Merge branch 'master' of github.com:dogtagpki/pki

4 files changed, 311 insertions, 21 deletions

diff --git a/specs/dogtag-pki-theme.spec b/specs/dogtag-pki-theme.spec
index f87c1b578..12b73702a 100644
--- a/specs/dogtag-pki-theme.spec
+++ b/specs/dogtag-pki-theme.spec
@@ -1,6 +1,6 @@
 Name:             dogtag-pki-theme
 Version:          10.4.0
-Release:          0.1%{?dist}
+Release:          1%{?dist}
 Summary:          Certificate System - Dogtag PKI Theme Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -168,6 +168,9 @@ cd build
 
 
 %changelog
+* Tue Mar 14 2017 Dogtag Team <pki-devel@redhat.com> 10.4.0-1
+- dogtagpki Pagure Issue #2541 - Re-base Dogtag pki packages to 10.4.x
+
 * Mon Aug  8 2016 Dogtag Team <pki-devel@redhat.com> 10.4.0-0.1
 - Updated version number to 10.4.0-0.1
 
diff --git a/specs/dogtag-pki.spec b/specs/dogtag-pki.spec
index 040ca0151..4e0b13d47 100644
--- a/specs/dogtag-pki.spec
+++ b/specs/dogtag-pki.spec
@@ -7,7 +7,7 @@
 Summary:          Dogtag Public Key Infrastructure (PKI) Suite
 Name:             dogtag-pki
 Version:          10.4.0
-Release:          0.1%{?dist}
+Release:          1%{?dist}
 # The entire source code is GPLv2 except for 'pki-tps' which is LGPLv2
 License:          GPLv2 and LGPLv2
 URL:              http://pki.fedoraproject.org/
@@ -19,7 +19,7 @@ BuildArch:        noarch
 %define esc_version                1.1.0
 # NOTE:  The following package versions are TLS compliant:
 %if 0%{?rhel}
-%define pki_core_rhel_version      10.3.3
+%define pki_core_rhel_version      10.4.0
 %define pki_core_rhcs_version      %{version}
 %else
 %define pki_core_version           %{version}
@@ -124,6 +124,9 @@ rm -rf %{buildroot}
 %doc README
 
 %changelog
+* Tue Mar 14 2017 Dogtag Team <pki-devel@redhat.com> 10.4.0-1
+- dogtagpki Pagure Issue #2541 - Re-base Dogtag pki packages to 10.4.x
+
 * Mon Aug  8 2016 Dogtag Team <pki-devel@redhat.com> 10.4.0-0.1
 - Updated version number to 10.4.0-0.1
 
diff --git a/specs/pki-console.spec b/specs/pki-console.spec
index 6a6a282e5..86c3f2d0e 100644
--- a/specs/pki-console.spec
+++ b/specs/pki-console.spec
@@ -1,6 +1,6 @@
 Name:             pki-console
 Version:          10.4.0
-Release:          0.1%{?dist}
+Release:          1%{?dist}
 Summary:          Certificate System - PKI Console
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -9,7 +9,7 @@ Group:            System Environment/Base
 %bcond_without    javadoc
 
 %if 0%{?rhel}
-%define pki_core_rhel_version      10.3.3
+%define pki_core_rhel_version      10.4.0
 %define pki_core_version           %{pki_core_rhel_version}
 %else
 %define pki_core_version           %{version}
@@ -27,7 +27,7 @@ BuildRequires:    nspr-devel
 BuildRequires:    nss-devel
 BuildRequires:    junit
 BuildRequires:    jpackage-utils >= 1.7.5-10
-BuildRequires:    jss >= 4.2.6-40
+BuildRequires:    jss >= 4.4.0-1
 BuildRequires:    pki-base-java >= %{pki_core_version}
 
 Requires:         idm-console-framework
@@ -36,7 +36,7 @@ Requires:         ldapjdk
 Requires:         pki-base-java >= %{pki_core_version}
 Requires:         pki-console-theme >= %{version}
 Requires:         jpackage-utils >= 1.7.5-10
-Requires:         jss >= 4.2.6-40
+Requires:         jss >= 4.4.0-1
 
 %if 0%{?rhel}
 # NOTE:  In the future, as a part of its path, this URL will contain a release
@@ -98,6 +98,10 @@ cd build
 
 
 %changelog
+* Tue Mar 14 2017 Dogtag Team <pki-devel@redhat.com> 10.4.0-1
+- Require "jss >= 4.4.0-1" as a build and runtime requirement
+- dogtagpki Pagure Issue #2541 - Re-base Dogtag pki packages to 10.4.x
+
 * Mon Aug  8 2016 Dogtag Team <pki-devel@redhat.com> 10.4.0-0.1
 - Updated version number to 10.4.0-0.1
 
diff --git a/specs/pki-core.spec b/specs/pki-core.spec
index 39911af41..2ef46e28d 100644
--- a/specs/pki-core.spec
+++ b/specs/pki-core.spec
@@ -13,7 +13,7 @@
 %global package_rhel_packages 1
 # Package RHCS-specific RPMS Only
 %global package_rhcs_packages 1
-%define pki_core_rhel_version 10.3.3
+%define pki_core_rhel_version 10.4.0
 %else
 # 0%{?fedora}
 # Fedora always packages all RPMS
@@ -65,7 +65,7 @@
 
 Name:             pki-core
 Version:          10.4.0
-Release:          0.1%{?dist}
+Release:          1%{?dist}
 Summary:          Certificate System - PKI Core Components
 URL:              http://pki.fedoraproject.org/
 License:          GPLv2
@@ -170,16 +170,16 @@ BuildRequires:    policycoreutils-python-utils
 BuildRequires:    python-ldap
 BuildRequires:    junit
 BuildRequires:    jpackage-utils >= 0:1.7.5-10
-BuildRequires:    jss >= 4.2.6-40
+BuildRequires:    jss >= 4.4.0-1
 BuildRequires:    systemd-units
 
 %if 0%{?rhel}
-BuildRequires:    tomcatjss >= 7.1.2-2
+BuildRequires:    tomcatjss >= 7.2.1-1
 %else
 %if 0%{?fedora} >= 23
-BuildRequires:    tomcatjss >= 7.1.3
+BuildRequires:    tomcatjss >= 7.2.1-1
 %else
-BuildRequires:    tomcatjss >= 7.1.2-2
+BuildRequires:    tomcatjss >= 7.1.3
 %endif
 %endif
 
@@ -318,7 +318,7 @@ Requires:         nss >= 3.14.3
 %endif
 
 Requires:         jpackage-utils >= 0:1.7.5-10
-Requires:         jss >= 4.2.6-40
+Requires:         jss >= 4.4.0-1
 
 Provides:         symkey = %{version}-%{release}
 
@@ -400,7 +400,7 @@ Requires:         slf4j-jdk14
 %endif
 Requires:         javassist
 Requires:         jpackage-utils >= 0:1.7.5-10
-Requires:         jss >= 4.2.6-40
+Requires:         jss >= 4.4.0-1
 Requires:         ldapjdk
 Requires:         pki-base = %{version}-%{release}
 
@@ -583,12 +583,12 @@ Requires(postun): systemd-units
 Requires(pre):    shadow-utils
 
 %if 0%{?rhel}
-Requires:         tomcatjss >= 7.1.2-2
+Requires:         tomcatjss >= 7.2.1-1
 %else
 %if 0%{?fedora} >= 23
-Requires:         tomcatjss >= 7.1.3
+Requires:         tomcatjss >= 7.2.1-1
 %else
-Requires:         tomcatjss >= 7.1.2-2
+Requires:         tomcatjss >= 7.1.3
 %endif
 %endif
 
@@ -1347,17 +1347,297 @@ systemctl daemon-reload
 %endif # %{with server}
 
 %changelog
-* Mon Aug  8 2016 Dogtag Team <pki-devel@redhat.com> 10.4.0-0.1
+* Tue Mar 14 2017 Dogtag Team <pki-devel@redhat.com> 10.4.0-1
+- Require "jss >= 4.4.0-1" as a build and runtime requirement
+- Require "tomcatjss >= 7.2.1-1" as a build and runtime requirement
+- ############################################################################
+- dogtagpki Pagure Issue #2541 - Re-base Dogtag pki packages to 10.4.x
+- ############################################################################
+- dogtagpki Pagure Issue #6 - Remove Policy Framework Deprecations (edewata)
+- dogtagpki Pagure Issue #850 - JSS certificate validation function does not
+  pass up exact errors from NSS (edewata)
+- dogtagpki Pagure Issue #1114 - [MAN] Generting Symmetric key fails with
+  key-generate when --usages verify is passed (vakwetu)
+- dogtagpki Pagure Issue #1247 - Better error message when try to renew a
+  certificate that expires outside renewal grace period (vakwetu)
+- dogtagpki Pagure Issue #1309 - Recovering of a revoked cert erroneously
+  reflects "active" in the token db cert entry (cfu)
+- dogtagpki Pagure Issue #1490 - add option to bypass dnsdomainname check in
+  pkispawn (vakwetu)
+- dogtagpki Pagure Issue #1517 - user-cert-add --serial CLI request to secure
+  port with remote CA shows authentication failure (edewata)
+- dogtagpki Pagure Issue #1527 - TPS Enrollment always goes to "ca1" (cfu)
+- dogtagpki Pagure Issue #1536 - CA EE: Submit caUserCert request without uid
+  does not show proper error message (vakwetu)
+- dogtagpki Pagure Issue #1663 - Add SCP03 support (jmagne)
+- dogtagpki Pagure Issue #1664 - [BUG] Add ability to disallow TPS to enroll
+  a single user on multiple tokens. (jmagne)
+- dogtagpki Pagure Issue #1710 - Add profile component that copies CN to SAN
+  (ftweedal)
+- dogtagpki Pagure Issue #1741 - ECDSA Certificates Generated by Certificate
+  System fail NIST validation test with parameter field. (cfu)
+- dogtagpki Pagure Issue #1897 - [MAN] Man page for logging configuration.
+  (edewata)
+- dogtagpki Pagure Issue #1920 - [MAN] Man page for PKCS #12 utilities
+  (edewata)
+- dogtagpki Pagure Issue #2275 - add options to enable/disable cert or crl
+  publishing. (vakwetu)
+- dogtagpki Pagure Issue #2289 - [MAN] pki ca-cert-request-submit fails
+  presumably because of missing authentication even if it should not require
+  any (edewata)
+- dogtagpki Pagure Issue #2450 - Unable to search certificate requests using
+  the latest request ID (edewata)
+- dogtagpki Pagure Issue #2453 - IPA replica-prepare failed with error
+  "Profile caIPAserviceCert Not Found" (ftweedal)
+- dogtagpki Pagure Issue #2457 - Misleading Logging for HSM (edewata)
+- dogtagpki Pagure Issue #2460 - Typo in comment line of
+  UserPwdDirAuthentication.java (edewata) 
+- dogtagpki Pagure Issue #2463 - Troubleshooting improvements (edewata)
+- dogtagpki Pagure Issue #2466 - two-step externally-signed CA installation
+  fails due to missing AuthorityID (ftweedal)
+- dogtagpki Pagure Issue #2475 - Multiple host authority entries created
+  (ftweedal)
+- dogtagpki Pagure Issue #2476 - Miscellaneous Minor Changes (edewata)
+- dogtagpki Pagure Issue #2478 - pkispawn fails as it is not able to find
+  openssl as a dependency package (mharmsen)
+- dogtagpki Pagure Issue #2483 - Unable to read an encrypted email using
+  renewed tokens (jmagne)
+- dogtagpki Pagure Issue #2486 - Automatic recovery of encryption cert is not
+  working when a token is physically damaged and a temporary token is issue
+  (jmagne)
+- dogtagpki Pagure Issue #2496 -Cert/Key recovery is successful when the cert
+  serial number and key id on the ldap user mismatches (cfu)
+- dogtagpki Pagure Issue #2497 - KRA installation failed against
+  externally-signed CA with partial certificate chain (edewata)
+- dogtagpki Pagure Issue #2498 -Token format with external reg fails when
+  op.format.externalRegAddToToken.revokeCert=true (cfu)
+- dogtagpki Pagure Issue #2500 - Problems with FIPS mode (edewata)
+- dogtagpki Pagure Issue #2505 - Fix packaging duplicates of classes in
+  multiple jar files (edewata)
+- dogtagpki Pagure Issue #2510 - PIN_RESET policy is not giving expected
+  results when set on a token (jmagne)
+- dogtagpki Pagure Issue #2513 -TPS token enrollment fails to
+  setupSecureChannel when TPS and TKS security db is on fips mode. (jmagne)
+- dogtagpki Pagure Issue #2523 - Changes to target.agent.approve.list
+  parameter is not reflected in the TPS Web UI (edewata)
+- dogtagpki Pagure Issue #2524 - Remove xenroll.dll from pki-core (mharmsen)
+- dogtagpki Pagure Issue #2525 - [RFE] FreeIPA to Dogtag permission mapping
+  plugin (ftweedal)
+- dogtagpki Pagure Issue #2532 - [RFE] add express archivals and retrievals
+  from KRA (vakwetu)
+- dogtagpki Pagure Issue #2534 - Automatic recovery of encryption cert - CA
+  and TPS tokendb shows different certificate status (cfu)
+- dogtagpki Pagure Issue #2543 - Unable to install subordinate CA with HSM in
+  FIPS mode (edewata)
+- dogtagpki Pagure Issue #2544 - TPS throws "err=6" when attempting to format
+  and enroll G&D Cards (jmagne)
+- dogtagpki Pagure Issue #2552 - pkispawn does not change default ecc key size
+  from nistp256 when nistp384 is specified in spawn config (jmagne)
+- dogtagpki Pagure Issue #2556 - pkispawn fails to create PKI subsystem on
+  FIPS enabled system (edewata)
+- dogtagpki Pagure Issue #2564 - pki-tomcat for 10+ minutes before generating
+  cert (edewata)
+- dogtagpki Pagure Issue #2569 - Token memory not wiped after key deletion
+  (jmagne)
+- dogtagpki Pagure Issue #2570 - Problem with default AJP hostname in IPv6
+  environment. (edewata)
+- dogtagpki Pagure Issue #2571 - Request ID undefined for CA signing
+  certificate (vakwetu)
+- dogtagpki Pagure Issue #2573 - CA Certificate Issuance Date displayed on CA
+  website incorrect (vakwetu)
+- dogtagpki Pagure Issue #2579 - NumberFormatException in
+  LDAPProfileSubsystem (ftweedal)
+- dogtagpki Pagure Issue #2582 - Access banner (edewata)
+- dogtagpki Pagure Issue #2601 - Return revocation reason in GET
+  /ca/rest/certs/{id} response. (ftweedal)
+- ############################################################################
+
+* Mon Mar  6 2017 Dogtag Team <pki-devel@redhat.com> 10.4.0-0.1
 - Updated version number to 10.4.0-0.1
+- NOTE: Original date was Mon Aug 8 2016
+
+* Mon Mar  6 2017 Dogtag Team <pki-devel@redhat.com> 10.3.5-13
+- PKI TRAC Ticket #1710 - Add profile component that copies CN to SAN (ftweedal)
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 10.3.5-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Tue Jan 31 2017 Dogtag Team <pki-devel@redhat.com> 10.3.5-11
+
+* Thu Dec 22 2016 Miro Hrončok <mhroncok@redhat.com> - 10.3.5-10
+- Rebuild for Python 3.6 (Fedora 26)
+
+* Tue Dec 13 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-9
+- PKI TRAC Ticket #1517 - user-cert-add --serial CLI request to secure port
+  with remote CA shows authentication failure (edewata)
+- PKI TRAC Ticket #1897 - [MAN] Man page for logging configuration. (edewata)
+- PKI TRAC Ticket #1920 - [MAN] Man page for PKCS #12 utilities (edewata)
+- PKI TRAC Ticket #2226 - KRA installation: NullPointerException in
+  ProxyRealm.findSecurityConstraints (edewata)
+- PKI TRAC Ticket #2289 -  [MAN] pki ca-cert-request-submit fails presumably
+  because of missing authentication even if it should not require any (edewata)
+- PKI TRAC Ticket #2523 - Changes to target.agent.approve.list parameter is
+  not reflected in the TPS Web UI [pki-base] (edewata)
+- PKI TRAC Ticket #2534 - Automatic recovery of encryption cert - CA and TPS
+  tokendb shows different certificate status (cfu)
+- PKI TRAC Ticket #2543 - Unable to install subordinate CA with HSM in FIPS
+  mode (edewata)
+- PKI TRAC Ticket #2544 -  TPS throws "err=6" when attempting to format and
+  enroll G&D Cards (jmagne)
+- PKI TRAC Ticket #2552 - pkispawn does not change default ecc key size from
+  nistp256 when nistp384 is specified in spawn config (jmagne)
+
+* Fri Nov  4 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-8
+- PKI TRAC Ticket #850 - JSS certificate validation function does not pass up
+  exact errors from NSS (edewata)
+  (Failed to start pki-tomcatd Service - "ipa-cacert-manage renew" failed?)
+- PKI TRAC Ticket #1247 - Better error message when try to renew a certificate
+  that expires outside renewal grace period (alee)
+- PKI TRAC Ticket #1536 - CA EE: Submit caUserCert request without uid does
+  not show proper error message (alee)
+- PKI TRAC Ticket #2460 - Typo in comment line of UserPwdDirAuthentication.java
+  (edewata)
+- PKI TRAC Ticket #2486 - Automatic recovery of encryption cert is not working
+  when a token is physically damaged and a temporary token is issued (jmagne)
+- PKI TRAC Ticket #2498 - Token format with external reg fails when
+  op.format.externalRegAddToToken.revokeCert=true (cfu)
+- PKI TRAC Ticket #2500 - Problems with FIPS mode (edewata)
+- PKI TRAC Ticket #2500 - Problems with FIPS mode (edewata)
+  (added KRA key recovery via CLI in FIPS mode)
+- PKI TRAC Ticket #2510 - PIN_RESET policy is not giving expected results when
+  set on a token (jmagne)
+- PKI TRAC Ticket #2513 - TPS token enrollment fails to setupSecureChannel
+  when TPS and TKS security db is on fips mode. (jmagne)
+- Reverted patches associated with
+  PKI TRAC Ticket #2523 - Changes to target.agent.approve.list parameter is
+  not reflected in the TPS Web UI
+
+* Mon Oct 10 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-7
+- PKI TRAC Ticket #1527 - TPS Enrollment always goes to "ca1" (cfu)
+- PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
+  user on multiple tokens. (jmagne)
+- PKI TRAC Ticket #2463 - Troubleshooting improvements (edewata)
+- PKI TRAC Ticket #2466 - two-step externally-signed CA installation fails due
+  to missing AuthorityID (ftweedal)
+- PKI TRAC Ticket #2475 - Multiple host authority entries created (ftweedal)
+- PKI TRAC Ticket #2476 - Dogtag 10.4.0 Miscellaneous Minor Changes
+  (edewata)
+- PKI TRAC Ticket #2478 - pkispawn fails as it is not able to find openssl as a
+  dependency package (mharmsen)
+- PKI TRAC Ticket #2483 - Unable to read an encrypted email using renewed
+  tokens (jmagne)
+- PKI TRAC Ticket #2496 - Cert/Key recovery is successful when the cert serial
+  number and key id on the ldap user mismatches (cfu)
+- PKI TRAC Ticket #2497 - KRA installation failed against externally-signed CA
+  with partial certificate chain (edewata)
+- PKI TRAC Ticket #2505 - Fix packaging duplicates of classes in multiple jar
+  files (edewata)
+- Fix for flake8 errors on Fedora 26 (cheimes)
+
+* Fri Sep  9 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-6
+- Revert Patch:  PKI TRAC Ticket #2449 - Unable to create system certificates
+  in different tokens (edewata)
+
+* Tue Sep  6 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-5
+- PKI TRAC Ticket #1638 - Lightweight CAs: revoke certificate on CA deletion
+  (ftweedal)
+- PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
+  (edewata)
+- PKI TRAC Ticket #2443 - Prevent deletion of host CA's keys if LWCA entry
+  deleted (ftweedal)
+- PKI TRAC Ticket #2444 - Authority entry without entryUSN is skipped even if
+  USN plugin enabled (ftweedal)
+- PKI TRAC Ticket #2446 - pkispawn: make subject_dn defaults unique per
+  instance name (for shared HSM) (cfu)
+- PKI TRAC Ticket #2447 - CertRequestInfo has incorrect URLs (vakwetu)
+- PKI TRAC Ticket #2449 - Unable to create system certificates in different
+  tokens (edewata)
+
+* Mon Aug 29 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-4
+- PKI TRAC Ticket #1578 - Authentication Instance Id PinDirEnrollment with authType value as SslclientAuth is not working (jmagne)
+- PKI TRAC TIcket #2414 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided (gkapoor)
+- PKI TRAC Ticket #2423 - pki_ca_signing_token when not specified does not fallback to pki_token_name value (edewata)
+- PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements (akasurde) - ticket remains open
+- PKI TRAC Ticket #2439 - Outdated deployment descriptors in upgraded server(edewata)
+
+* Mon Aug 22 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-3
+- spec file changes
+
+* Mon Aug 22 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-2
+- PKI TRAC Ticket #690 - [MAN] pki-tools man pages (mharmsen)
+  - CMCEnroll
+- PKI TRAC Ticket #833 - pki user-mod fullName="" gives an error message
+  "PKIException: LDAP error (21): error result" (edewata)
+- PKI TRAC Ticket #2431 - Errors noticed during ipa server upgrade.
+  (cheimes, edewata, mharmsen)
+- PKI TRAC Ticket #2432 - Kra-selftest behavior is not as expected (edewata)
+- PKI TRAC Ticket #2436 - Dogtag 10.3.6: Miscellaneous Enhancements
+  (edewata, mharmsen)
+- PKI TRAC Ticket #2437 - TPS UI: while adding certs for users from TPSUI pem
+  format with/without header works while pkcs7 with header is not allowed
+  (edewata)
+- PKI TRAC Ticket #2440 - Optional CA signing CSR for migration (edewata)
 
 * Mon Aug  8 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-1
 - Updated version number to 10.3.5-1
 
-* Tue Jul  5 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-0.1
+* Tue Jul 19 2016 Dogtag Team <pki-devel@redhat.com> 10.3.5-0.1
 - Updated version number to 10.3.5-0.1
+- NOTE: Original date was Tue Jul  5 2016
 
-* Tue Jun 21 2016 Dogtag Team <pki-devel@redhat.com> 10.3.4-0.1
+* Tue Jul 19 2016 Dogtag Team <pki-devel@redhat.com> 10.3.4-0.1
 - Updated version number to 10.3.4-0.1
+- NOTE: Original date was Tue Jun 21 2016
+
+* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 10.3.3-4
+- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
+
+* Tue Jul  5 2016 Dogtag Team <pki-devel@redhat.com> 10.3.3-3
+- PKI TRAC Ticket #691  - [MAN] pki-server man pages (mharmsen)
+- PKI TRAC Ticket #1114 - [MAN] Generting Symmetric key fails with
+  key-generate when --usages verify is passed (jmagne)
+- PKI TRAC Ticket #1306 - [RFE] Add granularity to token termination in TPS
+  (cfu)
+- PKI TRAC Ticket #1308 - [RFE] Provide ability to perform off-card key
+  generation for non-encryption token keys (cfu)
+- PKI TRAC Ticket #1405 - [MAN] Add additional HSM details to
+  'pki_default.cfg' & 'pkispawn' man pages (mharmsen)
+- PKI TRAC Ticket #1607 - [MAN] man pkispawn has inadequate description for
+  shared vs non shared tomcat instance installation (mharmsen)
+- PKI TRAC Ticket #1664 - [BUG] Add ability to disallow TPS to enroll a single
+  user on multiple tokens. (jmagne)
+- PKI TRAC Ticket #1711 - CLI :: pki-server ca-cert-request-find throws
+  IOError (edewata, ftweedal)
+- PKI TRAC Ticket #2285 - freeipa fails to start correctly after pki-core
+  update on upgraded system (ftweedal)
+- PKI TRAC Ticket #2311 - When pki_token_name=Internal, consider normalizing
+  it to "internal" (mharmsen)
+- PKI TRAC Ticket #2349 - Separated TPS does not automatically receive shared
+  secret from remote TKS (jmagne)
+- PKI TRAC Ticket #2364 - CLI :: pki-server ca-cert-request-show throws
+  attribute error (ftweedal)
+- PKI TRAC Ticket #2368 - pki-server subsystem subcommands throws error with
+  --help option (edewata)
+- PKI TRAC Ticket #2374 - KRA cloning overwrites CA signing certificate trust
+  flags (edewata)
+- PKI TRAC Ticket #2380 - Pki-server instance commands throws exception while
+  specifying invalid parameters. (edewata)
+- PKI TRAC Ticket #2384 - CA installation with HSM prompts for HSM password
+  during silent installation (edewata)
+- PKI TRAC Ticket #2385 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg
+  (ftweedal)
+- PKI TRAC Ticket #2387 - Add config for default OCSP URI if none given
+  (ftweedal)
+- PKI TRAC Ticket #2388 - CA creation responds 500 if certificate issuance
+  fails (ftweedal)
+- PKI TRAC Ticket #2389 - Installation: subsystem certs could have notAfter
+  beyond CA signing cert in case of external or existing CA (cfu)
+- PKI TRAC Ticket #2390 - Dogtag 10.3.4: Miscellaneous Enhancements
+  (akasurde, edewata)
+
+* Thu Jun 30 2016 Dogtag Team <pki-devel@redhat.com> 10.3.3-2
+- PKI TRAC Ticket #2373 - Fedora 25: RestEasy 3.0.6 ==> 3.0.17 breaks
+  pki-core (ftweedal)
 
 * Mon Jun 20 2016 Dogtag Team <pki-devel@redhat.com> 10.3.3-1
 - Updated release number to 10.3.3-1