+* Fri Mar 29 2019 Thierry Parmentelat <thierry.parmentelat@inria.fr> - sfa-5.0-0
+- ported to python3 - no other change
+
+* Mon Jan 07 2019 Thierry <Parmentelat> - sfa-4.0-2
+- have shebangs mention python2 since it is what this version runs on
+- use rpm names in python2-something for expressing dependencies
+- remove build dependency to python-setuptools
+- Handle C-BAS hrn format with "\" (Loic)
+- sfa-start does not daemonize anymore (this is handled by systemd)
+- a little nicer logs when troubleshooting auth issues
+- use systemctl in Makefile when syncing
+
+* Wed May 30 2018 Thierry <Parmentelat> - sfa-4.0-1
+- systemd service files install in /lib instead of /usr/lib for ubuntus
+- removed all features relating to slice manager
+- removed all features relating to component manager
+
+* Mon May 28 2018 Thierry <Parmentelat> - sfa-4.0-0
+- expose geni_api_versions as https://
+- avoid publishing non-relevant entries in GetVersion
+- fixes in the IoT-lab driver (thanks Loic)
+- reviewed logging policy, less awkward and more reliable; /var/log/sfa{,-import}.log should now be alive and time rotate
+- rewrote init-style startup script into systemd-native services: sfa-aggregate and sfa-registry, that both depend on sfa-db
+- huge cleanup, removed everything related to init.d; debian; flash-policy; max aggregate; federica, openstack/nova and nitos drivers
+
+* Fri Mar 16 2018 Thierry <Parmentelat> - sfa-3.1-22
+- pl: tweaks for exposing country / city on nodes from site tags if set
+- pl: tweaks for exposing hardware_types on nodes from node tag 'hardware_type' if set
+- pl: fix exposing granularity
+- sfaresetgids.py: a utility to reset gids when a update of the tolpevel gis is needed
+- iotlab: various tweaks
+- patch backported from plcapi about issues with xmlrpc and unicode under fedora >= 24
+
+* Fri Jan 13 2017 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-21
+- sfax509 command can run openssl x509 on all the parts of a gid
+- bugfix in sfi when running the discover subcommand
+- PEP8'ed a substantial part of the code
+- additional debug in chain verification
+- sfi myslice more robust - ignores broken slices
+- new sfi introspect
+- for myslice: the trust/ package should be python3-ready
+- * provided that m2crypto is
+- * although the devel version of m2crypto wroks just fine for us
+- * even if it's incomplete for other aspects that we do not care about
+
+* Thu Dec 17 2015 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-20
+- minor fixes for migrating on fedora23
+
+* Tue Dec 08 2015 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-19
+- imported changes from GENI as reported - Aaron Helsinger
+- minimal changes so that parts can be imported from nepi/py3
+- iotlab driver : fix ASAP jobs with state != Waiting, Running - Frederic
+- sfi client more accurately advertises rspec version - Loic
+- + bugfix in initscript
+
+* Mon Jun 08 2015 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-18
+- incorporated Frederic Saint Marcel's addition of ASAP management tag
+
+* Fri Jun 05 2015 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-17
+- workaround for 'name' not being exposed properly by List() on authority objects
+- fix a corner case in PL importer
+- trashed module registry_manager_openstack
+
+* Thu Jun 04 2015 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-16
+- added a new builtin column 'name' for authorities in the sfa registry
+- this is kept in sync with MyPLC's site names when relevant
+- sfa update -t authority thus now has a new -n/--name option
+- sfi register or update can specify record type on only 2 characters (au, us, no, or sl)
+- reviewed Describe and Allocate wrt slice tags for a PL AM:
+- Describe now exposes all slice tags with a 'scope' being 'sliver' or 'slice'
+- Allocate now by default ignores incoming slice tags
+- Allocate's options can mention 'pltags' among 'ignore', 'append', 'sync'
+- default being 'ignore'
+- in 'ignore' mode, slice tags are unchanged in the PL db
+- in 'append' mode, slice tags from the rspec are added to the db unless
+- they are already present
+- in 'sync' mode, the code attempts to leave the PL db in sync with the tags
+- provided in rspec; this can be dangerous and is thus no longer the default
+- behaviour
+
+* Thu Apr 23 2015 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-15
+- major rework of the iotlab driver, that uses an IoT-lab REST API
+- and so does not need to interact with LDAP and OAR directly
+- deprecated cortexlab driver altogether
+- cosmetic changes in displaying credentials, rights and certificates
+- for hopefully more readable error messages
+- always start postgresql if not running (ignore /etc/myplc-release)
+- does not need lxc=enter-namespace anymore for make sync
+
+* Thu Apr 09 2015 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-14
+- for SSL & python-2.7.9: ignore server verification
+- assume 2.7: remove compat code - always use HTTPSConnection (not HTTPS anymore)
+- fix: Reset GIDs works even if user has no pub_key
+- tweak for ubuntu (that does not have systemctl)
+- iotlab driver: fix ldap account creation at each lease
+- miscell cosmetic & layout
+
+* Mon Dec 01 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-13
+- bugfix - was adding extraneous backslashes in email address when attempting to AddPerson
+
+* Mon Sep 15 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-12
+- getting closer with the pip/pypi packaging
+
+* Mon Sep 15 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-11
+- various tweaks for the openlab demo
+- first stab at uploading onto a pypi (for pip install sfa)
+
+* Wed Aug 20 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-10
+- rewrote an optimized version of verify_persons in the PL driver:
+- Allocate and Provision should now perform much faster
+- in the bargain, changed the way dummy persons are created by SFA:
+- the sfa email is used when free, otherwise a fake email is made up from hrn
+- e.g. hrn=onelab.inria.thierry_parmentelat -> email=thierry_parmentelat@onelab.inria.stub
+- verify_chain debug flow does not up any more by default
+- various fixes in the iotlab driver
+
+* Mon Jul 21 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-9
+- Register can change the user keys using 'reg-keys' as well as 'keys'
+- also accept a single string rather than a list of keys
+- remove 'geni_api' from the registry GetVersion (which is not based on geni anymore)
+- bump the 'sfa' tag in the same registry GetVersion to 3
+- remove all mutable used as default arguments
+
+* Thu Jun 05 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-8
+- bugfix, sfi remove was broken
+
+* Wed Jun 04 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-7
+- sfi return code should be more meaningful - not yet for all commands though
+- DEFAULT_CREDENTIAL_LIFETIME now 28 days (was 31)
+- dropped support for legacy credentials
+- bugfix: short-lived credentials triggered a bug with UTC translated into localtime
+- further minor cleanup of timestamp formats
+
+* Mon Jun 02 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-6
+- iotlab driver: Allocate uses OAR
+- iotlab driver: using actual_caller_hrn
+
+* Thu May 29 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-5
+- Slice Manager is down by default
+- sfi renew -l/--as-long-as-possible and e.g. sfi renew <> +2[d|w|m]
+- also renew tries to find a max date for renewal instead of bailing out
+- sfaclientlib file names scheme keeps track of user as well as object for credentials
+- none fields get removed before sending over xmlrpc - partially for now
+- cleanup on time formats and - hopefully timezones
+- cleanup on speaking_for
+- Allocate passes actual_caller_hrn as part of options to driver
+- iotlab driver and leases
+- new modules abac_credential, credential_factory and speaksfor_util
+
+* Tue May 06 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-4
+- for register and update, client is expected to set
+- reg-researchers rather than researcher
+- reg-pis rather than pi
+- although the old forms are still supported
+- renamed sfi add into sfi register (add still works)
+- sfaadmin to return a meaningful exit code when fails
+- fix for sfadump
+- plimporter to report and ignore person or slice without a hrn
+- add support for stuff like sfi update -t slice -x the.slice.hrn -r none
+
+* Thu Apr 03 2014 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-3
+- fix for user hrn's that have a dash in their leaf
+- fix for names of GENI federates
+- fix for SFA_MAX_SLICE_RENEW
+
+* Thu Feb 20 2014 Mohamed Larabi <mohamed.larabi@inria.fr> - sfa-3.1-2
+- -- Core
+- added support for geni_extend_alap (as long as possible) in RenewSliver.
+- adding support for geni_speaking_for option,
+- -- RSpecs
+- Add support for Ofelia OpenFlow RSpecs
+- -- PlanetLab
+- Set Admins as PI's of the top authority while importing.
+- -- IoTLab
+- Iotlab and cortexlab ported to geni-v3.
+- Moving methods using the SFA db and api object from Shell to Driver.
+- Propagating the changes in iotlabimporter, iotlabaggregate and iotlabslices.
+- Iotlab now using sfa database for the special table lease_table.
+- Using alchemy.py classes to create a session to the DB.
+- Cleaning and documenting.
+- Fix Allocate() API call
+- -- client
+- handle single slivers.
+- fix sfi.py version and trusted.
+- -- PlanetLab
+- handle single slivers by Provision(), Delete() and PerformOperationalAction().
+- fix foreign slices mgt in sliver_to_slice_xrn() and check_sliver_credentials().
+- wider mgt of new slice url and description.
+- -- Packaging
+- rename senslab package into iotlab.
+- don't package xml-builder anymore.
+- fix debian/ubuntu packaging.
+
+* Tue Dec 10 2013 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.1-1
+- -- core
+- clean up rspecs.
+- GENIv3 rspecs enhirits everything from pgv2.
+- fix dbsession mgt by attributing each incoming API call has its own dbsession.
+- update all drivers and v2_to_v3_adapter according to dbsession fix.
+- fix DB migration.
+- -- client
+- fix sfi.py myslice.
+- sfi.py new option "my_pkcs12".
+- sfi.py defaulr rspec version is GENIv3
+- sfi.py trusted target either Registry interface or Slice interface.
+- -- PlanetLab
+- rebase all pl driver operations around the objects HRNs.
+- ignore objects (Site/Slice/Person/Node) coming from MyPLC peering.
+- importer ignores sites with tag sfa_created='True'.
+- -- IoTLab
+- In progress writing of native AM API v3 compliant driver.
+
+* Thu Oct 10 2013 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.0-2
+- -- core
+- Extend all versions of rspecs in order to support "links" and "channels" management methods
+- several fixes aroung Rspecs in order to make the code usable by 3rd-party tools
+- expose PL node tags in PGv2 and GENIv3 rspecs
+- fix default slivers mgt in sfav1 rspecs
+- fix SM and AM urn format in GetVersion
+- fix sfaadmin.py to handle extra testbed-dependent info
+- -- PlanetLab
+- Better management of external Slices/Persons/Sites
+- Importer ignores external Slices/Persons/Sites
+- -- Nitos
+- uniformize Leases management
+- address channels with urn
+- -- IotLab
+- Renaming slab folders, files and variables to iotlab, the new name of the platform.
+- New class ParsingResourcesFull in Oarrestapi file. Contain all the parsing nodes functions.
+- Adding a mobile field to iotlab rspec and a mobility type attribute .
+- Granularity changed to 60 sec.
+- Fixing returned rspec in GetSlices and GetLeases.
+- Corrections in import (importing nodes)
+- More testis in script files under testbeds/iotlab/tests . Creation of Rspecs request models under r testbeds/iotlab/tests /tests_rspec
+- Lease filtering by date added in GetLeases.
+- Commenting and cleaning
+
+* Wed Jun 19 2013 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-3.0-1
+- AM API v3-based first implementation.
+- planetlab native V3 driver
+- dummy native V3 driver
+- introduction of v2_to_v3_adapter
+- lease times in RFC3339 date format, not epoch
+- mostly in line with geni-v2 for non-v3 issues like packaging and all
+
+* Tue Feb 26 2013 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-25
+- sfi and sfaadmin list now share the same display code for related objs
+- support for advertising alternate api urls - for other API versions - api_versions.xml
+- cleaned up GID class
+- senslab: improved importer
+- senslab: add site to SlabLocation from Location
+- senslab: new class JsonPage
+- senslab: fix debian packaging
+- federica: fix list_slices
+
+* Tue Jan 29 2013 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-24
+- merged the senslab driver from git.f-lab.fr
+- merged the teagle flavour
+- debian packaging should work much better
+- added debug messsages for when db connection fails
+
+* Sun Jan 20 2013 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-23
+- minor fix in registry
+- fix for sfi gid, use clientbootstrap
+- support for debians and ubuntus (packaging and initscript)
+- deprecated cm package altogether
+- pl flavour, minor fix for tags
+- various fixes for the dummy flavour
+
+* Sun Dec 16 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-22
+- suited (and required) to run with plcapi-5.1-5 b/c of changes to AddPerson
+- tweaks in nitos importer
+- improvements to sfaadmin check-gid
+
+* Tue Dec 11 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-21
+- PL importer: minor fixes for corner cases
+- PL importer: also handles last_updated more accurately
+- sfi update can be used to select a key among several in PL
+- sfi add/update usage message fixes (no more record)
+- new feature sfaadmin registry check_gid [-a]
+
+* Mon Dec 03 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-20
+- fix 2 major bugs in PL importer
+- esp. wrt GID management against PLC key
+
+* Wed Nov 28 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-19
+- nicer sfi delegate, can handle multiple delegations and for authorities(pi) as well
+
+* Wed Nov 28 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-18
+- support fordelegation in sfaclientlib
+- sfi delegate fixed
+- other delegation-related sfi option trashed
+- new config (based on ini format)
+- new dummy driver and related package
+- pl importer has more explicit error messages
+- credential dump shows expiration
+
+* Tue Oct 16 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-17
+- bugfix in forwarding Resolve requests
+- various fixes in the nitos driver wrt keys and users
+
+* Mon Oct 01 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-16
+- various tweaks for the nitos driver
+
+* Wed Sep 26 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-15
+- first stab at a driver for the NITOS/OMF testbed (sep. pkg)
+- deeper cleanup of the data-dependencies between SFA and the testbed
+- in particular, sfi create issues Resolve(details=False)
+- for that purpose, Resolve exposes reg-* keys for SFA builtins
+- which in turn allows sfi list to show PIs, slice members and keys
+- NOTE: sfa-config-tty is known to be broken w/ less frequently used func's
+- Shows stacktrace when startup fails (DB conn, wrong flavour, etc..)
+
+* Mon Sep 17 2012 Thierry Parmentelat <thierry.parmentelat@sophia.inria.fr> - sfa-2.1-14
+- configurable data-dir (/var/lib/sfa)
+- no more dependent on myplc-config
+- some support for hrns with _ instead of \.
+- fix for PL importing in presence of gpg keys
+- DeleteSliver returns True instead of 1 in case of success
+- Various improvements on the openstack/nova side
+- new package sfa-nitos
+