- Resolves: bug #629951
  override LINK_MODE at compile-time to add -pie to linker flags, so that
  radiusd will be built as a PIE

- Resolves: bug #599521
  use DNS to resolve NAS-IPv6-Address attribute

- update to latest upstream, mainly bug fix release
- Resolves: bug #584101
  Feature improvements
  * Add radmin command "stats detail <file>" to see what
    is going on inside of a detail file reader.
  * Added documentation for CoA.  See raddb/sites-available/coa
  * Add sub-option support for Option 82.  See dictionary.dhcp
  * Add "server" field to default SQL NAS table, and documented it.

  Bug fixes
  * Reset "received ping" counter for Status-Server checks.  In some
    corner cases it was not getting reset.
  * Handle large VMPS attributes.
  * Count accounting responses from a home server in SNMP / statistics
    code.
  * Set EAP-Session-Resumed = Yes, not "No" when session is resumed.
  * radmin packet counter statistics are now unsigned, for numbers
    2^31..2^32.  After that they roll over to zero.
  * Be more careful about expanding data in PAP and MS-CHAP modules.
    This prevents login failures when passwords contain '{'.
  * Clean up zombie children if there were many "exec" modules being
    run for one packet, all with "wait = no".
  * re-open log file after HUP.  Closes bug #63.
  * Fix "no response to proxied packet" complaint for Coa / Disconnect
    packets.  It shouldn't ignore replies to packets it sent.
  * Calculate IPv6 netmasks correctly.  Closes bug #69.
  * Fix SQL module to re-open sockets if they unexpectedly close.
  * Track scope for IPv6 addresses.  This lets us use link-local
    addresses properly.  Closes bug #70.
  * Updated Makefiles to no longer use the shell for recursing into
    subdirs.  "make -j 2" should now work.
  * Updated raddb/sql/mysql/ippool.conf to use "= NULL".  Closes
    bug #75.
  * Updated Makefiles so that "make reconfig" no longer uses the shell
    for recursing into subdirs, and re-builds all "configure" files.
  * Used above method to regenerate all configure scripts.
    Closes bug #34.
  * Updated SQL module to allow "server" field of "nas" table
    to be blank: "".  This means the same as it being NULL.
  * Fixed regex realm example.  Create Realm attribute with value
    of realm from User-Name, not from regex.  Closes bug #40.
  * If processing a DHCP Discover returns "fail / reject", ignore
    the packet rather than sending a NAK.
  * Allow '%' to be escaped in sqlcounter module.
  * Fix typo internal hash table.
  * For PEAP and TTLS, the tunneled reply is added to the reply,
    rather than integrated via the operators.  This allows multiple
    VSAs to be added, where they would previously be discarded.
  * Make request number unsigned.  This changes nothing other than
    the debug output when the server receives more than 2^31 packets.
  * Don't block when reading child output in 'exec wait'.  This means
    that blocked children get killed, instead of blocking the server.
  * Enabled building without any proxy functionality
  * radclient now prefers IPv4, to match the default server config.
  * Print useful error when a realm regex is invalid
  * relaxed rules for preprocess module "with_cisco_vsa_hack".  The
    attributes can now be integer, ipaddr, etc.  (i.e. non-string)
  * Allow rlm_ldap to build if ldap_set_rebind_proc() has only
    2 arguments.
  * Update configure script for rlm_python to avoid dynamic linking
    problems on some platforms.
  * Work-around for bug #35
  * Do suid to "user" when running in debug mode as root
  * Make "allow_core_dumps" work in more situations.
  * In detail file reader, treat bad records as EOF.
    This allows it to continue working when the disk is full.
  * Fix Oracle default accounting queries to work when there are no
    gigawords attributes.  Other databases already had the fix.
  * Fix rlm_sql to show when it opens and closes sockets.  It already
    says when it cannot connect, so it should say when it can connect.
  * "chmod -x" for a few C source files.
  * Pull update spec files, etc. from RedHat into the redhat/ directory.
  * Allow spaces when parsing integer values.  This helps people who
    put "too much" into an SQL value field.

- Resolves: bug #539466

- bug #526559 initial install should run bootstrap to create certificates
  running radiusd in debug mode to generate inital temporary certificates
  is no longer necessary, the /etc/raddb/certs/bootstrap is invoked on initial
  rpm install (not upgrade) if there is no existing /etc/raddb/certs/server.pem file
- bug #528493 use sha1 algorithm instead of md5 during cert generation
  the certificate configuration (/etc/raddb/certs/{ca,server,client}.cnf) files
  were modifed to use sha1 instead of md5 and the validity reduced from 1 year to 2 months

- update to latest upstream
  Feature improvements
  * Print more descriptive error message for too many EAP sessions.
    This gives hints on what to do when "failed to store handler"
  * Commands received from radmin are now printed on stdout when
    in debugging mode.
  * Allow accounting packets to be written to a detail file, even
    if they were read from a different detail file.
  * Added OpenSSL license exception (src/LICENSE.openssl)

  Bug fixes
  * DHCP sockets can now set the broadcast flag before binding to a
    socket.  You need to set "broadcast = yes" in the DHCP listener.
  * Be more restrictive on string parsing in the config files
  * Fix password length in scripts/create-users.pl
  * Be more flexible about parsing the detail file.  This allows
    it to read files where the attributes have been edited.
  * Ensure that requests read from the detail file are cleaned up
    (i.e. don't leak) if they are proxied without a response.
  * Write the PID file after opening sockets, not before
    (closes bug #29)
  * Proxying large numbers of packets no longer gives error
    "unable to open proxy socket".
  * Avoid mutex locks in libc after fork
  * Retry packet from detail file if there was no response.
  * Allow old-style dictionary formats, where the vendor name is the
    last field in an ATTRIBUTE definition.
  * Removed all recursive use of mutexes.  Some systems just don't
    support this.
  * Allow !* to work as documented.
  * make templates work (see templates.conf)
  * Enabled "allow_core_dumps" to work again
  * Print better errors when reading invalid dictionaries
  * Sign client certificates with CA, rather than server certs.
  * Fix potential crash in rlm_passwd when file was closed
  * Fixed corner cases in conditional dynamic expansion.
  * Use InnoDB for MySQL IP Pools, to gain transactional support
  * Apply patch to libltdl for CVE-2009-3736.
  * Fixed a few issues found by LLVM's static checker
  * Keep track of "bad authenticators" for accounting packets
  * Keep track of "dropped packets" for auth/acct packets
  * Synced the "debian" directory with upstream
  * Made "unlang" use unsigned 32-bit integers, to match the
    dictionaries.

- Remove devel subpackage. It doesn't make much sense to have a devel package since
  we don't ship libraries and it produces multilib conflicts.

- more spec file clean up from review comments
- remove freeradius-libs subpackage, move libfreeradius-eap and
  libfreeradius-radius into the main package
- fix subpackage requires, change from freeradius-libs to main package
- fix description of the devel subpackage, remove referene to non-shipped libs
- remove execute permissions on src files included in debuginfo
- remove unnecessary use of ldconfig
- since all sub-packages now require main package remove user creation for sub-packages
- also include the LGPL library license file in addition to the GPL license file
- fix BuildRequires for perl so it's compatible with both Fedora, RHEL5 and RHEL6

- fix various rpmlint issues.

- rebuild against perl 5.10.1