v1.3.1 - Aug 26, 2013
---------------------
Bugfixes:
        * Response with NSID contained extra bytes after reload
        * List of remotes is scanned for longest prefix match
        * Multipacket TSIG signatures for transfers
        * Wrongly parsed TSIG key secret without quotes
        * Removed autoconf checks for extended instruction sets

v1.3.0 - Aug 5, 2013
--------------------
Features:
        * Defaults for CH TXT id.server,version.server (see doc)
Bugfixes:
        * Progressive interval for bootstrap retry
        * Transfers randomly cancelled
        * Disabling RRL on reload
        * Secondary groups not initialized when dropping privileges
        * Responding to DS queries for names at or below delegation points

v1.3.0-rc5 - Jul 29, 2013
-------------------------
Features:
        * Much faster bootstrap of many zones
Bugfixes:
        * Removed deprecated 'knotc -w' option
        * Slave ignores out-of-zone records in zone
        * Support for obsolete types in zone transfers
        * Slave zone file names fixes
        * Long transfers being randomly dropped

v1.3.0-rc4 - Jul 15, 2013
-------------------------
Features:
        * --with-configdir option for default config path
        * Reintroducted 'pidfile' config option
Bugfixes:
        * AXFR/IXFR subsystem performance improvements
        * Rescheduling of AXFR in some cases
        * RRSIGs not in the same section for DS records
        * Log messages leaking to syslog
        * 'knotc restart' option removed due to several limitations

v1.3.0-rc3 - Jun 28, 2013
-------------------------

Features:
        * Utility to estimate memory consumption (see 'knotc memstats')
        * PID file is not created when running on foreground
        * UNIX sockets support for knotc
        * Configurable 'rundir' and 'storage'

Bugfixes:
        * IXFR with an arbitrary number of diffs
        * Processing of knotc TSIG keyfile
        * Atomic PID file writing, removed deprecated 'knotc start'
        * Performance regression when RRSIGs came before covered RRs in AXFR

v1.3.0-rc2 - Jun 14, 2013
-------------------------

Bugfixes:
        * Label compression related bug
        * Proper resolution of some CNAME chains
        * Unstable response rate in rare cases
        * Several log messages

v1.3.0-rc1 - Jun 4, 2013
---------------------------

Features:
        * Faster zone parser
        * Full support for EUI and ILNP resource records
        * Lower memory footprint for large zones
        * No compilation of zones
        * Improved scheduling of zone transfers
        * Logging of serials and timing information for zone transfers
        * Config: 'groups' keyword allowing to create groups of remotes
        * Config: 'include' keyword allowing other file includes
        * Client utilities: kdig, khost, knsupdate
        * Server identification using TXT/CH queries (RFC 4892)
        * Improved build scripts
        * Improved dname compression and performance
Bugfixes:
        * Fixed creating of PID file when dropping privileges
Updated net/knot to 1.3.1
Add support for 64-bit SunOS.
1.5.3:
Bugfix
[CPPXT-92] - Update xmlsig 1.1 schema to final CR

Improvements
[CPPXT-94] - Configuration check should check for missing private key
[CPPXT-95] - Improve logging when libcurl is built without OpenSSL

1.5.2:
Bugfixes
[CPPXT-89] - Regression in deprecated catalog_path option during initialization
[CPPXT-90] - X509Digest generates base64 based on hex digest instead of binary

Improvement
[CPPXT-91] - KeyInfoResolver code returns empty credential object.

1.5.1:
Improvement
[CPPXT-88] - Support path resolution in ParserPool / catalog files

1.5.0:
Bugfixes
[CPPXT-76] - Remove compile time version output where possible.
[CPPXT-79] - link fails if xml-security-c library outside default link path
[CPPXT-83] - Transport layer not handling Last-Modified header correctly
[CPPXT-84] - Problems compiling log4shib on Solaris SPARC 10 with Sun
             Studio 12.1 with 64bit libraries
[CPPXT-86] - Small Memory Leak in XMLObjectBuilder::buildFromElement()

Improvements
[CPPXT-70] - Improve remote CRL access and caching support
[CPPXT-78] - Support configuration of name and policy restrictions for the
             signature metadata filter (signing certificate)
[CPPXT-82] - libcurl, ExplicitKeyTrustEngine, PKIX could provide additional
             debug information
[CPPXT-87] - Libcurl versions before 7.20 do not refresh caches of IdP IP
             address look-ups - this breaks SAML1 attribute query if the IdP's
             IP address is changed
Updated textproc/xmltooling to 1.5.3
2.5.3:
Bugfixes
[CPPOST-83] - Compile error with boost 1.53
[CPPOST-86] - samlsign core dumps when -dig option is used

2.5.2:
(none)

2.5.1:
Bugfixes
[CPPOST-79] - Typo in "metadata intance failed manual validation checking"
              log message
[CPPOST-80] - SAMLTIME_MAX constant breaks for universal Mac builds

Improvement
[CPPOST-78] - Add metadata:rpi schema to OpenSAML

2.5.0:
Bugfixes
[CPPOST-65] - Remove compile time version output where possible.
[CPPOST-70] - Problem calling virtual functions from base class constructors
[CPPOST-71] - Various clone methods are broken.
[CPPOST-75] - ChainingTrustEngine resets SOAP/TLS-based null peer entity name,
              forces TrustEngine name matching

Improvements
[CPPOST-74] - metadata provider should check validity before replacing
              old metadata
[CPPOST-76] - filter IdPs somehow that don't declare themselves "ready"

New Features
[CPPOST-69] - Load Folders of Metadata
[CPPOST-73] - Metadata filter that can add EntityAttribute tags
Updated security/opensaml to 2.5.3
OpenDNSSEC 1.4.2 - 2013-09-11

* OPENDNSSEC-428: ods-ksmutil: Add option for 'ods-ksmutil key generate' to
  take number of zones as a parameter

Bugfixes:
* SUPPORT-66: Signer Engine: Fix file descriptor leak in case of TCP write
  error [OPENDNSSEC-427].
* SUPPORT-71: Signer Engine: Fix double free crash in case of HSM connection
  error during signing [OPENDNSSEC-444].
* OPENDNSSEC-401: 'ods-signer sign <zone> --serial <nr>' command produces seg
  fault when run directly on command line (i.e. not via interactive mode)
* OPENDNSSEC-440: 'ods-ksmutil key generate' and the enforcer can create
  too many keys if there are keys already available and the KSK and ZSK use
  same algorithm and length
* OPENDNSSEC-424: Signer Engine: Respond to SOA queries from file instead
  of memory. Makes response non-blocking.
* OPENDNSSEC-425 Change "hsmutil list" output so that the table header goes
  to stdout not stderr
* OPENDNSSEC-438: 'ods-ksmutil key generate' and the enforcer can create
  too many keys for <SharedKeys/> policies when KSK and ZSK use same
  algorithm and length
* OPENDNSSEC-443: ods-ksmutil: Clean up of hsm connection handling
* Signer Engine: Improved Inbound XFR checking.
* Signer Engine: Fix double free corruption in case of adding zone with
  DNS Outbound Adapters and NotifyCommand enabled.
Updated security/opendnssec to 1.4.2
Rename newly imported "raduko-star" to "rakudo-star", on behalf of
sno@ (and with his OK) since he's AFK for another couple days.
s/raduko-star/rakudo-star/