<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="13">
<package pkgid="93593f2099f282c72d865d7ae9100b5b8a5d1d53d9925aa52077a8b36308e3a4" name="awp-agent" arch="x86_64">
  <version epoch="0" ver="2.10.0" rel="40174.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.1" date="1749556800">- firewall module, will clear existing firewall policy and replace it with the firewall-policy</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.7.0" date="1750420800">- firewall module, integration with the global whitelisting policy from the server
- firewall module, add support for windows</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.8.0" date="1760529600">- active-response: add ipset-based active response script (awp-ipset.sh)
- awp-ipset.sh: accept stdin JSON input like awp-firewall-drop.sh
- compliance-scanner: add Rocky Linux 10 benchmark
- compliance-scanner: add Rocky Linux 9 benchmark
- compliance-scanner: add Rocky Linux 8 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.0" date="1768478400">- AIX: Add support for AWPclamav in /opt/atomicorp
- AIX: Fix sed compatibility using perl wrapper
- AIX: Update malware-scanner path detection
- Add Enterprise Linux 10 (el10) support
- compliance-scanner: add Rocky Linux 10 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.2" date="1772193600">- active-response: Enhance awp-firewall-drop.sh with white-list support and IP validation
- retention: Update diff-retention-check.sh with date-based logging for rotation
- atomicorp-api: Fix JSON parsing for manual commands (upgrade/install)
- atomicorp-api: Add check_repository function to verify repo presence before updates
- active-response: Normalize service names during restart (ossec-hids vs ossec-agent)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.3" date="1772712000">- active-response: Fix premature service restart in atomicorp-api
- retention: Add date-based logging for rotation in diff-retention-check.sh
- clamav: Add /var/clamav and /var/lib/clamav as permanent excludes</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.4" date="1773835200">- active-response: Integrate ossec-execd dedup handshake (check_keys + phase2 abort) in atomicorp-api, malware-scan.sh, and atomic-isolate.ps1
- clamav: Remove SCA check 48170 and clam_configuration_check.sh (wrong approach for config parity)
- retention: diff-retention-check.sh — /var/ossec/logs, DEBUG=1 for file logging, chmod 755 on install; ASL_v6 issue #1509</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.5" date="1778068800">- compliance: ship CIS Kubernetes Benchmark v2.0.0 PDF and Kubernetes SCA policies `atomic_k8s_worker_kubelet.yml` + `atomic_k8s_control_plane.yml`; trigger copies CIS Ubuntu policies and Kubernetes YAML into ruleset/sca
- k8s-mapping: add static-friendly Go helper (Kubernetes API → NDJSON atomic_ossec.k8s_mapping.v1) under src/awp-agent/k8s-mapping for future syscollector integration
- active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.6" date="1778846400">- active-response: atomicorp-api — detached remote ossec upgrades (systemd-run --no-block, setsid+nohup, at, nohup) so agent RPM scriptlets cannot kill the package manager mid-transaction; dnf/yum/microdnf selection; ossec-agent vs ossec-hids restart probe; /var/ossec/tmp/awp-remote-upgrade.state; zypper path logs unsupported
- active-response: atomicorp-api — systemd-run uses bash redirection to log file (not StandardOutput=append), random unit name, --uid=0/--gid=0 for Rocky/RHEL 9 reliability
- RPM trigger: copy CentOS CIS SCA from modules/compliance/content/centos into ruleset/sca on CentOS hosts
- RPM trigger: remove Ubuntu SCA copy path (Debian/Ubuntu packages use debian postinst)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.10.0" date="1779105600">- compliance: Kubernetes SCA policies `cis_k8s_worker_kubelet.yml` and `cis_k8s_control_plane.yml` (CIS Kubernetes Benchmark v2.0.0 themes; kubeadm worker/control-plane heuristics); RPM trigger copies into `ruleset/sca/kubernetes` and removes legacy `atomic_k8s_*` names
- compliance: refresh `cis_rhel10_linux.yml` benchmark content
- RPM `%triggerin`: copy CentOS CIS policies from `modules/compliance/content/centos/&lt;major&gt;/` into `ruleset/sca` on CentOS hosts; drop Ubuntu-specific SCA install from RPM (Debian/Ubuntu use `.deb` postinst)</changelog>
</package>
<package pkgid="c6dc7efd99aea0f7f7882beb378567c57d573530e20184b48e5156dfd86e570a" name="awp-agent" arch="x86_64">
  <version epoch="0" ver="2.9.5" rel="40117.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.5.0" date="1745928000">- strip the compliance-scanner binary to reduce its size
- Fix for ubuntu postinstall to apply sca files
- Fix for clamav range, moved from 281xx to 481xx, this overlapped with RHEL9
- Add Rocky 9 benchmark
- Add command support to compliance-scanner
- Add summary result to compliance-scanner
- Add -failed to compliance-scanner, this will only show the failed results, otherwise tests that pass will be displayed with "passed"
- Update for ASL Issue#1284, this is to add remote upgrade support into the UI
- add Debian 12 benchmark
- postinst on deb systems target content adding based on OS version
- firewall module, only run on rhel/centos/rocky
- atomicorp-functions, add detection for u24
- Update ubuntu 14/16/18 CIS checks to detect the version of the OS before running
- Disable the Ubuntu 18 NX test, as this was dumping the entrie journalctl to the SCA's memory</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.0" date="1746705600">- compliance-scanner, add parallel scanning, file caching, and configurable max size limit scanning (8k default)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.1" date="1749556800">- firewall module, will clear existing firewall policy and replace it with the firewall-policy</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.7.0" date="1750420800">- firewall module, integration with the global whitelisting policy from the server
- firewall module, add support for windows</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.8.0" date="1760529600">- active-response: add ipset-based active response script (awp-ipset.sh)
- awp-ipset.sh: accept stdin JSON input like awp-firewall-drop.sh
- compliance-scanner: add Rocky Linux 10 benchmark
- compliance-scanner: add Rocky Linux 9 benchmark
- compliance-scanner: add Rocky Linux 8 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.0" date="1768478400">- AIX: Add support for AWPclamav in /opt/atomicorp
- AIX: Fix sed compatibility using perl wrapper
- AIX: Update malware-scanner path detection
- Add Enterprise Linux 10 (el10) support
- compliance-scanner: add Rocky Linux 10 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.2" date="1772193600">- active-response: Enhance awp-firewall-drop.sh with white-list support and IP validation
- retention: Update diff-retention-check.sh with date-based logging for rotation
- atomicorp-api: Fix JSON parsing for manual commands (upgrade/install)
- atomicorp-api: Add check_repository function to verify repo presence before updates
- active-response: Normalize service names during restart (ossec-hids vs ossec-agent)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.3" date="1772712000">- active-response: Fix premature service restart in atomicorp-api
- retention: Add date-based logging for rotation in diff-retention-check.sh
- clamav: Add /var/clamav and /var/lib/clamav as permanent excludes</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.4" date="1773835200">- active-response: Integrate ossec-execd dedup handshake (check_keys + phase2 abort) in atomicorp-api, malware-scan.sh, and atomic-isolate.ps1
- clamav: Remove SCA check 48170 and clam_configuration_check.sh (wrong approach for config parity)
- retention: diff-retention-check.sh — /var/ossec/logs, DEBUG=1 for file logging, chmod 755 on install; ASL_v6 issue #1509</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.5" date="1776772800">- active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts</changelog>
</package>
<package pkgid="244c9d101dec2676a61cc293179564798237ff0fabc02dfe8f9fe1a0c1b77934" name="awp-agent" arch="x86_64">
  <version epoch="0" ver="2.9.6" rel="40133.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.0" date="1746705600">- compliance-scanner, add parallel scanning, file caching, and configurable max size limit scanning (8k default)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.6.1" date="1749556800">- firewall module, will clear existing firewall policy and replace it with the firewall-policy</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.7.0" date="1750420800">- firewall module, integration with the global whitelisting policy from the server
- firewall module, add support for windows</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.8.0" date="1760529600">- active-response: add ipset-based active response script (awp-ipset.sh)
- awp-ipset.sh: accept stdin JSON input like awp-firewall-drop.sh
- compliance-scanner: add Rocky Linux 10 benchmark
- compliance-scanner: add Rocky Linux 9 benchmark
- compliance-scanner: add Rocky Linux 8 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.0" date="1768478400">- AIX: Add support for AWPclamav in /opt/atomicorp
- AIX: Fix sed compatibility using perl wrapper
- AIX: Update malware-scanner path detection
- Add Enterprise Linux 10 (el10) support
- compliance-scanner: add Rocky Linux 10 benchmark</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.2" date="1772193600">- active-response: Enhance awp-firewall-drop.sh with white-list support and IP validation
- retention: Update diff-retention-check.sh with date-based logging for rotation
- atomicorp-api: Fix JSON parsing for manual commands (upgrade/install)
- atomicorp-api: Add check_repository function to verify repo presence before updates
- active-response: Normalize service names during restart (ossec-hids vs ossec-agent)</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.3" date="1772712000">- active-response: Fix premature service restart in atomicorp-api
- retention: Add date-based logging for rotation in diff-retention-check.sh
- clamav: Add /var/clamav and /var/lib/clamav as permanent excludes</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.4" date="1773835200">- active-response: Integrate ossec-execd dedup handshake (check_keys + phase2 abort) in atomicorp-api, malware-scan.sh, and atomic-isolate.ps1
- clamav: Remove SCA check 48170 and clam_configuration_check.sh (wrong approach for config parity)
- retention: diff-retention-check.sh — /var/ossec/logs, DEBUG=1 for file logging, chmod 755 on install; ASL_v6 issue #1509</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.5" date="1776772800">- active-response: awp-firewall-drop.sh — fw-drop mutex under /run/awp-agent (fallbacks) instead of /var/ossec/active-response to avoid FIM noise on pid (issue #15); audited other shipped active-response scripts</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 2.9.6" date="1778846400">- active-response: atomicorp-api — detached remote ossec upgrades (systemd-run --no-block, setsid+nohup, at, nohup) so agent RPM scriptlets cannot kill the package manager mid-transaction; dnf/yum/microdnf selection; ossec-agent vs ossec-hids restart probe; /var/ossec/tmp/awp-remote-upgrade.state; zypper path logs unsupported
- active-response: atomicorp-api — systemd-run uses bash redirection to log file (not StandardOutput=append), random unit name, --uid=0/--gid=0 for Rocky/RHEL 9 reliability</changelog>
</package>
<package pkgid="f7738ffadb4eb43cf446d9de067d34accf3e42e854d862a1fa437d10de666f2f" name="ossec-hids" arch="x86_64">
  <version epoch="1" ver="4.11.0" rel="39873.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.0 and 4.10.2.</changelog>
</package>
<package pkgid="cb526fc31c89e0a5096b52cdfe97b62e81abc5d31a10b0a0f1068ab3fb1a6cb6" name="ossec-hids" arch="x86_64">
  <version epoch="1" ver="4.11.0" rel="39897.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.0 and 4.10.2.</changelog>
</package>
<package pkgid="5b80460fefd18ce3211c8745dd202baf5fa3620bc66920b7a9c4a1b17f611409" name="ossec-hids" arch="x86_64">
  <version epoch="1" ver="4.11.1" rel="40087.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.1-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.1 and 4.10.2.</changelog>
  <changelog author="Atomicorp &lt;support@atomicorp.com&gt; - 4.11.1-1" date="1777636800">- Bump version to 4.11.1 (see project CHANGELOG.md).</changelog>
</package>
<package pkgid="c0d2934873747c3c3eef046b475ece1e4c3052562487509b6af6e980c1d9753b" name="ossec-hids-agent" arch="x86_64">
  <version epoch="1" ver="4.11.0" rel="39873.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.0 and 4.10.2.</changelog>
</package>
<package pkgid="5fb3495b2ce9ec451c51dc1c967cced979f9846f4be13a9db7a33683c2d2948d" name="ossec-hids-agent" arch="x86_64">
  <version epoch="1" ver="4.11.0" rel="39897.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.0 and 4.10.2.</changelog>
</package>
<package pkgid="8f26a77eff67c3e231542730743a7da3231cf87cf495be2b299c8f39af4ed4c2" name="ossec-hids-agent" arch="x86_64">
  <version epoch="1" ver="4.11.1" rel="40087.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.1-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.1 and 4.10.2.</changelog>
  <changelog author="Atomicorp &lt;support@atomicorp.com&gt; - 4.11.1-1" date="1777636800">- Bump version to 4.11.1 (see project CHANGELOG.md).</changelog>
</package>
<package pkgid="d021103acabd6d33aafa5d094655c2f03bda6a9741e774b2c453074ce3166091" name="ossec-hids-server" arch="x86_64">
  <version epoch="1" ver="4.10.1" rel="39401.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
</package>
<package pkgid="5b9651a06d77f92ac848fb6fca742014ed007cd16c5ea43416b3dbe036748b9e" name="ossec-hids-server" arch="x86_64">
  <version epoch="1" ver="4.11.0" rel="39873.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.0-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.0 and 4.10.2.</changelog>
</package>
<package pkgid="9c6ba5bd64fc0af6d97c640b923158c93fb17c0b4198a7ba0c78a9285efd8a13" name="ossec-hids-server" arch="x86_64">
  <version epoch="1" ver="4.11.1" rel="40087.el10.art"/>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.10.1-1" date="1742299200">- ossec-execd (server/manager): after active-response stdin/stdout handshake (continue/abort), close child pipes with `wpdetach()` instead of blocking on `waitpid`; reap children in the existing `waitpid(..., WNOHANG)` loop so long-running AR does not stall the exec queue. (See project `CHANGELOG.md` §4.10.1; Windows: `wpdetach` still uses `wpclose` until further process support.)
- active-response: `asl-ipset.sh` — execd JSON shun path (ipset, iptables set ref), `active-responses.log` line per run; see `CHANGELOG.md` §4.10.1.
- Drop `ar-tracking.sh` from extraneous sources (script retired; package install was already disabled).
- Renumber `ossec-hids-authd.service` to Source10.</changelog>
  <changelog author="Support &lt;support@atomicorp.com&gt; - 4.11.1-1" date="1775563200">- Syscollector OCI container inventory (docker/podman discovery, dbsync) and agent DB schema v11 (`sys_containers`, upgrade path). Merged `master` through 4.10.2 (endpoint UUID, keepalive batch / SQLite busy hardening, UID/HTTPS and `WDBC_CONSTRAINT` handling). See project `CHANGELOG.md` sections 4.11.1 and 4.10.2.</changelog>
  <changelog author="Atomicorp &lt;support@atomicorp.com&gt; - 4.11.1-1" date="1777636800">- Bump version to 4.11.1 (see project CHANGELOG.md).</changelog>
</package>
<package pkgid="8cbb900a7ecbce8cde1780a519b54553f9c87153ca7fae4cbfe8c83d4a4a72c2" name="syft" arch="x86_64">
  <version epoch="0" ver="1.44.0" rel="1.el10"/>
  <changelog author="Scott R. Shinn &lt;scott@atomicrocketturtle.com&gt; - 1.39.0-1" date="1768478400">- Initial RPM package for Syft</changelog>
  <changelog author="Scott R. Shinn &lt;scott@atomicrocketturtle.com&gt; - 1.40.1-1" date="1768564800">- Update to version 1.40.1</changelog>
  <changelog author="Scott R. Shinn &lt;scott@atomicrocketturtle.com&gt; - 1.41.1-1" date="1769688000">- Update to version 1.41.1</changelog>
  <changelog author="Scott R. Shinn &lt;scott@atomicrocketturtle.com&gt; - 1.42.0-1" date="1771156800">- Update to version 1.42.0</changelog>
  <changelog author="Scott R. Shinn &lt;scott@atomicrocketturtle.com&gt; - 1.42.1-1" date="1771416000">- Update to version 1.42.1</changelog>
  <changelog author="Scott R. Shinn &lt;scott@atomicrocketturtle.com&gt; - 1.42.3-1" date="1774699200">- Update to version 1.42.3</changelog>
  <changelog author="Scott R. Shinn &lt;scott@atomicrocketturtle.com&gt; - 1.44.0-1" date="1778241600">- Update to version 1.44.0</changelog>
</package>
</otherdata>