[Bug] - sudo - incomplete changelog

[paulez]

Describe the bug
sudo package version 1.9.15-1.p5.amzn2023.0.3 has only 2 changelog entries:

bash-5.2# rpm -q --changelog sudo
* Mon Apr 06 2026 Zayd Rajab <zaydr@amazon.com> - 1.9.15-1.p5.amzn2023.0.3
- Fix CVE-2026-35535

* Thu Jun 26 2025 Josiah Vehrs <jvehrs@amazon.com> - 1.9.15-1.p5.amzn2023.0.2
- Patch CVE-2025-32462
- Patch CVE-2025-32463

Many available package versions in the repo are not listed in the changelog:

bash-5.2# dnf list --showduplicates sudo
Last metadata expiration check: 0:00:43 ago on Thu Jul 30 13:00:44 2026.
Installed Packages
sudo.x86_64                                  1.9.15-1.p5.amzn2023.0.3                                   @amazonlinux
Available Packages
sudo.x86_64                                  1.9.12-1.p2.amzn2023.0.2                                   amazonlinux 
sudo.x86_64                                  1.9.12-1.p2.amzn2023.0.3                                   amazonlinux 
sudo.x86_64                                  1.9.13-1.p2.amzn2023.0.1                                   amazonlinux 
sudo.x86_64                                  1.9.13-1.p2.amzn2023.0.3                                   amazonlinux 
sudo.x86_64                                  1.9.13-1.p2.amzn2023.0.4                                   amazonlinux 
sudo.x86_64                                  1.9.14-1.p3.amzn2023.0.1                                   amazonlinux 
sudo.x86_64                                  1.9.15-1.p5.amzn2023.0.1                                   amazonlinux 
sudo.x86_64                                  1.9.15-1.p5.amzn2023.0.2                                   amazonlinux 
sudo.x86_64                                  1.9.15-1.p5.amzn2023.0.3                                   amazonlinux 

Could we fix the changelog to be complete?

To Reproduce
Steps to reproduce the behavior:

1. Install sudo
2. Run rpm -q --changelog sudo

Expected behavior
Changelog cover all previous versions of the sudo package.

Additional context
Add any other context about the problem here.

[FusionPow]

Thanks for reporting this, Paul. We confirmed the older missing entries are expected under AL2023’s RPM changelog retention policy rather than a loss of source history.

AL2023 follows Fedora’s RPM configuration, which overrides RPM’s default and sets the maximum changelog age to two years:

# Automatically trim changelog entries after 2 years
%_changelog_trimage %{expr:2*365*24*60*60}

RPM measures this relative to the newest changelog entry. For this sudo build, the newest entry is April 6, 2026, making the cutoff April 6, 2024. Existing source entries from January 2024 and earlier are therefore omitted from the packaged RPM metadata while remaining in the source spec.

[stewartsmith]

There's two things we've been musing on that may be relevant and it'd be good to get feedback on:

1. What is valuable to have in RPM changelogs and what isn't? What could just be in separate documentation such as the published release notes? While relatively minor in compressed size, it does all add up, and scaled across all instances, it's a decent amount of disk space (and cost) that goes to RPM changelogs that are only looked at in more specific scenarios
2. How many older packages to keep in the repo. Since we have deterministic updates so it's easy to access repos of older releases, they'd still be readily accessible for those who need to. Having all the old versions in all of the repos ends up using extra network bandwidth for metadata, extra disk space, and extra memory. That adds up too, and can put more strain on smaller instance types.