fips-mode-setup, fips-finish-install: call zipl more often (s390x-specific)
libssh: enable diffie-hellman-group14-sha256 support
openssl: fix disabling ChaCha20

implement scoped policies, e.g., cipher@SSH = ... (#1960266)
deprecate derived properties:
deprecate sha1_in_dnssec property
deprecate unscoped form of protocol property
update documentation
expand upstream test coverage
openssl: set MinProtocol / MaxProtocol separately for TLS and DTLS (#1946522)
support AES-192 ciphers in custom policies for non-TLS scenarios (#1876846)
stop claiming Camellia is disabled (#1925104)
disable CBC ciphers in FUTURE for everything but Kerberos (#1933016)
drop SHA224 from signature algorithms in FIPS:OSPP (#1934755)
condition ecdh-sha2-nistp384 on SECP384R1

OSPP subpolicy: tweak for RHEL-8.3+
libssh: respect ssh_certs

OSPP subpolicy: remove AES-CCM
openssl: handle the AES-CCM removal properly

disallow X448/ED448 in FIPS policy with gnutls >= 3.6.12
add AD-SUPPORT policy module

fallback to FIPS policy instead of the default-config in FIPS mode
java: Document properly how to override the crypto policy
krb5: No support for 3des anymore
reorder the signature algorithms to follow the order in default openssl list

make the post script work in environments where /proc/sys is not available

automatically set up FIPS policy in FIPS mode on first install

explicitly enable DHE-DSS in gnutls config if enabled in policy
use grubby with --update-kernel=ALL to avoid breaking kernelopts
OSPP subpolicy: Allow GCM for SSH protocol
openssh: Support newly standardized ECDHE-GSS and DHE-GSS key exchanges
if the policy in FIPS mode is not a FIPS policy print a message
openssl: Add SignatureAlgorithms support
custom crypto policies: enable completely overriding contents of the list
added ECDHE-ONLY.pmod policy module example
openssh: make LEGACY policy to prefer strong public key algorithms
various python code cleanups
update-crypto-policies: dump the current policy to
policies/state/CURRENT.pol
split scripts into their own subpackage

move the pre-built .config files to /usr/share/crypto-policies/back-ends

fips-mode-setup: compatibility with RHCOS

add FIPS subpolicy for OSPP

custom crypto policies support
update-crypto-policies: fix handling of list operations in policy modules
update-crypto-policies: fix updating of the current policy marker
fips-mode-setup: fixes related to containers and non-root execution
make it possible to use fips-mode-setup --check without dracut
add .config symlinks so a crypto policy can be set with read-only
mounting /usr/share/crypto-policies/<policy> to
policies/back-ends
run the update-crypto-policies in posttrans

gnutls: enable TLS-1.3 in the FIPS policy

fix ownership of policy directories
nss: enable X25519 in appropriate policies and conflict with old nss
openssh: conflict with old incompatible openssh version

openssh: add missing curve25519-sha256 to the key exchange list
openssh: fix RSA certificate support
fips-mode-setup: drop the kernel boot option if there is no separate
fips-finish-install: regenerate all initramdisks
add libssh configuration backend