<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="279">
<package pkgid="59276c8bac519005024694b394d7a184fe9f7db2f44d1d7e152ed5a3c397b425" name="flightctl" arch="src">
  <version epoch="0" ver="0.11.0~main~4~gfe913e5a" rel="1.20250926142220273733.main.4.gfe913e5a.el9"/>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.11.0~main~4~gfe913e5a-1.20250926142220273733.main.4.gfe913e5a" date="1758888000">- EDM-2016: Credential Challenge documentation (#1709) (kkyrazis)
- EDM-2196: Add AAP details and update org docs (Dakota Crowder)
- NO-ISSUE: Include pkg in unit tests (#1712) (kkyrazis)</changelog>
</package>
<package pkgid="caa84adf20d3848f8bbdcf5ddb593939cdf7da01defee7f8f49c0507f9373e99" name="flightctl" arch="aarch64">
  <version epoch="0" ver="0.3.0" rel="1.20250114101550685707.main.262.gf57716d.el9"/>
  <changelog author="Ricardo Noriega &lt;rnoriega@redhat.com&gt; - 0.0.1-3" date="1710331200">- New specfile for both CLI and agent packages</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.0.1-4" date="1723032000">- Add basic greenboot support for failed flightctl-agent service</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.0.1-5" date="1724241600">- Add must-gather script to provide a simple mechanism to collect agent debug</changelog>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.3.0-1" date="1730721600">- Move the Release field to -1 so we avoid auto generating packages
  with -5 all the time.</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.3.0-1.20250114101550685707.main.262.gf57716d" date="1736856000">- EDM-967: Add identity information for K8S (#785) (Ori Amizur)
- EDM-1021: applications: add controller sync test (Sam Batschelet)
- EDM-1021: applications: ensure id is deterministic (Sam Batschelet)
- EDM-1015: Add note in docs about go template syntax (Avishay Traeger)
- EDM-992: Validate URL for login cmd (#777) (Rastislav Wagner)
- EDM-983: Testing for Filtering (Eldar101)
- EDM-710: Validate Repository Spec Selectors Using GenericRepoSpec (#769) (Assaf Albo)
- EDM-1017: Replace variables in git config mountPath (Avishay Traeger)
- EDM-390: Update device lifecycle status based on Condition (Lily Sturmann)
- EDM-391: add lifecycle manager (Sam Batschelet)
- NO-ISSUE: Add shortcut 'k' for 'insecure-skip-tls-verify' flag (#778) (Rastislav Wagner)
- EDM-869: TC75506 Resources lifecycle (#687) (amalykhi)
- NO-ISSUE: Small fix in template variables doc (sserafin)
- EDM-821: Support pure k8s authN (rawagner)
- Revert "EDM-773: Update charts to support deployment via ACM operator" (#772) (Rastislav Wagner)
- EDM-969: applications: ensure unique ID (Sam Batschelet)
- EDM-969: applications: add internal support for tracking by ID (Sam Batschelet)
- EDM-390: Add decommission spec to rendered device config (Lily Sturmann)
- EDM-943: Add document describing k8s RBAC authorization (Ori Amizur)
- EDM-390: Set decommission request in device spec (Lily Sturmann)
- EDM-390: Add decommission request to device spec (Lily Sturmann)
- EDM-1008: Add permissions check for device console (#763) (Rastislav Wagner)
- EDM-1005: Fix selector behavior for NULL columns in the database (#762) (Assaf Albo)
- EDM-1011: CLI to request device count when listing fleets (Avishay Traeger)
- EDM-1010: Fix template variable for inline config path (Avishay Traeger)
- EDM-526: policy: ensure DST is properly covered (Sam Batschelet)
- EDM-970: Fix K8S_RBAC_NS value for ACM deployment (#759) (Rastislav Wagner)
- EDM-773: Update charts to support deployment via ACM operator (#760) (Rastislav Wagner)
- EDM-526: policy: improve logging (Sam Batschelet)
- EDM-526: device: ensure policy has an escape hatch (Sam Batschelet)
- EDM-526: policy: add schedule tests and improve logic (Sam Batschelet)
- EDM-526: api: install tzdata for time zone validation (Sam Batschelet)
- EDM-526: spec/queue: refactor (Sam Batschelet)
- EDM-526: device: update status to align with policy checks and docs (Sam Batschelet)
- EDM-526: spec/queue: improve docs (Sam Batschelet)
- EDM-526: plumb update policy (Sam Batschelet)
- EDM-526: agent: add update policy (Sam Batschelet)
- Integrate Labels and Annotations Filtering into Selector Framework (#751) (Assaf Albo)
- EDM-768: Align createOrUpdate (Frank A. Zdarsky)
- EDM-768: Fix properties next to ref linting issue (Frank A. Zdarsky)
- EDM-768: Fix PascalCase linting issue (Frank A. Zdarsky)
- EDM-768: Fix linting issues (Frank A. Zdarsky)
- EDM-822: Container port (Eldar101)
- EDM-781: Field selectors tests (Eldar Weiss)
- EDM-390: Set enrolled devices to 'Enrolled' lifecycle status (Lily Sturmann)
- EDM-954: Use approved RabbitMQ (Avishay Traeger)
- EDM-819: Remove any unnecessary helm for the gRPC endpoint (Miguel Angel Ajo)
- EDM-818: gRPC and agent HTTPS under the same endpoint (Miguel Angel Ajo)
- EDM-955: Use approved Redis (Avishay Traeger)
- NO-ISSUE: Collect logs in smoke/e2e github workflows (Avishay Traeger)
- EDM-922: Fine-tune HTTP server settings (Avishay Traeger)
- EDM-953: Use approved Postgres (Avishay Traeger)
- NO-ISSUE: omit grpc from make generate (Sam Batschelet)
- EDM-649: Update CSR error codes to be more expressive and accurate (Lily Sturmann)
- NO-ISSUE: reduce scope of bootc API (Sam Batschelet)
- Revert "NO-ISSUE: helm: unblock CI pin rabbitmq" (Sam Batschelet)
- EDM-390: Add decommission CLI command (Lily Sturmann)
- EDM-390: Small fix for decommission target type (Lily Sturmann)
- NO-ISSUE: troubleshooting: add basic agent debug (Sam Batschelet)
- EDM-948: Allow specifying Namespace for k8s RBAC checks (#736) (Rastislav Wagner)
- EDM-870: flightctl console cli on web socket (#731) (Miguel Angel Ajo Pelayo)
- MGMT-18492: Add logical support for reboot hooks (Sam Batschelet)
- EDM-390: Add lifecyclestatus to devicestatus (Lily Sturmann)
- NO-ISSUE: libvirt-dev should always be installed (Miguel Angel Ajo)
- NO-ISSUE: Implement Go tools pattern (Frank A. Zdarsky)
- NO-ISSUE: Update GH runner (Frank A. Zdarsky)
- EDM-390: Add decommissioning field to rendered device spec (Lily Sturmann)
- NO-ISSUE: packaging: add flightctl agent version to must-gather (Sam Batschelet)
- NO-ISSUE: metrics: register flightctl_api_errors_client_total (Sam Batschelet)
- EDM-391: Add 'decommissioning' Condition and Reasons for device (Lily Sturmann)
- NO-ISSUE: Use a password for accessing Valkey (Avishay Traeger)
- NO-ISSUE: Move key-value code out of tasks package (Avishay Traeger)
- EDM-854: Use go-templates for fleet template parameters (Avishay Traeger)
- NO-ISSUE: helm: unblock CI pin rabbitmq (Sam Batschelet)
- EDM-879: improve service generated app status (Sam Batschelet)
- EDM-886: correctly fmt service side app status (Sam Batschelet)
- EDM-526: ensure errors reported by os.exec are properly handeled (Sam Batschelet)
- EDM-870: ws console wiring (Miguel Angel Ajo)
- EDM-870: Move console request/connection to websocket (Miguel Angel Ajo)
- EDN-860: Add permission checks for all API endpoints (Ori Amizur)
- NO-ISSUE: Fix OpenAPI descriptions (Frank A. Zdarsky)
- EDM-848: revert tzdata host mount (#690) (Sam Batschelet)
- EDM-876: Fix helm template error (Celia Amador)
- EDM-788: Add init script for PostgreSQL to set master user as superuser (#679) (Assaf Albo)
- EDM-838: Update ACM registration doc (Frank A. Zdarsky)
- NO-ISSUE: redeploy kind pods for development (Miguel Angel Ajo)
- NO-ISSUE: move ownership od status exporters to managers (Sam Batschelet)
- EDM-853: spec/queue: ensure item requeue backoff only if tried  (#696) (Sam Batschelet)
- EDM-642: Remove sorting mechanism for TP phase (#701) (Assaf Albo)
- MGMT-17672: Document device statuses (Frank A. Zdarsky)
- EDM-417: Get renderedVersion from DB (Frank A. Zdarsky)
- EDM-417: Update unit-tests for server-side status (Frank A. Zdarsky)
- EDM-417: Do not report retries, fail faster (Frank A. Zdarsky)
- EDM-417: Compute service-side status (Frank A. Zdarsky)
- EDM-649: Add specific error message when CSR approval fails (Lily Sturmann)
- EDM-649: Remove extraneous CN len check (Lily Sturmann)
- EDM-842: transient networking error should not mark agent degraded (Sam Batschelet)
- EDM-772: Move UI chart to main repo (#673) (Rastislav Wagner)
- NO-ISSUE: agent: ensure bootstrap status (Sam Batschelet)
- EDM-761: Document lifecycle hooks (Frank A. Zdarsky)
- EDM-764: Update Hooks API implementation (Frank A. Zdarsky)
- EDM-764: Update Hooks API (Frank A. Zdarsky)
- EDM-659: agent/fileio: ensure ignition gid, uid and mode (Sam Batschelet)
- NO-ISSUE: Pass internalOpenShiftApiUrl from values to api-config CM (#680) (Rastislav Wagner)
- EDM-424: add update policy api and validation (Sam Batschelet)
- EDM-420: Increase DB parameters (#669) (Gregory Shilin)
- NO-ISSUE: Append UI port to valid redirect URIs (rawagner)
- EDM-390: Add decommissioning route to device API (Lily Sturmann)
- EDM-417: Centralize API consts (Frank A. Zdarsky)
- NO-ISSUE: add command to prepare e2e test (sserafin)
- EDM-621: Fix microshift registration docs (Avishay Traeger)
- EDM-767: Actually update ignition mount path (Avishay Traeger)
- EDM-708: Reduce git access (Avishay Traeger)
- NO-ISSUE: Remove duplicated code in git helpers (Avishay Traeger)
- MGMT-17672: device: align update status phases (Sam Batschelet)
- Add developer documentation for field-selector (#658) (Assaf Albo)
- EDM-681: Allow field selector when 'summaryOnly' is enabled (#656) (Assaf Albo)
- EDM-704: Automate test 75991 (sserafin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: created a document with instructions to run devicesimulator (Gregory Shilin)
- EDM-695: Logger verbosity flag was added (-v) (#651) (Gregory Shilin)
- EDM-423: Fix lexer state for nested exists/notexists selectors (#655) (Assaf Albo)
- EDM-423: Adapt K8s lexer to support RHS equality symbol (asafbss)
- EDM-423: Modify k8s containment operator; remove support for 'in' and 'notin' on JSON fields (asafbss)
- EDM-423: Remove selector casting; implement a whitelist of selectors per resource for stricter filtering (asafbss)
- EDM-423: Move alias back to label in API while keeping it as a field in device model (asafbss)
- EDM-423: Add documentation for Field Selectors (asafbss)
- EDM-666: Updated selector names to match the documented API (asafbss)
- EDM-664: Added selector support for Spec field in field-selector (asafbss)
- EDM-423: Introduce Alias Field for Device Metadata (asafbss)
- EDM-423: Add more Kubernetes operators to enhance selectors for fields (asafbss)
- EDM-423: Kubernetes vanilla label selector (asafbss)
- NO-ISSUE: Fix linter and spellchecker issues (Frank A. Zdarsky)
- NO-ISSUE: Fix path-filter (Frank A. Zdarsky)
- EDM-694: Add Valkey key value store service (Ricardo Noriega)
- EDM-694: Use primary IP and nip.io domains (Ricardo Noriega)
- EDM-694: Add FlightCtl Network to slice (Ricardo Noriega)
- EDM-694: Add Makefile Quadlet targets for deploy and clean (Ricardo Noriega)
- EDM-694: Initial FlightCtl deployment with Quadlets (Ricardo Noriega)
- NO-ISSUE: Update config storage API (Avishay Traeger)
- EDM-578: Remove templateversion populate task (Avishay Traeger)
- EDM-582: Freeze HTTP configurations (Avishay Traeger)
- EDM-583: Freeze k8s secret configurations (Avishay Traeger)
- EDM-581: Freeze git configurations (Avishay Traeger)
- NO-ISSUE: Remove device's TV annotation if removed from fleet (Avishay Traeger)
- EDM-580: Deploy Valkey for frozen configurations (Avishay Traeger)
- EDM-578: Separate fleet validate and device render logic (Avishay Traeger)
- EDM-420: Enable to run devicesimulator on multiple hosts (#650) (Gregory Shilin)
- NO-ISSUE: Improve UpdateDeviceWithRetries to handle all errors (Miguel Angel Ajo)
- EDM-446: device/fileio: ensure readable paths in PathExists (Sam Batschelet)
- EDM-656: agent: clarify completed status (Sam Batschelet)
- EDM-656: agent: ensure Shutdown is threadsafe (Sam Batschelet)
- EDM-656: agent/device improve systemd status reporting (Sam Batschelet)
- NO-ISSUE: console: simplify exec test case (Sam Batschelet)
- EDM-673: Enable exposing APIs via Gateway (rawagner)
- EDM-650: Load k8s ca.crt when deployed on k8s (rawagner)
- EDM-482: node-exporter conatainer failed to start due the Failed to open directory, disabling udev device properties (Ori Amizur)</changelog>
</package>
<package pkgid="c08a0ead554c105ccd0b27b83ee7a5122c50e4a8fb292ab603c9d4fe43fde607" name="flightctl" arch="src">
  <version epoch="0" ver="0.3.0" rel="1.20250114101550685707.main.262.gf57716d.el9"/>
  <changelog author="Ricardo Noriega &lt;rnoriega@redhat.com&gt; - 0.0.1-3" date="1710331200">- New specfile for both CLI and agent packages</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.0.1-4" date="1723032000">- Add basic greenboot support for failed flightctl-agent service</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.0.1-5" date="1724241600">- Add must-gather script to provide a simple mechanism to collect agent debug</changelog>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.3.0-1" date="1730721600">- Move the Release field to -1 so we avoid auto generating packages
  with -5 all the time.</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.3.0-1.20250114101550685707.main.262.gf57716d" date="1736856000">- EDM-967: Add identity information for K8S (#785) (Ori Amizur)
- EDM-1021: applications: add controller sync test (Sam Batschelet)
- EDM-1021: applications: ensure id is deterministic (Sam Batschelet)
- EDM-1015: Add note in docs about go template syntax (Avishay Traeger)
- EDM-992: Validate URL for login cmd (#777) (Rastislav Wagner)
- EDM-983: Testing for Filtering (Eldar101)
- EDM-710: Validate Repository Spec Selectors Using GenericRepoSpec (#769) (Assaf Albo)
- EDM-1017: Replace variables in git config mountPath (Avishay Traeger)
- EDM-390: Update device lifecycle status based on Condition (Lily Sturmann)
- EDM-391: add lifecycle manager (Sam Batschelet)
- NO-ISSUE: Add shortcut 'k' for 'insecure-skip-tls-verify' flag (#778) (Rastislav Wagner)
- EDM-869: TC75506 Resources lifecycle (#687) (amalykhi)
- NO-ISSUE: Small fix in template variables doc (sserafin)
- EDM-821: Support pure k8s authN (rawagner)
- Revert "EDM-773: Update charts to support deployment via ACM operator" (#772) (Rastislav Wagner)
- EDM-969: applications: ensure unique ID (Sam Batschelet)
- EDM-969: applications: add internal support for tracking by ID (Sam Batschelet)
- EDM-390: Add decommission spec to rendered device config (Lily Sturmann)
- EDM-943: Add document describing k8s RBAC authorization (Ori Amizur)
- EDM-390: Set decommission request in device spec (Lily Sturmann)
- EDM-390: Add decommission request to device spec (Lily Sturmann)
- EDM-1008: Add permissions check for device console (#763) (Rastislav Wagner)
- EDM-1005: Fix selector behavior for NULL columns in the database (#762) (Assaf Albo)
- EDM-1011: CLI to request device count when listing fleets (Avishay Traeger)
- EDM-1010: Fix template variable for inline config path (Avishay Traeger)
- EDM-526: policy: ensure DST is properly covered (Sam Batschelet)
- EDM-970: Fix K8S_RBAC_NS value for ACM deployment (#759) (Rastislav Wagner)
- EDM-773: Update charts to support deployment via ACM operator (#760) (Rastislav Wagner)
- EDM-526: policy: improve logging (Sam Batschelet)
- EDM-526: device: ensure policy has an escape hatch (Sam Batschelet)
- EDM-526: policy: add schedule tests and improve logic (Sam Batschelet)
- EDM-526: api: install tzdata for time zone validation (Sam Batschelet)
- EDM-526: spec/queue: refactor (Sam Batschelet)
- EDM-526: device: update status to align with policy checks and docs (Sam Batschelet)
- EDM-526: spec/queue: improve docs (Sam Batschelet)
- EDM-526: plumb update policy (Sam Batschelet)
- EDM-526: agent: add update policy (Sam Batschelet)
- Integrate Labels and Annotations Filtering into Selector Framework (#751) (Assaf Albo)
- EDM-768: Align createOrUpdate (Frank A. Zdarsky)
- EDM-768: Fix properties next to ref linting issue (Frank A. Zdarsky)
- EDM-768: Fix PascalCase linting issue (Frank A. Zdarsky)
- EDM-768: Fix linting issues (Frank A. Zdarsky)
- EDM-822: Container port (Eldar101)
- EDM-781: Field selectors tests (Eldar Weiss)
- EDM-390: Set enrolled devices to 'Enrolled' lifecycle status (Lily Sturmann)
- EDM-954: Use approved RabbitMQ (Avishay Traeger)
- EDM-819: Remove any unnecessary helm for the gRPC endpoint (Miguel Angel Ajo)
- EDM-818: gRPC and agent HTTPS under the same endpoint (Miguel Angel Ajo)
- EDM-955: Use approved Redis (Avishay Traeger)
- NO-ISSUE: Collect logs in smoke/e2e github workflows (Avishay Traeger)
- EDM-922: Fine-tune HTTP server settings (Avishay Traeger)
- EDM-953: Use approved Postgres (Avishay Traeger)
- NO-ISSUE: omit grpc from make generate (Sam Batschelet)
- EDM-649: Update CSR error codes to be more expressive and accurate (Lily Sturmann)
- NO-ISSUE: reduce scope of bootc API (Sam Batschelet)
- Revert "NO-ISSUE: helm: unblock CI pin rabbitmq" (Sam Batschelet)
- EDM-390: Add decommission CLI command (Lily Sturmann)
- EDM-390: Small fix for decommission target type (Lily Sturmann)
- NO-ISSUE: troubleshooting: add basic agent debug (Sam Batschelet)
- EDM-948: Allow specifying Namespace for k8s RBAC checks (#736) (Rastislav Wagner)
- EDM-870: flightctl console cli on web socket (#731) (Miguel Angel Ajo Pelayo)
- MGMT-18492: Add logical support for reboot hooks (Sam Batschelet)
- EDM-390: Add lifecyclestatus to devicestatus (Lily Sturmann)
- NO-ISSUE: libvirt-dev should always be installed (Miguel Angel Ajo)
- NO-ISSUE: Implement Go tools pattern (Frank A. Zdarsky)
- NO-ISSUE: Update GH runner (Frank A. Zdarsky)
- EDM-390: Add decommissioning field to rendered device spec (Lily Sturmann)
- NO-ISSUE: packaging: add flightctl agent version to must-gather (Sam Batschelet)
- NO-ISSUE: metrics: register flightctl_api_errors_client_total (Sam Batschelet)
- EDM-391: Add 'decommissioning' Condition and Reasons for device (Lily Sturmann)
- NO-ISSUE: Use a password for accessing Valkey (Avishay Traeger)
- NO-ISSUE: Move key-value code out of tasks package (Avishay Traeger)
- EDM-854: Use go-templates for fleet template parameters (Avishay Traeger)
- NO-ISSUE: helm: unblock CI pin rabbitmq (Sam Batschelet)
- EDM-879: improve service generated app status (Sam Batschelet)
- EDM-886: correctly fmt service side app status (Sam Batschelet)
- EDM-526: ensure errors reported by os.exec are properly handeled (Sam Batschelet)
- EDM-870: ws console wiring (Miguel Angel Ajo)
- EDM-870: Move console request/connection to websocket (Miguel Angel Ajo)
- EDN-860: Add permission checks for all API endpoints (Ori Amizur)
- NO-ISSUE: Fix OpenAPI descriptions (Frank A. Zdarsky)
- EDM-848: revert tzdata host mount (#690) (Sam Batschelet)
- EDM-876: Fix helm template error (Celia Amador)
- EDM-788: Add init script for PostgreSQL to set master user as superuser (#679) (Assaf Albo)
- EDM-838: Update ACM registration doc (Frank A. Zdarsky)
- NO-ISSUE: redeploy kind pods for development (Miguel Angel Ajo)
- NO-ISSUE: move ownership od status exporters to managers (Sam Batschelet)
- EDM-853: spec/queue: ensure item requeue backoff only if tried  (#696) (Sam Batschelet)
- EDM-642: Remove sorting mechanism for TP phase (#701) (Assaf Albo)
- MGMT-17672: Document device statuses (Frank A. Zdarsky)
- EDM-417: Get renderedVersion from DB (Frank A. Zdarsky)
- EDM-417: Update unit-tests for server-side status (Frank A. Zdarsky)
- EDM-417: Do not report retries, fail faster (Frank A. Zdarsky)
- EDM-417: Compute service-side status (Frank A. Zdarsky)
- EDM-649: Add specific error message when CSR approval fails (Lily Sturmann)
- EDM-649: Remove extraneous CN len check (Lily Sturmann)
- EDM-842: transient networking error should not mark agent degraded (Sam Batschelet)
- EDM-772: Move UI chart to main repo (#673) (Rastislav Wagner)
- NO-ISSUE: agent: ensure bootstrap status (Sam Batschelet)
- EDM-761: Document lifecycle hooks (Frank A. Zdarsky)
- EDM-764: Update Hooks API implementation (Frank A. Zdarsky)
- EDM-764: Update Hooks API (Frank A. Zdarsky)
- EDM-659: agent/fileio: ensure ignition gid, uid and mode (Sam Batschelet)
- NO-ISSUE: Pass internalOpenShiftApiUrl from values to api-config CM (#680) (Rastislav Wagner)
- EDM-424: add update policy api and validation (Sam Batschelet)
- EDM-420: Increase DB parameters (#669) (Gregory Shilin)
- NO-ISSUE: Append UI port to valid redirect URIs (rawagner)
- EDM-390: Add decommissioning route to device API (Lily Sturmann)
- EDM-417: Centralize API consts (Frank A. Zdarsky)
- NO-ISSUE: add command to prepare e2e test (sserafin)
- EDM-621: Fix microshift registration docs (Avishay Traeger)
- EDM-767: Actually update ignition mount path (Avishay Traeger)
- EDM-708: Reduce git access (Avishay Traeger)
- NO-ISSUE: Remove duplicated code in git helpers (Avishay Traeger)
- MGMT-17672: device: align update status phases (Sam Batschelet)
- Add developer documentation for field-selector (#658) (Assaf Albo)
- EDM-681: Allow field selector when 'summaryOnly' is enabled (#656) (Assaf Albo)
- EDM-704: Automate test 75991 (sserafin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: typo fix (Gregory Shilin)
- EDM-695: created a document with instructions to run devicesimulator (Gregory Shilin)
- EDM-695: Logger verbosity flag was added (-v) (#651) (Gregory Shilin)
- EDM-423: Fix lexer state for nested exists/notexists selectors (#655) (Assaf Albo)
- EDM-423: Adapt K8s lexer to support RHS equality symbol (asafbss)
- EDM-423: Modify k8s containment operator; remove support for 'in' and 'notin' on JSON fields (asafbss)
- EDM-423: Remove selector casting; implement a whitelist of selectors per resource for stricter filtering (asafbss)
- EDM-423: Move alias back to label in API while keeping it as a field in device model (asafbss)
- EDM-423: Add documentation for Field Selectors (asafbss)
- EDM-666: Updated selector names to match the documented API (asafbss)
- EDM-664: Added selector support for Spec field in field-selector (asafbss)
- EDM-423: Introduce Alias Field for Device Metadata (asafbss)
- EDM-423: Add more Kubernetes operators to enhance selectors for fields (asafbss)
- EDM-423: Kubernetes vanilla label selector (asafbss)
- NO-ISSUE: Fix linter and spellchecker issues (Frank A. Zdarsky)
- NO-ISSUE: Fix path-filter (Frank A. Zdarsky)
- EDM-694: Add Valkey key value store service (Ricardo Noriega)
- EDM-694: Use primary IP and nip.io domains (Ricardo Noriega)
- EDM-694: Add FlightCtl Network to slice (Ricardo Noriega)
- EDM-694: Add Makefile Quadlet targets for deploy and clean (Ricardo Noriega)
- EDM-694: Initial FlightCtl deployment with Quadlets (Ricardo Noriega)
- NO-ISSUE: Update config storage API (Avishay Traeger)
- EDM-578: Remove templateversion populate task (Avishay Traeger)
- EDM-582: Freeze HTTP configurations (Avishay Traeger)
- EDM-583: Freeze k8s secret configurations (Avishay Traeger)
- EDM-581: Freeze git configurations (Avishay Traeger)
- NO-ISSUE: Remove device's TV annotation if removed from fleet (Avishay Traeger)
- EDM-580: Deploy Valkey for frozen configurations (Avishay Traeger)
- EDM-578: Separate fleet validate and device render logic (Avishay Traeger)
- EDM-420: Enable to run devicesimulator on multiple hosts (#650) (Gregory Shilin)
- NO-ISSUE: Improve UpdateDeviceWithRetries to handle all errors (Miguel Angel Ajo)
- EDM-446: device/fileio: ensure readable paths in PathExists (Sam Batschelet)
- EDM-656: agent: clarify completed status (Sam Batschelet)
- EDM-656: agent: ensure Shutdown is threadsafe (Sam Batschelet)
- EDM-656: agent/device improve systemd status reporting (Sam Batschelet)
- NO-ISSUE: console: simplify exec test case (Sam Batschelet)
- EDM-673: Enable exposing APIs via Gateway (rawagner)
- EDM-650: Load k8s ca.crt when deployed on k8s (rawagner)
- EDM-482: node-exporter conatainer failed to start due the Failed to open directory, disabling udev device properties (Ori Amizur)</changelog>
</package>
<package pkgid="1450b506b9d4f8b75dd785d77bfb069368e5635b0e846b5aa8629b27131fac24" name="flightctl" arch="src">
  <version epoch="0" ver="1.2.0~main~27~gb5c1b040" rel="1.20260204153358102810.main.27.gb5c1b040.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.2.0~main~27~gb5c1b040-1.20260204153358102810.main.27.gb5c1b040" date="1770206400">- NO-ISSUE: missing network policy for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Bump resourcesync e2e task timeout value (Dakota Crowder)
- NO-ISSUE: Add e2e harness setup without VMs and use for ResourceSync tests (Dakota Crowder)
- EDM-3265: build cs9 microshift image only if the repo is accessible (Ilya Skornyakov)
- EDM-3262: fixed cancel not working properly for pending states (Asaf Ben Natan)
- EDM-3263: when defaulting to HOST_FQDN -&gt; lowercase it (Asaf Ben Natan)
- EDM-3005: update ginkgo_total_nodes (Gregory Shilin)
- EDM-3005: update ginkgo_total_nodes to be 2 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Add cs10-specific error message support (Gregory Shilin)
- EDM-3005: Add running cs10-bootc e2e tests. Fix certificate handling (Gregory Shilin)
- NO-ISSUE: Disable rollback test temporarily (Ilya Skornyakov)
- NO-ISSUE: imagebuild api set to v1alpha1 (Asaf Ben Natan)
- EDM-3258: EDM-3257,operator cant cancel fix (Asaf Ben Natan)
- NO-ISSUE: fix Publish Binaries workflow (Ilya Skornyakov)
- EDM-2985: fix imports post-merge (Ilya Skornyakov)
- EDM-2985: add unit tests (Ilya Skornyakov)
- EDM-2985: validate header value (Ilya Skornyakov)
- EDM-2985: Add API version to HTTP request logs (Ilya Skornyakov)
- NO-ISSUE: repo url + entitlements support (Asaf Ben Natan)
- NO-ISSUE: Updated init container quadlet files to ensure everything in standardoutput and standarderror shows up in journal (Ram)
- NO-ISSUE: Add TC ID 87279 to greenboot rollback test (amalykhi)
- EDM-2636: Rootless Quadlets (Ben Keith)
- EDM-3226: fixes invalid chars attempted to be saved to psql (Asaf Ben Natan)
- EDM-6163: Skip kind test (Eldar Weiss)
- NO-ISSUE: MVC separation (Asaf Ben Natan)</changelog>
</package>
<package pkgid="187cee948dc10e74fec01d1400b2021522a7f1f397c89cdfd5bc3cce1617a140" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="be19d890d3c6f2977e8ee0f741ccd9b0af9d02d412d5ba299d0d2d034ac1eb79" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="55d84c56d66fc5e0e35181aa6848502e0fc2aa7b59c93bd9dcd91ee8f0dd73c2" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2ecd14480f4836590226598ba9bf1c54f4dcd8e2fb73a9b06a1204da3ceed73c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bc07cafc3ca75b4463f4b7683fa70b2239b89697ccad4abb0bade05cb98baab2" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ea06dc5770bdad2b09d38f0cff98782b4f078827357e5833c609d38e4f772c42" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1f87241f4eb9cd4f6bc812ed23ec9bbb727e31fd0f27e2b50c8f049985798e32" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c1022592bed937c74175e2230c93c6bd042d25cb2f2bd6403706051a28e1ec24" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9be411f5ad18ee5dad715de020f039ea0a5fe94c229f6d9dbdcd23f6ec762809" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6bfb2bdeacdc5c9941224f1fd8d7868486b7e92b8b16585b766d9eb6e1bc1a10" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f2af099683c0f5badb42cb829b0b4d1f723d738315728eb96561d610591072dc" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4d02f47177da0f72d4d081bba1215144d347a4912c2d0c62d4b320165fd33a4f" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cf15066002e61a621f9e217df13735d9abc75b79259fbe67212800a5aed3d92b" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="79c483964945058b38e0578ccbfca8babf5e14fa95540b9b3e9a37ad9431344c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7cae24e678a9dafd31ca41a0d4de9f138a18c479b0f26b06dccee8fce8d8feea" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4104363df116fa82f93f7ea8114fe6a12d1d16f4fc80c96d8c25f436978577c7" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d31942ede20808d2e5e125ee2c1da554a09e0eb3f82f24a937e887eaa522fb76" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4a325e8a25aea18792d28bed696a994efd26f35d3fb994ae107353c5e0098f6c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f05821fddd19f021ea91dd82f8fe0705d2272c6372d55b3cb2c13e3ea902884d" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6471584fb18b68f15affc7e8db78215defe8f87d0c7bca10f041d29d1a81b640" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f29513b79198b28842f0349a366179d5c6c03ffd8751e712da7a94f46cf55f91" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="922ecf30faa48c17f8f6f92b536b29fc473978b84dc7615f2ee264d8d78d9a37" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c2a136a56eb64932a5e276948623f116163dbb0c22c5ff43ff6253fca28de526" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9b85b7182941f0f6babda10075f1a5f8930382727c8238968a7354318b474b02" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d4fb90d2480511be511a80f991dfa18fa9a3621349f9290c2888c2600a3f9a9c" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d767efeeb8eaa0679c29bb4fe2719cc595ba0347076bbc57a852073574d8271f" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~14~g552be8c2" rel="1.20260812085853033689.main.14.g552be8c2.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~14~g552be8c2-1.20260812085853033689.main.14.g552be8c2" date="1786536000">- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1ac70d5a6b17b09a258f5402d8d9f08c4a827c05956d1dbbac762250aa1fc48c" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~16~g5d69c1a0" rel="1.20260812133922490008.main.16.g5d69c1a0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~16~g5d69c1a0-1.20260812133922490008.main.16.g5d69c1a0" date="1786536000">- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9a12f1253457f7acc21de335ba8b0fae6436e2d916dbdacd821ced7e5b47db69" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~17~g1dee52fb" rel="1.20260812153145429044.main.17.g1dee52fb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~17~g1dee52fb-1.20260812153145429044.main.17.g1dee52fb" date="1786536000">- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d55a7c9d137b979b6468f45355e6065066638d500840fd81d85af40e388d2b51" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~18~g9c8ebb91" rel="1.20260813095420387555.main.18.g9c8ebb91.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~18~g9c8ebb91-1.20260813095420387555.main.18.g9c8ebb91" date="1786622400">- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="89ecb1a49a60f51900f0cd9646ad33c96d2a8fce636da015b4010a68539270a9" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~19~g500f34e9" rel="1.20260813130813735207.main.19.g500f34e9.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~19~g500f34e9-1.20260813130813735207.main.19.g500f34e9" date="1786622400">- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="213e83ccdc272dab603fb5927dd4b0cfe65200f77386f7799cffb5ee8185f596" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6a4c62f6c092882482f72d6fc8138556de2e6f6a4f87dd808e613d8af1ffeed8" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~20~g42e18f79" rel="1.20260813163125863683.main.20.g42e18f79.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~20~g42e18f79-1.20260813163125863683.main.20.g42e18f79" date="1786622400">- Fixes #3347: Add aarch64 container image builds   (#3226) (kkyrazis)
- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e04c83f4d6c6f721fc726dade9a28a80d16873de162dde8fb59e0dbcc5d510a9" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f29a1ab021ad4b4857dc49eaf2484688ae869ebe1bf8b43fb412fd9a19229c8f" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="23d967d6b7ae2bc9f8422fd82c9596bbc4e9c627c273e6fc06bc24eb43562a73" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="805c0bd0299356073bb2c564985993a2de66c463978c78047cc7ef750c0e7420" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="88b112984f375c3b82face5dd2117419f1af42ac991badd803621f180e6a4472" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="403382d0bf7639dc7f939852dafdf82b4fe9b1333563f9738bcb32b1d34b7a83" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0851d2a11026e8d23ddbd87a70116f70472ec1df4ccc847a819fa5b462780700" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3a3788cf34ba0901e77d9be40d9aa85802e33c8ab9747b65a2793bd2c72a3e42" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bb6a6a1b4704f887992c15671aa32d5ba26765655f9fba83073e915cab7bf4b3" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8e322304c1a896e3439e3ce00edea574e7e5ba9b02bebbda6eb4057eac0f6ad3" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="528ac9c915a1ade3497f874ed49d07292217d9a451736e8d0ad1dccb3b0f0e0d" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="056f9eacf0853a853e0858746bcec08cd3141c866ae4e169baeb85d8f7693cdd" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="583494ea59ce502d5a466b0ac9dc1060d2d05d13a7aa2dce6d2a6050b77b5858" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cddd5c9a32197d5accb9c6d94c5081077c3a741bb8ccd0b8b2b0fd7da4c459c0" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5c683bdc84000e9a534345d6fa8fd9861a84951f04a7d25f43894effc69cfedf" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="67d5f34d3ef067220d349d877d63aebbf19632b0eef7dde54a3dddbf2060ed0c" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6cd052aa7b87d6e1f6029e8267cfdfa7113f09404918966bbfcc3f0cf97556eb" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7fab6175f509580a52c228ef74a344c545ac442b83d723e49fdde1f55028c557" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="12da655831f6b3b1aafe1aaf9e0e636452e60e89b7b17fbce81f5de8075ae977" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a3c3a2dffe8d128f22c3c75ca28146b0792f0fad121f86e50a63a6d1f8a02a33" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ff67b7cf7521ac42fb92465512a5de19308e1d80d1b389a253be6489e4e16fdc" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0ea871871b2c3dc4b72bc2f71d2225a515e9299bf64eb78249549eb7fdce155d" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8bcbfd63f05ac32921525e9c240b8b7a7dd82dfcd8dd435f756c98f4dd388a3b" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8b10a212e03599b75cd3cc7d40029dc955c1cb04dfb4db119854f988ed6c682e" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9457668ba1e79a0108c138163176ac721516b0f9483482472a0d4e4c110c5a09" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a527eabd663f692d7fd2fff2b3bbcc6900372bd01ec5bf730e99e5d677bf300a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7760ce093be1575fc88df90713998be2123231371bc75d101487f0cf0b3ec371" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f90a1647a38c19f57994de42c5053fe99f990c21c4818005c3457ec12f52e3f8" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e31047313ad280f46fbfab4cf008cf9ab30fe992b5cb73ff0e3b5571e3bb9851" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="259c91a30e0fa5775600c7533391449256ebe3f397d93e198436f95ed66917ed" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ffd5a91311d99518674ead6e1b8b7a376797ab5ce4cd39119d699ce7850e6971" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="481bd23689fd7b998132cfc5edb0cc54fc3cbe7e2444edd536531b3075af93d3" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="174c5b1bba5f8371a35b81b133cfea51abc70b4207b5e75460479568edce8b09" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~14~g552be8c2" rel="1.20260812085853033689.main.14.g552be8c2.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~14~g552be8c2-1.20260812085853033689.main.14.g552be8c2" date="1786536000">- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0fb1ab7918128bce164a56834d7e64180069ee431925dbcc25b4b374d7925bd4" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~16~g5d69c1a0" rel="1.20260812133922490008.main.16.g5d69c1a0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~16~g5d69c1a0-1.20260812133922490008.main.16.g5d69c1a0" date="1786536000">- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6d455438369f9479a9629a14faffb400252e8bf7713679c6b956a4644a65a32d" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~17~g1dee52fb" rel="1.20260812153145429044.main.17.g1dee52fb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~17~g1dee52fb-1.20260812153145429044.main.17.g1dee52fb" date="1786536000">- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="81960006e6d7df30aec659be8cacf93eea16a1ac4771697c6c4583c0dbec9a3a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~18~g9c8ebb91" rel="1.20260813095420387555.main.18.g9c8ebb91.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~18~g9c8ebb91-1.20260813095420387555.main.18.g9c8ebb91" date="1786622400">- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c689db4244d12d11d63b3ae6b612ad81c2760a213d32acbcded790bb38a43168" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~19~g500f34e9" rel="1.20260813130813735207.main.19.g500f34e9.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~19~g500f34e9-1.20260813130813735207.main.19.g500f34e9" date="1786622400">- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f6d90b15824c87bac1d9ead122a06127c06e010f1bc2961e3cf8319de63ec788" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9d0a0957edde1272195c4802d3b1002f1f2b0d03b1e6adaab77458e5be994b7b" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~20~g42e18f79" rel="1.20260813163125863683.main.20.g42e18f79.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~20~g42e18f79-1.20260813163125863683.main.20.g42e18f79" date="1786622400">- Fixes #3347: Add aarch64 container image builds   (#3226) (kkyrazis)
- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0104d90441fb02dfc71cc6d59f044ac456b3a5523e2c52cf89d7261a018ca0bc" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="7c17bb63c2c8ecf0f985f4ae6342c0c17bcb30350f29f88a2659167ba3f8bc74" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d0ccdaa57c6617b73c1a16afd233790998e3385ff5a3e02f34bb0117ad656862" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e5ab114afa26416123275c0d095485b8a7da9d67a3ab518ee6b2eb7270e87569" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8c74c5e0e6ac1a89496e4d79ba3d857817c84217875e29df0f24145e956c568f" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="78970d5eb0bcd12887ddfe584ecc49625a7d0472ffd01b0b747a8648369d11d6" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ecf5e9899743abe3ddabd0f9e3959d4205015aaa2b56ea81660fe22b94bc254e" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4647341943ebafd670cc1cb1a2b00dc0e13d6487c06cff64d37e3fe6510dd0c0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0e1f3dbdf1d557cffda28f6b647535a004d70e6bab65b90881a2c9cd0c1a8c15" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d686a3b649c94215f0c4fb886e4f25e765bee327ae9ad6270ce3c7470393c03c" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a2309a452531647a9e7efc0350c0b015179a0efb2a3160bad00f34a6181168c7" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d161f1ce36e1d0d72a5c2a093cdc12485b0b3e3eca32e3fc365abe653d7a6b28" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6b0021395cce9a8c6f00aa3ba77d70ad48dc2c3f618d47de834629a25a1d73af" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bf247a61d5122351c6d71a4045cf4bd4dfa4f6000230943c9e5a72c63bbec174" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e7bada5edfde70bf2c74d995c31cadf065f3f3010b75840e6a16b736902741bb" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2dff644c4da3c741ce5f74e3f3e2ee674713e087351deb9bd91a8e5ef641cf3d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="41b4ab1f08b428879f1f3945ea8964325f1419ec7005ef888c236a3de0fadb8a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="59d2297dd07dbb7455e39303ec78781cfca1cd534c077a7fafe2845801480eb1" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cd9ecf5299d9dc099b61f7740cbe77e8c6181d8a7bebb1ad4cb4c191b3be6179" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="85f93d5382c22ad546113f6c9ded28762d90e9ef772da4b7152305bbc0a22f78" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="775ebc8a0e716bd4efc98bfd0a0aaf5445705d7a91250dd05d50c58d6978a63d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="147932d9c8f94097fce491e4ea01616981a9f450467f3a20fccdde8eeb452998" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ef572e73a26e294bbf610e85eecd3c3b1a2a2dfd9846724396db5d33161002c2" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="403e592d95797cd79545b0d1ec9d1a0d1e7efe16f4f478fcd9292d82d850fcf9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3c5f4be82699151f7a14ed30a31bf1d5423293e54461a8f45dfbb8b28ba45988" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1ac52c476553b35a06210c9c35cde3ce326cdcfc45a67a45f87d16203bc2dfc0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="551bbe8ab5b768c0d35585a63e79f36d860f553e636f33cf679362f94b793f33" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="10c5548dab90ace576c8fbebc938cb77034e39cdf4209fbc707bb702ef068cbe" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8c33179bdd88c1275e96b23f4740b044bea3adb193b4598597333471992c6056" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="33e9d0961b88e26f4b6563130b31182aaf3318d76d411b00a99e6d1c681a7011" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="5e906eb75ff778f3d146b9315a33605a8909af9c27aee36a724c75a802206f83" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="833e4b95abc2c6efb6a574a52ddce515350ba8661f6d7da1e84993c6f0bbde2c" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b198f72f5eafd1370c41632e82133967e0413bf268324ca9faff7f62bc0f6758" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~14~g552be8c2" rel="1.20260812085853033689.main.14.g552be8c2.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~14~g552be8c2-1.20260812085853033689.main.14.g552be8c2" date="1786536000">- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d0b3510541d11fcefd8222d171938e1463c915f7ce4a9df697a2f3aef6572e7f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~16~g5d69c1a0" rel="1.20260812133922490008.main.16.g5d69c1a0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~16~g5d69c1a0-1.20260812133922490008.main.16.g5d69c1a0" date="1786536000">- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c53ecaeb3edda9a81f715f28c09e2a5b61ae53422fc007f2039effc1b6d73155" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~17~g1dee52fb" rel="1.20260812153145429044.main.17.g1dee52fb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~17~g1dee52fb-1.20260812153145429044.main.17.g1dee52fb" date="1786536000">- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="165aea5f25f99b4592b4fd4604713f29451ea2aaec96747a8838c5004694cf84" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~18~g9c8ebb91" rel="1.20260813095420387555.main.18.g9c8ebb91.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~18~g9c8ebb91-1.20260813095420387555.main.18.g9c8ebb91" date="1786622400">- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ff56111a8ad0b9cdc7438ef8eb968c90c6c2800c7c2675a19383fc2e800ff807" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~19~g500f34e9" rel="1.20260813130813735207.main.19.g500f34e9.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~19~g500f34e9-1.20260813130813735207.main.19.g500f34e9" date="1786622400">- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c20b12a0ca00ba8deac9031f4369bcef8285381b0788dfd0230ffec1f636888f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6475413de6bd38128aabb1a116ac3db65dd2e9cf4143373727ede62de935fd6b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~20~g42e18f79" rel="1.20260813163125863683.main.20.g42e18f79.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~20~g42e18f79-1.20260813163125863683.main.20.g42e18f79" date="1786622400">- Fixes #3347: Add aarch64 container image builds   (#3226) (kkyrazis)
- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="eaf2b5310e38056bdacb834dd41ee29105d350ec069ab9d5d8737e85fae3b0ae" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="47a0c204313115a669686dcd00ddbbcab7bf99a463e34e58ca6d5384fabef981" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="058a1c3537daf24d6c95f47a629d51f16f9ca2a9f5d1b3830d80ff1f42d08558" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1bed7411efee339ce1719c17e05c9da037d124a1484e66fbfd6bff0e7ea794ca" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c8623755fdc7835e0d2562a802a331417ab952687f7a0a9093ca14c835314f95" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="5e3712cb73d56a65d39c57d2cf864a0f3ab27cdca302da0ad5dd8e98ce3a4b3a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8c2c7be152c72671402ab1dab28314f974f9cdd5c19ae793a351718dcdd17a92" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a8ccb25ef209ec00cd807d15e7c61cc6188bb4674997d28a0c11081a31daeee0" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2330def572ddcfca2a3d58d9e0afcdef74136c590b7f3196a1fca6ad9fc49904" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6397e11b9b08ce6d1878623fb998d513c8bf9f63dd281ca884efbc0fb5c89b36" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ca804c3a410abbc61877a4a0bd94ffb98173a82879d9d6f90d14332868463544" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="043a678b3f7c06e05b964878a7dba38749c65fb3086594736474d2f333a03c6e" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9329563e5ee697fb53db56773c1506e2700f2ca4910f2358e3dfd34744d3fa7e" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="71ae1075052eb23d45e445a2173c323ce246936ccb3d73f8f984af65d0047778" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cf184b1015ff3e29140174b8fb1e9072e944a243b7ad12e1c899ca2893307b05" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9d146f09857b31e379827c4e7e4237b76e690a69357c6e441056772dc1ae2b0a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d82d002ccc22bbaa7a6b345d0e80956aabce09b7520e95990fe02021893e2184" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1fb3164c359574299e8156132660da31f7c78d74ba5d3e68a1ff9ea4ddf32e26" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c8b7277a27184080b06ea5e3a0f66248b78c543fc99883fb5712863f97998d43" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e23252157e8ab328916367d2eb606cc1ed405ef3e1723cd6badfb1eba8222f02" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="597847e079ef05dd54e3dcbe02aeb650f4cc399e46a901b7da9175f30d26aea2" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0221857a5cb35c994d4c808c1e80657fa5d43137003a034bd7c26137f81e6239" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e26ad63dc5987059a0c04efe3ed767ce5d85a8c93ece179886995249e64431c5" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f7d2c936ace535fbcd0d201785d98e0c3fdd6d60f98f09505ed8651e49ecdfb8" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4e0ce50d2d11685c6049489c01836902a2bef6ba4374e47ef8c59fa59a36400a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="09edce4846c31054b45864e2ba18982a56ade25015e0aab8137a3613783acb4f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1d5d7d71799756839c1a5d21d38ed838d48c0f812ecb9f10fd690d94c4dfa107" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a22240c43b25eb312c9c5ebad58abbd16eb9111abf80b6b7f691d5b3ea4a9da0" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3f9b6935b256bab1beb0708e8ef27db704805024fbb5ad1b825184e6b154d0a2" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="23ae8171171023484a9240ee8122ca596cbd85fd3b74eaf2276a4dc8ee6dde53" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0827cfa4e3096a2d8fd066ccf865e3718fe8e61d4bfa584ffa026618a32852ca" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cd8f0282590033a20596f8bf5fe9f383e25b39cea4329db1ae01776681e0a3cb" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d0f200a417eaac2860ef4e03dd02e9455ff1d438140df3bbdc404ded4e616372" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~14~g552be8c2" rel="1.20260812085853033689.main.14.g552be8c2.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~14~g552be8c2-1.20260812085853033689.main.14.g552be8c2" date="1786536000">- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="63ea1d256fae25e6c90fa0e8e967b598664cc6f065c77fa95291fbbfe648e22c" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~16~g5d69c1a0" rel="1.20260812133922490008.main.16.g5d69c1a0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~16~g5d69c1a0-1.20260812133922490008.main.16.g5d69c1a0" date="1786536000">- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="37954be700b5480c6c49be35c00766f8f417b45156fc9dbefaa34ee389563820" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~17~g1dee52fb" rel="1.20260812153145429044.main.17.g1dee52fb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~17~g1dee52fb-1.20260812153145429044.main.17.g1dee52fb" date="1786536000">- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="21c9720e5d9d877894bb16efd0ee3ff40713e74a4719d922648b466dd564971d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~18~g9c8ebb91" rel="1.20260813095420387555.main.18.g9c8ebb91.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~18~g9c8ebb91-1.20260813095420387555.main.18.g9c8ebb91" date="1786622400">- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4b72872a3f2d1e67dd60f282428be80b3e71b8adc6551f5294c06d434cb9c3ca" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~19~g500f34e9" rel="1.20260813130813735207.main.19.g500f34e9.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~19~g500f34e9-1.20260813130813735207.main.19.g500f34e9" date="1786622400">- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4f8d5c9a24c55a40eccbc98d96046f7c1bb0327fccc160e5adffefa8b14701c5" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ac33cbf9b3280dcb9733e7c3b80e645e8f214e938d8bb56b1b819df4c7cb28dc" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~20~g42e18f79" rel="1.20260813163125863683.main.20.g42e18f79.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~20~g42e18f79-1.20260813163125863683.main.20.g42e18f79" date="1786622400">- Fixes #3347: Add aarch64 container image builds   (#3226) (kkyrazis)
- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1aa19f0d75c81e508705bbbf2918b2b7d5cd63632b251dfadce3ce20cbb5d368" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2523ac5daaeec5379bed05d6a3b63831f4727efe51accf625d67befdde0f0100" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8393e94bcfed1aa58882825ae6834e41c200b1f3f39bdf9098da0fcd2da45193" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="243ef30993a2b05b4ff8ecbbb9950f0e1a216a46a72325610106e9aa981b12b1" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3a6a4eaf4698b83f5a3c52a08012c2dc1fceb63e1204825eeed6ae98f6046de2" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="640fd790d0c0d25acd3195ab7c7efda2c2d980360d51f372e39709a374489c13" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="7c9cd9317d54fdfbf6be7d3bf77c3ed9fe548abbf00f83c96c06666a51fd0d63" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cc1dcd0b915e1208827e7be12d085a3b5aa38532c1db5830022bef056862b095" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ffb51d999ed57aee03efd58bb278e602fc6c91797353baf2def972b79581c533" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a124309bd3657bb7ecb084d654f4d2ec8ad08870415fe17667e7b7c5ce49f04b" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7c04455e907c8976bca4a71ba51694a51076684457d49a1ff32faf61975e9cdb" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f5c169978bbd385fc7de270ddca67ff4e97e358ff04a132e8e2e28977790d5c2" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="010c25048bf93d19089a31d44eff4b3dfdbe1848ef28427fb69176d754aa5265" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2c49aa5bd71f251271a51266fb986019bbe12bafbcbd9e0b9fca9235677e0ae8" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3c2639242335910bcc719c525e0cc9dcdd5d01190d371e2403f7148abf2ad630" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a106e960caff87c23cef1737b1a9c46cc2608155b312374024037af5219a3033" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a4b8e33e7acf921d325bdfc05929444f071f6176971312bb17f4b32185ba1c11" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1936313e27a93992956223a6e0aab1f0af6f8f72a7b5b552d5d43c6a6afb5b92" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1998aed98c71852270649cededa8527d2eb377bf45fc85f3827d9fda048682d4" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="78d2fb3ad67bf071ed75b46ef5f33ad40383d59dad1b639b9d1e83bef3c4b40d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b468db6cca91e0ffc1662e78c2ac915e536a5ccc79d5a30b19ff6c6d1cc311fd" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7a6cf2957912ddc218febb983e863599e48532594fffe770e5a15ee943c1edc6" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="45aa6e670f5cf849efc33a7bedf799b18ba314c807ff2c96caaf05c1d352ea1c" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="58b4c405ed0bdd56d705b087e77683c4228417d4124193889a78fe620bcef6ba" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="78830023d4ae6b141a341124f91056b1263c1f9001619aee4c263339b13c4ac9" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bb3994dbbce9f644afff9d9e7a31ce10ae857f560f005685bb9ec604e787e224" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b308c35bdc1812bed4aa13d232f48da38da46ed3672a9eb129fadd57aae65076" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="355780aeabb021236a6c3e70ba4c066440b2eba4dc16569a7e3b90a53f49b8dc" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="305ef29a3f2f1326db57d0e277593cabe19967e2a8ba32910da86cf848de513a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c375dbed794822a6e7d8e74c84c8a31e239ba873d5d8bfe778e1fb4c1cf6f01a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="585d3ee42764e13de339485b8f9f49de862c1e7394ae7c9eb3f3a1e24c663e74" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2b486fbb01ac69ba0c62841ac9833c4dc7868dbd030c97032922ad07b1300d0f" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e18bb35cfa67d229ee308ebf5e0de47b9b67ca732cb3989c6d61314c2dcc47ea" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~14~g552be8c2" rel="1.20260812085853033689.main.14.g552be8c2.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~14~g552be8c2-1.20260812085853033689.main.14.g552be8c2" date="1786536000">- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="81b78f29f823d20cedaeb575f3ebf3217a60edc950a24123da2ddbba71d8a46e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~16~g5d69c1a0" rel="1.20260812133922490008.main.16.g5d69c1a0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~16~g5d69c1a0-1.20260812133922490008.main.16.g5d69c1a0" date="1786536000">- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="062e85aa1f7320cf4aa07f8ddbbcb21274d05cd07c245c774aede2bd9a513e74" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~17~g1dee52fb" rel="1.20260812153145429044.main.17.g1dee52fb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~17~g1dee52fb-1.20260812153145429044.main.17.g1dee52fb" date="1786536000">- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f112e5395cf8a0975ea3d42ccc4e41b515260067fd8412312a4d411d6b71f640" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~18~g9c8ebb91" rel="1.20260813095420387555.main.18.g9c8ebb91.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~18~g9c8ebb91-1.20260813095420387555.main.18.g9c8ebb91" date="1786622400">- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cb7c63ad0174e0ebdd53cbb5c9b258000eef67619a4a76fb38f048675bab551b" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~19~g500f34e9" rel="1.20260813130813735207.main.19.g500f34e9.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~19~g500f34e9-1.20260813130813735207.main.19.g500f34e9" date="1786622400">- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="96019074689e3f885a228357c7c04917a87e03637d2186f2a17f7b9a6326b0b5" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1f6e17192d91c4f327d57895cc5632f0f0aeca16fc3cf1fe04c14d9b22549caa" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~20~g42e18f79" rel="1.20260813163125863683.main.20.g42e18f79.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~20~g42e18f79-1.20260813163125863683.main.20.g42e18f79" date="1786622400">- Fixes #3347: Add aarch64 container image builds   (#3226) (kkyrazis)
- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e409fde903d0c5f462025852b0de6acc6962ba81befaf15198d54f1daccbfd4e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d825beab19ee777982615a4efc9fbfde0ccede3850559232f9444ab0a530b726" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2893863c14cef325729255aa93cd8cb856c49a7e3bf8a53957d6fc6c3bf4bc4b" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="11f0d51efdf33589fdaf2337166795d7cbe07a0b4a70eaf3b65a05c7701817f7" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4183dd8742d767e410b05c7dacbb78dad1b5d10a08643c676321e96ae94d9852" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9a7967393ed0de1efa44a4c631353b50db4f3daece8d900dbe0c26c59f4be82a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="737b5b97c9f8f860d257998137fcede6e7b0b18811e11c9597b200f1970babab" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e4dc40cb62fbe74a74598907517ce4789dcedd1bab25b02ebdb6965ad25336f7" name="flightctl-otel-collector" arch="aarch64">
  <version epoch="0" ver="0.11.0~main~4~gfe913e5a" rel="1.20250926142220273733.main.4.gfe913e5a.el9"/>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.11.0~main~4~gfe913e5a-1.20250926142220273733.main.4.gfe913e5a" date="1758888000">- EDM-2016: Credential Challenge documentation (#1709) (kkyrazis)
- EDM-2196: Add AAP details and update org docs (Dakota Crowder)
- NO-ISSUE: Include pkg in unit tests (#1712) (kkyrazis)</changelog>
</package>
<package pkgid="1bf1e8efd74a2882edb1af78ac3fd3b9a797a7702ce008c26a17e37acf329c47" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f0cd5bb46f9573522679c6046584a802049a5f076fe93e0e419c9e44d04a4de1" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="095747b14aa9943141741fc655f43631385acf6c38d2d704c8c4c00b6d2831aa" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="dc3b2f1c2d89aa37eedc6be320e19e15b29431436dad97207976f509b8529949" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2ee8766a12ef6c1a765b358e67c9b96cf26cfebeff767b9829f4a9ca664a19a9" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="036ebac8de2d8409a310aa2a0cf9a747abc6518a39c122bd45d30dc73903d046" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="511a173092a0d44ed33f354d258c72ba2c67c9e0ff71a49d8941ec261ee7f1b5" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f16ceaf08bf7f1583c63131838d8dd5e15fe6da865284fe8ea4cd07d1404f778" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d1098d07925931de5e307954cb8ca6dae49bcb45c792951821a53dcc0bd75ba2" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="06225b6310272bdf3ecaf319d32a690d20e0df869d29a969f1704c6566cc1042" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5640fcf5ae7120b7471de432deea4c322c44a4940eec5a54e3331bf6f18a6930" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="55ce88b7df1eb3f31a2c67a57c919f817cf51abec66835bd61dc17d3c8d2ec4e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d52ae1b50f1ba1f626419ed22387d12bd771dfa7eb439903330d3947112b3d97" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="382a041d856bf50f6b87d981353bbd2e09e23b9abbe5fc2880392d796e52a096" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d8d32c97d9208a509f9f3df6cbdca42be7c20aec7c0be5147db84273f2bd6247" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bf00176921fd84042972a0b2ea9d9664870a31504123a3d1f6042c02a6b2c835" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="66f40182a6ae5707b6e977b777fc177a3cb120d84052d005d2ab07464023e100" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bf9ce01532fe50ab6a18eebf695a87f08f98081e705052077adcb506bdc8a3d2" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4cb58aea49d542542fa8d6cbc33fb463a79aa687cb410a347996a7eb45d298c2" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f3e352c1989f18f540349d7a57ddd5006a60208efa0f626d3c23d0baef21470d" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0246746e289598e21a0673235ea0ff76cf1480c88ad785fdce2a3333987db15d" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ccd059290930439abe45696e709aa9d28fa7d74fb1e42fb79693029f99034b80" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="816fdef70e204142e3d3e4bf684aaf478d2557d77d8f7e9366dc65b3172310a1" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c96120586e20f4f9fec7845d1ec8488677d3aed98b79238437d31ab7a384fe5e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="71e817de97f344dbff56fb92e1a9d8a67ac97663b97a093e556f499b76045b8e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2ece73b1660aa6da7176835b0481ee431a23794b7bed7de9fd1d39c860d1b751" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~14~g552be8c2" rel="1.20260812085853033689.main.14.g552be8c2.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~14~g552be8c2-1.20260812085853033689.main.14.g552be8c2" date="1786536000">- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="fd09317727efe59b253cae4715cfd3dbecd68c6fdd0e95ab96be18ded4eefa89" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~16~g5d69c1a0" rel="1.20260812133922490008.main.16.g5d69c1a0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~16~g5d69c1a0-1.20260812133922490008.main.16.g5d69c1a0" date="1786536000">- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="63a46d84b7fff147d1663815d4836151f21e6691a704cf0c7bbc732d6db5f1ac" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~17~g1dee52fb" rel="1.20260812153145429044.main.17.g1dee52fb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~17~g1dee52fb-1.20260812153145429044.main.17.g1dee52fb" date="1786536000">- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6223f27056c94e313d17e5475352748050d15e7a34fe1f5cd597813e76e46845" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~18~g9c8ebb91" rel="1.20260813095420387555.main.18.g9c8ebb91.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~18~g9c8ebb91-1.20260813095420387555.main.18.g9c8ebb91" date="1786622400">- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a9418e374c1e83e967bad4456fc3a21a11b2a1de85ec7dfca3595d1fa3abd839" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~19~g500f34e9" rel="1.20260813130813735207.main.19.g500f34e9.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~19~g500f34e9-1.20260813130813735207.main.19.g500f34e9" date="1786622400">- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="00d59d23c71b4f96fe1abd7256cd7a9d8b8534292b21c265ec73b71c224b747b" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8b330317a79cc1ff0f66bead31c16a257d41510afeace63fa724304430be55c6" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~20~g42e18f79" rel="1.20260813163125863683.main.20.g42e18f79.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~20~g42e18f79-1.20260813163125863683.main.20.g42e18f79" date="1786622400">- Fixes #3347: Add aarch64 container image builds   (#3226) (kkyrazis)
- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="95d339dd5fd2eefd42d03cf176d1cd509adde28d6a0507ad835908e3783bc451" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bcb67bf8d24ffe229b25e9f5b3bceb1abd7933511e9d0a621f280bd9652eb9be" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="768bf3ac27548ad7d5456a1182be813341d159b78e1cd8c2e5c61f105b2e3693" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="81ed86ceebd6ddee9df9604ec3864c551c3a5297da397731898f0e115d984d00" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ab6572fbb3d15348cd0cf59875fa9d2c61c4bfe2a3d057882b8c5d3e4d5d6f37" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="12209ebf9ccf18685629d6f2aeb15ac0f88c2d494ef3e51035ad814bcefe936f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="cba7d2cf3c49645b5411bf315fb4dd1149b2e1fe4c4df74b445061eb21a5c17a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="faac5095b1d76f9755f76ba0b54505bb203ee78fadbd1479d4fbe670d12bb029" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8b85fd8cca24b8e9699fa261d0ed76f5356e52c11c47608c97c0ba9ea5761c5c" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3c70aebec3d0fd75f811f99036953663e54f46b53ecf20d30671b7c1c1991fb1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0d0cf19bc9f788707cf0922f7df23134a27a41a5a7f5fdf8a20c422db8e2906b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="24b290061e4ac1f9a4a52ef29bc4584cf42ad009b7c7a39e5f3a2050d48229cc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c8011a5a5f7ba7e9b03bd1da679e9027de40d1004de7f4b833bfce5ebfba8553" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4d1416c91fc1435462cf55db3ee586f966a326d11f603bdf3f635d2dec2e9362" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ab45bc98746626d2af139c704b9a5e99cc4ca86cadc19cc6485464d8dc714f1f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="57b001394d0a9dbcc1fb6bb9136834cdd099f3ca1e1e32edda28871796677754" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="63ec84f7cce3043036cf0b8eb83c2de6100714bb28631a29d508c59f84660233" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="482bcedc1d059dc0772111cbf311118dd4b38b9e01f084878826f267f1de6a6d" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b6d5815438cafa0a6bf2a0f734e987ade783f7dd58e1c6681c7356019d3fe8fc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d2c524e63c536356c6cf50c08cc320a321005f475ec31232afade40ce0c4e490" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5f7480a9e9d1b71d6e39526a3cfe2f52bdb8b58547844b6e3717317196f995ba" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c3994fea2a52b873a05a5393c8c2be80e8de92127d5299effdd9ce2b246ae59c" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3d8e10ecd6da66d860a35e0a366b033f612752d7e00a557a21dbb742341b42d9" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="85300d85f1cb7752f9e642fe334e63d115423059f1da678d88f54634e50c4322" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b0f7c3c477a68162cc85eb7c40efb86cb262d77206949ca0e7719df27fad775e" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0084ec711ca35770a5f6192a6825a0b462771556c13c650b9149bec4b408ea25" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a3fd03e650381b3a0a585e7b2d804f8daea6bc3c7ebde4cdbbf6400fff7b0cff" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="58b2dd6e6b353c23023116662470796263b15de1079660618ee3e19daf62f90f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7a424ced0031570db943de5924d046e24a83b3135963c3142cf4fd8177ba17e1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="dcf652436e8591907d8e00c351ae6a80c704f6fc442132e9c66765d284f2c78c" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="263aebd32a254f7fc673dc5a76c592d5af46001de1647e7f14a96291101094f7" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="72af602be0728fd13db8513d2ee89f3a489bf6132a346aac47490e14434263cc" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ada68834e46d97dc6b99bfc0673dded04e190e62d40c7a636d20972e117d7a54" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~14~g552be8c2" rel="1.20260812085853033689.main.14.g552be8c2.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~14~g552be8c2-1.20260812085853033689.main.14.g552be8c2" date="1786536000">- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d3069fa4e6087cadd9aa817d77cca28d993d87e94e88b35d31023dd5b4b72554" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~16~g5d69c1a0" rel="1.20260812133922490008.main.16.g5d69c1a0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~16~g5d69c1a0-1.20260812133922490008.main.16.g5d69c1a0" date="1786536000">- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="df5726ffca50a1c43ce58bea94020157cf7bf5f9fc4b9c07671362a52ffc5ae3" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~17~g1dee52fb" rel="1.20260812153145429044.main.17.g1dee52fb.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~17~g1dee52fb-1.20260812153145429044.main.17.g1dee52fb" date="1786536000">- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="601ba4bff48451b01f024aba29f98fd8a876baafb45b5158f0a21ef9402a0f71" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~18~g9c8ebb91" rel="1.20260813095420387555.main.18.g9c8ebb91.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~18~g9c8ebb91-1.20260813095420387555.main.18.g9c8ebb91" date="1786622400">- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4e060e32cffbaa25aed1ac9aabccb8925775775763b494434a2f840bb9149fdb" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~19~g500f34e9" rel="1.20260813130813735207.main.19.g500f34e9.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~19~g500f34e9-1.20260813130813735207.main.19.g500f34e9" date="1786622400">- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="278152fb9d6e1348e9f188df89a9fc6e23c604774907a0a7a1d9bc01af616f66" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b8e17e00399fa2c2acba3986f3cac41b29465fe52be39b16fdc591842835c1e4" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~20~g42e18f79" rel="1.20260813163125863683.main.20.g42e18f79.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~20~g42e18f79-1.20260813163125863683.main.20.g42e18f79" date="1786622400">- Fixes #3347: Add aarch64 container image builds   (#3226) (kkyrazis)
- NO-ISSUE: align package image preload with testcontainers runtime (#3375) (Eldar101)
- EDM-4742: Remove the ready-replica gate for Running (#3370) (Itzik Brown)
- EDM-5028: fix Mutate status poisoning without LastSeen; trim UpdateStatus clones (#3369) (Asaf Ben Natan)
- EDM-5035: Allow Helm stop/start when rendered lifecycle fields are present (#3357) (Asaf Ben Natan)
- NO-ISSUE: Skip redundant FleetRolloutDeviceSelected re-renders (#3368) (Asaf Ben Natan)
- EDM-4768: add package-mode e2e suite (#3354) (Eldar101)
- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="087ee4958f69b4164c8b24f5540bdd34a0da4c3435bb046ac57e8e532549ba80" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="5bb9508d9e27c86ea902902bfad0c1112cd333431692c45b93f965c5142aa1d6" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b48c77de520e079ce667c5ecfc9bc3ebca8beb711e40e561dc1495d9dadc3cc4" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f71643bb08040e5cce5a51f768fd02d547f720e1940b321423cabd04dcb967f0" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4a490f8a1f675f15e8b115d50c9755dd63d0a614b61693a2700e7d82ea75a4a7" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="25c453ed4373e76a73f4aea10db9997a62b9d6cc24ef8a68f8b603696d866416" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="753a6e07626c514b4ea109dcbde537ec44f6c150b7bd1c37ac52825ba888c96c" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9a127735c9d28cf5c7ad6490054540b440eff2eff419b9746657041cfb0e0cd2" name="flightctl-telemetry-gateway" arch="aarch64">
  <version epoch="0" ver="1.2.0~main~27~gb5c1b040" rel="1.20260204153358102810.main.27.gb5c1b040.el9"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.2.0~main~27~gb5c1b040-1.20260204153358102810.main.27.gb5c1b040" date="1770206400">- NO-ISSUE: missing network policy for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Bump resourcesync e2e task timeout value (Dakota Crowder)
- NO-ISSUE: Add e2e harness setup without VMs and use for ResourceSync tests (Dakota Crowder)
- EDM-3265: build cs9 microshift image only if the repo is accessible (Ilya Skornyakov)
- EDM-3262: fixed cancel not working properly for pending states (Asaf Ben Natan)
- EDM-3263: when defaulting to HOST_FQDN -&gt; lowercase it (Asaf Ben Natan)
- EDM-3005: update ginkgo_total_nodes (Gregory Shilin)
- EDM-3005: update ginkgo_total_nodes to be 2 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Reorganize tests matrix. Label some tests as "agent" and run them for both CS9 and CS10 (Gregory Shilin)
- EDM-3005: Add cs10-specific error message support (Gregory Shilin)
- EDM-3005: Add running cs10-bootc e2e tests. Fix certificate handling (Gregory Shilin)
- NO-ISSUE: Disable rollback test temporarily (Ilya Skornyakov)
- NO-ISSUE: imagebuild api set to v1alpha1 (Asaf Ben Natan)
- EDM-3258: EDM-3257,operator cant cancel fix (Asaf Ben Natan)
- NO-ISSUE: fix Publish Binaries workflow (Ilya Skornyakov)
- EDM-2985: fix imports post-merge (Ilya Skornyakov)
- EDM-2985: add unit tests (Ilya Skornyakov)
- EDM-2985: validate header value (Ilya Skornyakov)
- EDM-2985: Add API version to HTTP request logs (Ilya Skornyakov)
- NO-ISSUE: repo url + entitlements support (Asaf Ben Natan)
- NO-ISSUE: Updated init container quadlet files to ensure everything in standardoutput and standarderror shows up in journal (Ram)
- NO-ISSUE: Add TC ID 87279 to greenboot rollback test (amalykhi)
- EDM-2636: Rootless Quadlets (Ben Keith)
- EDM-3226: fixes invalid chars attempted to be saved to psql (Asaf Ben Natan)
- EDM-6163: Skip kind test (Eldar Weiss)
- NO-ISSUE: MVC separation (Asaf Ben Natan)</changelog>
</package>
</otherdata>