diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/.gitignore b/.gitignore
index 67ec311..f334ce1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,11 @@ at_3.1.12.orig.tar.gz
 /at_3.1.20.orig.tar.gz
 /at_3.1.23.orig.tar.gz
 /at_3.1.23.orig.tar.gz.asc
+/at_3.2.1.orig.tar.gz
+/at_3.2.1.orig.tar.gz.asc
+/at_3.2.2.orig.tar.gz
+/at_3.2.2.orig.tar.gz.asc
+/at_3.2.4.orig.tar.gz
+/at_3.2.4.orig.tar.gz.asc
+/at_3.2.5.orig.tar.gz
+/at_3.2.5.orig.tar.gz.sig
diff --git a/at-3.1.14-usePOSIXtimers.patch b/at-3.1.14-usePOSIXtimers.patch
deleted file mode 100644
index 89c5614..0000000
--- a/at-3.1.14-usePOSIXtimers.patch
+++ /dev/null
@@ -1,111 +0,0 @@
-diff -up at-3.1.14/atd.c.timers at-3.1.14/atd.c
---- at-3.1.14/atd.c.timers	2013-12-02 11:03:01.250080057 +0100
-+++ at-3.1.14/atd.c	2013-12-02 11:06:15.560243498 +0100
-@@ -831,6 +831,54 @@ run_loop()
-     return next_job;
- }
- 
-+#ifdef HAVE_TIMER_CREATE
-+timer_t timer;
-+struct itimerspec timeout;
-+
-+void timer_setup()
-+{
-+    struct sigevent sev;
-+
-+    sev.sigev_notify = SIGEV_SIGNAL;
-+    sev.sigev_signo = SIGHUP;
-+    sev.sigev_value.sival_ptr = &timer;
-+
-+    memset(&timeout, 0, sizeof(timeout));
-+
-+    if (timer_create(CLOCK_REALTIME, &sev, &timer) < 0)
-+           pabort("unable to create timer");
-+}
-+
-+time_t atd_gettime()
-+{
-+    struct timespec curtime;
-+
-+    clock_gettime(CLOCK_REALTIME, &curtime);
-+
-+    return curtime.tv_sec;
-+}
-+
-+void atd_setalarm(time_t next)
-+{
-+    timeout.it_value.tv_sec = next;
-+    timer_settime(timer, TIMER_ABSTIME, &timeout, NULL);
-+    pause();
-+}
-+#else
-+void timer_setup()
-+{
-+}
-+
-+time_t atd_gettime()
-+{
-+    return time(NULL);
-+}
-+
-+void atd_setalarm(time_t next)
-+{
-+    sleep(next - atd_gettime());
-+}
-+#endif
- /* Global functions */
- 
- int
-@@ -936,7 +984,7 @@ main(int argc, char *argv[])
-     sigaction(SIGCHLD, &act, NULL);
- 
-     if (!run_as_daemon) {
--	now = time(NULL);
-+	now = atd_gettime();
- 	run_loop();
- 	exit(EXIT_SUCCESS);
-     }
-@@ -959,13 +1007,14 @@ main(int argc, char *argv[])
-     act.sa_handler = set_term;
-     sigaction(SIGINT, &act, NULL);
- 
-+    timer_setup();
-     daemon_setup();
- 
-     do {
--	now = time(NULL);
-+	now = atd_gettime();
- 	next_invocation = run_loop();
- 	if (next_invocation > now) {
--	    sleep(next_invocation - now);
-+	    atd_setalarm(next_invocation);
- 	}
-     } while (!term_signal);
-     daemon_cleanup();
-diff -up at-3.1.14/config.h.in.timers at-3.1.14/config.h.in
---- at-3.1.14/config.h.in.timers	2013-12-02 11:00:27.000000000 +0100
-+++ at-3.1.14/config.h.in	2013-12-02 11:02:06.521033976 +0100
-@@ -38,6 +38,9 @@
- /* Define to 1 if you have the `getloadavg' function. */
- #undef HAVE_GETLOADAVG
- 
-+/* Define to 1 if you have the `timer_create' function. */
-+#undef HAVE_TIMER_CREATE
-+
- /* Define to 1 if you have the <getopt.h> header file. */
- #undef HAVE_GETOPT_H
- 
-diff -up at-3.1.14/configure.ac.timers at-3.1.14/configure.ac
---- at-3.1.14/configure.ac.timers	2013-12-02 11:00:27.000000000 +0100
-+++ at-3.1.14/configure.ac	2013-12-02 11:02:45.217066560 +0100
-@@ -254,6 +254,10 @@ AC_CHECK_LIB(selinux, is_selinux_enabled
- AC_SUBST(SELINUXLIB)
- AC_SUBST(WITH_SELINUX)
- 
-+dnl check for POSIX timer functions
-+AC_SEARCH_LIBS([timer_create],[rt])
-+AC_CHECK_FUNCS([timer_create])
-+
- AC_MSG_CHECKING(groupname to run under)
- AC_ARG_WITH(daemon_groupname,
- [ --with-daemon_groupname=DAEMON_GROUPNAME	Groupname to run under (default daemon) ],
diff --git a/at-3.1.18-make.patch b/at-3.1.18-make.patch
deleted file mode 100644
index 171b63c..0000000
--- a/at-3.1.18-make.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-diff -up at-3.1.18/Makefile.in.make at-3.1.18/Makefile.in
---- at-3.1.18/Makefile.in.make	2015-12-06 16:45:10.000000000 +0100
-+++ at-3.1.18/Makefile.in	2016-03-23 12:38:15.652898579 +0100
-@@ -68,13 +68,13 @@ LIST = Filelist Filelist.asc
- all: at atd atd.service atrun
- 
- at: $(ATOBJECTS)
--	$(CC) $(LDFLAGS) -o at $(ATOBJECTS) $(LIBS) $(LEXLIB)
-+	$(CC) $(LDFLAGS) -pie -o at $(ATOBJECTS) $(LIBS) $(LEXLIB)
- 	rm -f $(CLONES)
- 	$(LN_S) -f at atq
- 	$(LN_S) -f at atrm
- 
- atd: $(RUNOBJECTS)
--	$(CC) $(LDFLAGS) -o atd $(RUNOBJECTS) $(LIBS) $(PAMLIB) $(SELINUXLIB)
-+	$(CC) $(LDFLAGS) -pie -o atd $(RUNOBJECTS) $(LIBS) $(PAMLIB) $(SELINUXLIB)
- 
- y.tab.c y.tab.h: parsetime.y
- 	$(YACC) -d parsetime.y
-@@ -89,38 +89,41 @@ atrun: atrun.in
- 	configure
- 
- .c.o:
--	$(CC) -c $(CFLAGS) $(DEFS) $*.c
-+	$(CC) -c $(CFLAGS) -fPIE $(DEFS) $*.c
- 
- install: all
--	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(etcdir)
--	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(bindir)
--	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(sbindir)
--	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(docdir)
--	$(INSTALL) -g root -o root -m 755 -d $(IROOT)$(atdocdir)
--	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 755 -d $(IROOT)$(ATSPOOL_DIR) $(IROOT)$(ATJOB_DIR)
--	chmod 1770 $(IROOT)$(ATSPOOL_DIR) $(IROOT)$(ATJOB_DIR)
-+	$(INSTALL) -m 755 -d $(IROOT)$(etcdir)
-+	$(INSTALL) -m 755 -d $(IROOT)$(bindir)
-+	$(INSTALL) -m 755 -d $(IROOT)$(sbindir)
-+	$(INSTALL) -m 755 -d $(IROOT)$(docdir)
-+	$(INSTALL) -m 755 -d $(IROOT)$(atdocdir)
-+	$(INSTALL) -m 755 -d $(IROOT)$(etcdir)/pam.d/
-+	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 755 -d $(IROOT)$(ATSPOOL_DIR)
-+	chmod 700 $(IROOT)$(ATJOB_DIR) $(IROOT)$(ATSPOOL_DIR)
-+	chown $(DAEMON_USERNAME):$(DAEMON_GROUPNAME) $(IROOT)$(ATJOB_DIR) $(IROOT)$(ATSPOOL_DIR)
- 	touch $(IROOT)$(LFILE)
- 	chmod 600 $(IROOT)$(LFILE)
- 	chown $(DAEMON_USERNAME):$(DAEMON_GROUPNAME) $(IROOT)$(LFILE)
--	test -f $(IROOT)$(etcdir)/at.allow || test -f $(IROOT)$(etcdir)/at.deny || $(INSTALL) -o root -g $(DAEMON_GROUPNAME) -m 640 at.deny $(IROOT)$(etcdir)/
--	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 6755 at $(IROOT)$(bindir)
-+	test -f $(IROOT)$(etcdir)/at.allow || test -f $(IROOT)$(etcdir)/at.deny || $(INSTALL) -m 600 at.deny $(IROOT)$(etcdir)/
-+	$(INSTALL) -o $(INSTALL_ROOT_USER) -g $(DAEMON_GROUPNAME) pam_atd $(IROOT)$(etcdir)/pam.d/atd
-+	$(INSTALL) -m 4755 at $(IROOT)$(bindir)
- 	$(LN_S) -f at $(IROOT)$(bindir)/atq
- 	$(LN_S) -f at $(IROOT)$(bindir)/atrm
--	$(INSTALL) -g root -o root -m 755 batch $(IROOT)$(bindir)
--	$(INSTALL) -d -o root -g root -m 755 $(IROOT)$(man1dir)
--	$(INSTALL) -d -o root -g root -m 755 $(IROOT)$(man5dir)
--	$(INSTALL) -d -o root -g root -m 755 $(IROOT)$(man8dir)
--	$(INSTALL) -g root -o root -m 755 atd $(IROOT)$(sbindir)
--	$(INSTALL) -g root -o root -m 755 atrun $(IROOT)$(sbindir)
--	$(INSTALL) -g root -o root -m 644 at.1 $(IROOT)$(man1dir)/
-+	$(INSTALL) -m 755 batch $(IROOT)$(bindir)
-+	$(INSTALL) -d -m 755 $(IROOT)$(man1dir)
-+	$(INSTALL) -d -m 755 $(IROOT)$(man5dir)
-+	$(INSTALL) -d -m 755 $(IROOT)$(man8dir)
-+	$(INSTALL) -m 755 atd $(IROOT)$(sbindir)
-+	$(INSTALL) -m 755 atrun $(IROOT)$(sbindir)
-+	$(INSTALL) -m 644 at.1 $(IROOT)$(man1dir)/
- 	cd $(IROOT)$(man1dir) && $(LN_S) -f at.1 atq.1 && $(LN_S) -f at.1 batch.1 && $(LN_S) -f at.1 atrm.1
--	$(INSTALL) -g root -o root -m 644 atd.8 $(IROOT)$(man8dir)/
-+	$(INSTALL) -m 644 atd.8 $(IROOT)$(man8dir)/
- 	sed "s,\$${exec_prefix},$(exec_prefix),g" <atrun.8>tmpman
--	$(INSTALL) -g root -o root -m 644 tmpman $(IROOT)$(man8dir)/atrun.8
-+	$(INSTALL) -m 644 tmpman $(IROOT)$(man8dir)/atrun.8
- 	rm -f tmpman
--	$(INSTALL) -g root -o root -m 644 at.allow.5 $(IROOT)$(man5dir)/
-+	$(INSTALL) -m 644 at.allow.5 $(IROOT)$(man5dir)/
- 	cd $(IROOT)$(man5dir) && $(LN_S) -f at.allow.5 at.deny.5
--	$(INSTALL) -g root -o root -m 644 $(DOCS) $(IROOT)$(atdocdir)
-+	$(INSTALL) -m 644 $(DOCS) $(IROOT)$(atdocdir)
- 	rm -f $(IROOT)$(mandir)/cat1/at.1* $(IROOT)$(mandir)/cat1/batch.1* \
- 		$(IROOT)$(mandir)/cat1/atq.1*
- 	rm -f $(IROOT)$(mandir)/cat1/atd.8*
diff --git a/at-3.1.18-utc-dst.patch b/at-3.1.18-utc-dst.patch
deleted file mode 100644
index 3a2a40b..0000000
--- a/at-3.1.18-utc-dst.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff -up at-3.1.18/parsetime.y.dst at-3.1.18/parsetime.y
---- at-3.1.18/parsetime.y.dst	2015-12-06 16:45:10.000000000 +0100
-+++ at-3.1.18/parsetime.y	2015-07-01 13:53:14.088881926 +0200
-@@ -476,8 +476,8 @@ parsetime(time_t currtime, int argc, cha
-     exectm = *localtime(&currtime);
-     currtime -= exectm.tm_sec;
-     exectm.tm_sec = 0;
--    exectm.tm_isdst = -1;
-     memcpy(&currtm,&exectm,sizeof(currtm));
-+    exectm.tm_isdst = -1;
-     time_only = 0;
-     yearspec = 0;
- 
-@@ -503,8 +503,8 @@ parsetime(time_t currtime, int argc, cha
- 	    return 0;
- 	if (isgmt) {
- 	    exectime -= timezone;
--	    if (currtm.tm_isdst && !exectm.tm_isdst)
--		exectime -= 3600;
-+	    if (exectm.tm_isdst)
-+		exectime += 3600;
- 	}
- 	if (exectime < currtime)
- 		panic("refusing to create job destined in the past");
diff --git a/at-3.1.23-document-n.patch b/at-3.1.23-document-n.patch
index 7028300..39e77e4 100644
--- a/at-3.1.23-document-n.patch
+++ b/at-3.1.23-document-n.patch
@@ -9,10 +9,11 @@ diff -up at-3.1.23/atd.8.in.document-n at-3.1.23/atd.8.in
  .RB [ \-s ]
  .SH DESCRIPTION
  .B atd
-@@ -44,6 +45,10 @@ in the foreground.
+@@ -44,6 +45,11 @@ in the foreground.
  Process the at/batch queue only once.
  This is primarily of use for compatibility with old versions of
  .BR at ;
++.TP
 +.B \-n
 +Append the hostname of the system to the subject of the e-mails sent by
 +.BR atd .
diff --git a/at-3.1.20-lock-locks.patch b/at-3.2.2-lock-locks.patch
similarity index 75%
rename from at-3.1.20-lock-locks.patch
rename to at-3.2.2-lock-locks.patch
index 17d6ad4..5b97d34 100644
--- a/at-3.1.20-lock-locks.patch
+++ b/at-3.2.2-lock-locks.patch
@@ -1,6 +1,6 @@
-diff -up at-3.1.20/atd.c.lock-locks at-3.1.20/atd.c
---- at-3.1.20/atd.c.lock-locks	2016-07-01 10:41:50.640867692 +0200
-+++ at-3.1.20/atd.c	2016-07-01 10:42:32.345844967 +0200
+diff -ur b/atd.c a/atd.c
+--- b/atd.c	2021-04-25 03:31:30.000000000 +0200
++++ a/atd.c	2021-05-21 13:00:45.135020670 +0200
 @@ -74,6 +74,9 @@
  #include <syslog.h>
  #endif
@@ -11,7 +11,7 @@ diff -up at-3.1.20/atd.c.lock-locks at-3.1.20/atd.c
  /* Local headers */
  
  #include "privs.h"
-@@ -288,7 +291,7 @@ run_file(const char *filename, uid_t uid
+@@ -275,7 +278,7 @@
   * mail to the user.
   */
      pid_t pid;
@@ -19,8 +19,8 @@ diff -up at-3.1.20/atd.c.lock-locks at-3.1.20/atd.c
 +    int fd_out, fd_in, fd_std;
      char jobbuf[9];
      char *mailname = NULL;
-     int mailsize = 128;
-@@ -410,6 +413,10 @@ run_file(const char *filename, uid_t uid
+     size_t mailsize = 128;
+@@ -390,6 +393,10 @@
  
      fcntl(fd_in, F_SETFD, fflags & ~FD_CLOEXEC);
  
@@ -31,7 +31,7 @@ diff -up at-3.1.20/atd.c.lock-locks at-3.1.20/atd.c
      /*
       * If the spool directory is mounted via NFS `atd' isn't able to
       * read from the job file and will bump out here.  The file is
-@@ -553,10 +560,7 @@ run_file(const char *filename, uid_t uid
+@@ -520,10 +527,7 @@
  	PRIV_END
      }
      /* We're the parent.  Let's wait.
@@ -43,7 +43,7 @@ diff -up at-3.1.20/atd.c.lock-locks at-3.1.20/atd.c
         non-blocking waitpid. So this blocking one will eventually
         return with an ECHILD error. 
       */
-@@ -573,14 +577,14 @@ run_file(const char *filename, uid_t uid
+@@ -548,14 +552,14 @@
      /* some sendmail implementations are confused if stdout, stderr are
       * not available, so let them point to /dev/null
       */
@@ -63,7 +63,7 @@ diff -up at-3.1.20/atd.c.lock-locks at-3.1.20/atd.c
  
      if (unlink(filename) == -1)
          syslog(LOG_WARNING, "Warning: removing output file for job %li failed: %s",
-@@ -588,7 +592,12 @@ run_file(const char *filename, uid_t uid
+@@ -563,7 +567,12 @@
  
      /* The job is now finished.  We can delete its input file.
       */
@@ -77,31 +77,31 @@ diff -up at-3.1.20/atd.c.lock-locks at-3.1.20/atd.c
      unlink(newname);
      free(newname);
  
-@@ -723,16 +732,18 @@ run_loop()
+@@ -673,16 +682,18 @@
  
  	/* Skip lock files */
  	if (queue == '=') {
 -            /* FIXME: calhariz */
--            /* I think the following code is broken, but commenting
--               may haven unknow side effects.  Make a release and see
+-            /* I think the following code is broken, but commenting it
+-               may cause unknow side effects.  Make a release and see
 -               in the wild how it works. For more information see:
--               https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=818508/*
+-               https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=818508 */
 -
 -	    /* if ((buf.st_nlink == 1) && (run_time + CHECK_INTERVAL <= now)) { */
 -	    /*     /\* Remove stale lockfile FIXME: lock the lockfile, if you fail, it's still in use. *\/ */
 -	    /*     unlink(dirent->d_name); */
 -	    /* } */
-+	    if ((buf.st_nlink == 1) && (run_time + CHECK_INTERVAL <= now)) {
-+		int fd;
++	    if ((buf.st_nlink == 1) && (run_time + CHECK_INTERVAL <= now)) { 
++		    int fd;
 +
-+		fd = open(dirent->d_name, O_RDONLY);
-+		if (fd != -1) {
-+			if (flock(fd, LOCK_EX | LOCK_NB) == 0) {
-+				unlink(dirent->d_name);
-+				syslog(LOG_NOTICE, "removing stale lock file %s\n", dirent->d_name);
-+			}
-+			(void)close(fd);
-+		}
++            fd = open(dirent->d_name, O_RDONLY);
++            if (fd != -1) {
++                if (flock(fd, LOCK_EX | LOCK_NB) == 0) {
++                    unlink(dirent->d_name);
++                    syslog(LOG_NOTICE, "removing stale lock file %s\n", dirent->d_name);
++                }
++                (void)close(fd);
++            }
 +	    }
  	    continue;
  	}
diff --git a/at-3.1.20-shell.patch b/at-3.2.2-shell.patch
similarity index 67%
rename from at-3.1.20-shell.patch
rename to at-3.2.2-shell.patch
index ac9586c..9e383b8 100644
--- a/at-3.1.20-shell.patch
+++ b/at-3.2.2-shell.patch
@@ -1,19 +1,19 @@
-diff -up at-3.1.20/at.c.shell at-3.1.20/at.c
---- at-3.1.20/at.c.shell	2016-07-01 09:47:13.392684445 +0200
-+++ at-3.1.20/at.c	2016-07-01 09:48:47.679931959 +0200
+diff -ur b/at.c a/at.c
+--- b/at.c	2021-04-25 03:31:30.000000000 +0200
++++ a/at.c	2021-05-21 12:51:48.123335137 +0200
 @@ -62,11 +62,8 @@
  #include <stdlib.h>
  #include <string.h>
- 
+
 -#ifdef TM_IN_SYS_TIME
  #include <sys/time.h>
 -#else
  #include <time.h>
 -#endif
- 
+
  #ifdef HAVE_UNISTD_H
  #include <unistd.h>
-@@ -239,6 +236,12 @@ writefile(time_t runtimer, char queue)
+@@ -245,6 +242,12 @@
      int kill_errno;
      int rc;
      int mailsize = 128;
@@ -23,25 +23,26 @@ diff -up at-3.1.20/at.c.shell at-3.1.20/at.c
 +
 +    gettimeofday(&tv, &tz);
 +    srandom(getpid()+tv.tv_usec);
- 
+
  /* Install the signal handler for SIGINT; terminate after removing the
   * spool file if necessary
-@@ -465,6 +468,9 @@ writefile(time_t runtimer, char queue)
+@@ -492,6 +495,9 @@
      fprintf(fp, " || {\n\t echo 'Execution directory "
  	    "inaccessible' >&2\n\t exit 1\n}\n");
- 
+
 +    i = random();
 +    fprintf(fp, "${SHELL:-/bin/sh} << \'marcinDELIMITER%08lx\'\n", i);
 +
      istty = isatty(fileno(stdin));
      if (istty) {
- 	fprintf(stderr, "at> ");
-@@ -480,7 +486,7 @@ writefile(time_t runtimer, char queue)
+ 	runtime = localtime(&runtimer);
+@@ -512,7 +518,7 @@
      if (istty) {
  	fprintf(stderr, "<EOT>\n");
      }
 -    fprintf(fp, "\n");
-+    fprintf(fp, "marcinDELIMITER%08lx\n", i);
++    fprintf(fp, "\nmarcinDELIMITER%08lx\n", i);
      if (ferror(fp))
  	panic("Output error");
      fflush(fp);
+Only in a: .vscode
diff --git a/at-3.1.20-aborted-jobs.patch b/at-3.2.5-aborted-jobs.patch
similarity index 71%
rename from at-3.1.20-aborted-jobs.patch
rename to at-3.2.5-aborted-jobs.patch
index 78a196f..568ef4b 100644
--- a/at-3.1.20-aborted-jobs.patch
+++ b/at-3.2.5-aborted-jobs.patch
@@ -1,14 +1,14 @@
-diff -up at-3.1.20/atd.c.aborted at-3.1.20/atd.c
---- at-3.1.20/atd.c.aborted	2017-09-14 15:31:47.971486148 +0200
-+++ at-3.1.20/atd.c	2017-09-14 15:43:53.506567281 +0200
-@@ -731,12 +731,17 @@ run_loop()
+diff -ur b/atd.c a/atd.c
+--- b/atd.c	2022-02-22 15:55:28.745663105 +0100
++++ a/atd.c	2022-02-22 16:07:26.416578085 +0100
+@@ -722,12 +722,18 @@
  	/* Is the file already locked?
  	 */
  	if (buf.st_nlink > 1) {
 +	    if (run_time < buf.st_mtime)
 +		run_time = buf.st_mtime;
  	    if (run_time + CHECK_INTERVAL <= now) {
--
+ 
  		/* Something went wrong the last time this was executed.
  		 * Let's remove the lockfile and reschedule.
 +		 * We also change the timestamp to avoid rerunning the job more
@@ -17,6 +17,6 @@ diff -up at-3.1.20/atd.c.aborted at-3.1.20/atd.c
  		strncpy(lock_name, dirent->d_name, sizeof(lock_name));
 +		if (utime(lock_name, 0) < 0)
 +			syslog(LOG_ERR, "utime couldn't be set for lock file %s\n", lock_name);
- 		lock_name[sizeof(lock_name)-1] = '\0';
+         lock_name[sizeof(lock_name)-1] = '\0';
  		lock_name[0] = '=';
  		unlink(lock_name);
diff --git a/at-3.2.5-address-sast.patch b/at-3.2.5-address-sast.patch
new file mode 100644
index 0000000..ecf981c
--- /dev/null
+++ b/at-3.2.5-address-sast.patch
@@ -0,0 +1,57 @@
+From 43e8b5b5dd72bb9a80679dec8c15a24f00888a53 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Stan=C4=9Bk?= <jstanek@redhat.com>
+Date: Wed, 26 Jun 2024 16:59:31 +0200
+Subject: [PATCH] Address issues from static analyzer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+- Tweak types in run_file() to prevent overflow
+- Initialize all members of of struct tm in posix_time_parse().
+
+The static analyzer findings: https://issues.redhat.com/browse/RHEL-44999
+
+Signed-off-by: Jan Staněk <jstanek@redhat.com>
+---
+ atd.c     | 4 ++--
+ posixtm.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/atd.c b/atd.c
+index 64fdd83..3908de3 100644
+--- a/atd.c
++++ b/atd.c
+@@ -279,7 +279,7 @@ run_file(const char *filename, uid_t uid, gid_t gid)
+     int fd_out, fd_in;
+     char jobbuf[9];
+     char *mailname = NULL;
+-    int mailsize = 128;
++    size_t mailsize = 128;
+     char *newname;
+     FILE *stream;
+     int send_mail = 0;
+@@ -292,7 +292,7 @@ run_file(const char *filename, uid_t uid, gid_t gid)
+     char queue;
+     char fmt[64];
+     unsigned long jobno;
+-    int rc;
++    long rc;
+ #ifdef HAVE_PAM
+     int retcode;
+ #endif
+diff --git a/posixtm.c b/posixtm.c
+index cf4ec09..06b22fa 100644
+--- a/posixtm.c
++++ b/posixtm.c
+@@ -188,7 +188,7 @@ posix_time_parse (struct tm *tm, const char *s, unsigned int syntax_bits)
+ bool
+ posixtime (time_t *p, const char *s, unsigned int syntax_bits)
+ {
+-  struct tm tm0;
++  struct tm tm0 = {0};
+   struct tm tm1;
+   struct tm const *tm;
+   time_t t;
+-- 
+GitLab
+
diff --git a/at-3.1.14-mailwithhostname.patch b/at-3.2.5-mailwithhostname.patch
similarity index 67%
rename from at-3.1.14-mailwithhostname.patch
rename to at-3.2.5-mailwithhostname.patch
index a2b3f79..a601db4 100644
--- a/at-3.1.14-mailwithhostname.patch
+++ b/at-3.2.5-mailwithhostname.patch
@@ -1,7 +1,7 @@
-diff -up at-3.1.14/atd.c.mail at-3.1.14/atd.c
---- at-3.1.14/atd.c.mail	2013-12-04 11:39:44.556239282 +0100
-+++ at-3.1.14/atd.c	2013-12-04 11:40:50.544234246 +0100
-@@ -100,6 +100,10 @@ int selinux_enabled=0;
+diff -ur b/atd.c a/atd.c
+--- b/atd.c	2022-02-22 15:21:06.649147600 +0100
++++ a/atd.c	2022-02-22 15:49:13.640184845 +0100
+@@ -98,6 +98,10 @@
  #define BATCH_INTERVAL_DEFAULT 60
  #define CHECK_INTERVAL 3600
  
@@ -12,35 +12,35 @@ diff -up at-3.1.14/atd.c.mail at-3.1.14/atd.c
  /* Global variables */
  
  uid_t real_uid, effective_uid;
-@@ -117,6 +121,7 @@ static time_t last_chg;
- static int nothing_to_do;
+@@ -115,6 +119,7 @@
+ static int nothing_to_do = 0;
  unsigned int batch_interval;
  static int run_as_daemon = 0;
 +static int mail_with_hostname = 0;
+ static int hupped = 0;
  
  static volatile sig_atomic_t term_signal = 0;
- 
-@@ -298,6 +303,7 @@ run_file(const char *filename, uid_t uid
+@@ -301,6 +306,7 @@
      char fmt[64];
      unsigned long jobno;
-     int rc;
+     long rc;
 +    char hostbuf[MAXHOSTNAMELEN];
  #ifdef WITH_PAM
      int retcode;
  #endif
-@@ -452,6 +458,11 @@ run_file(const char *filename, uid_t uid
+@@ -455,6 +461,11 @@
  
      write_string(fd_out, "Subject: Output from your job ");
      write_string(fd_out, jobbuf);
 +    if (mail_with_hostname > 0) {
-+               gethostname(hostbuf, MAXHOSTNAMELEN-1);
++        gethostname(hostbuf, MAXHOSTNAMELEN-1);
 +        write_string(fd_out, " ");
 +        write_string(fd_out, hostbuf);
 +    }
      write_string(fd_out, "\nTo: ");
      write_string(fd_out, mailname);    
      write_string(fd_out, "\n\n");
-@@ -843,7 +854,7 @@ main(int argc, char *argv[])
+@@ -905,7 +916,7 @@
      run_as_daemon = 1;
      batch_interval = BATCH_INTERVAL_DEFAULT;
  
@@ -49,7 +49,7 @@ diff -up at-3.1.14/atd.c.mail at-3.1.14/atd.c
  	switch (c) {
  	case 'l':
  	    if (sscanf(optarg, "%lf", &load_avg) != 1)
-@@ -865,6 +876,10 @@ main(int argc, char *argv[])
+@@ -927,6 +938,10 @@
  	    daemon_foreground++;
  	    break;
  
diff --git a/at-3.2.5-make.patch b/at-3.2.5-make.patch
new file mode 100644
index 0000000..e8ebcc2
--- /dev/null
+++ b/at-3.2.5-make.patch
@@ -0,0 +1,86 @@
+diff -ur b/Makefile.in a/Makefile.in
+--- b/Makefile.in	2022-02-05 11:00:57.000000000 +0100
++++ a/Makefile.in	2022-03-08 16:05:28.088069816 +0100
+@@ -76,13 +76,13 @@
+ all: at atd atd.service atrun
+ 
+ at: $(ATOBJECTS)
+-	$(CC) $(LDFLAGS) -o at $(ATOBJECTS) $(LIBS) $(LEXLIB)
++	$(CC) $(LDFLAGS) -pie -o at $(ATOBJECTS) $(LIBS) $(LEXLIB)
+ 	rm -f $(CLONES)
+ 	$(LN_S) -f at atq
+ 	$(LN_S) -f at atrm
+ 
+ atd: $(RUNOBJECTS)
+-	$(CC) $(LDFLAGS) -o atd $(RUNOBJECTS) $(LIBS) $(PAMLIB) $(SELINUXLIB)
++	$(CC) $(LDFLAGS) -pie -o atd $(RUNOBJECTS) $(LIBS) $(PAMLIB) $(SELINUXLIB)
+ 
+ y.tab.c y.tab.h: parsetime.y
+ 	$(YACC) -d parsetime.y
+@@ -99,40 +99,43 @@
+ 	configure
+ 
+ .c.o:
+-	$(CC) -c $(CFLAGS) $(DEFS) $*.c
++	$(CC) -c $(CFLAGS) -fPIE $(DEFS) $*.c
+ 
+ install: all
+-	$(INSTALL) -g root -o root -m 755 -d $(DESTDIR)$(etcdir)
+-	$(INSTALL) -g root -o root -m 755 -d $(DESTDIR)$(bindir)
+-	$(INSTALL) -g root -o root -m 755 -d $(DESTDIR)$(sbindir)
+-	$(INSTALL) -g root -o root -m 755 -d $(DESTDIR)$(atdatadir)
+-	$(INSTALL) -g root -o root -m 755 -d $(DESTDIR)$(docdir)
+-	$(INSTALL) -g root -o root -m 755 -d $(DESTDIR)$(atdocdir)
+-	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 755 -d $(DESTDIR)$(ATSPOOL_DIR) $(DESTDIR)$(ATJOB_DIR)
+-	chmod 1770 $(DESTDIR)$(ATSPOOL_DIR) $(DESTDIR)$(ATJOB_DIR)
++	$(INSTALL) -m 755 -d $(DESTDIR)$(etcdir)
++	$(INSTALL) -m 755 -d $(DESTDIR)$(bindir)
++	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
++	$(INSTALL) -m 755 -d $(DESTDIR)$(atdatadir)
++	$(INSTALL) -m 755 -d $(DESTDIR)$(docdir)
++	$(INSTALL) -m 755 -d $(DESTDIR)$(atdocdir)
++	$(INSTALL) -m 755 -d $(DESTDIR)$(etcdir)/pam.d/
++	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 755 -d $(DESTDIR)$(ATSPOOL_DIR)
++	chmod 700 $(DESTDIR)$(ATJOB_DIR) $(DESTDIR)$(ATSPOOL_DIR)
++	chown $(DAEMON_USERNAME):$(DAEMON_GROUPNAME) $(DESTDIR)$(ATJOB_DIR) $(DESTDIR)$(ATSPOOL_DIR)
+ 	touch $(DESTDIR)$(LFILE)
+ 	chmod 600 $(DESTDIR)$(LFILE)
+ 	chown $(DAEMON_USERNAME):$(DAEMON_GROUPNAME) $(DESTDIR)$(LFILE)
+-	test -f $(DESTDIR)$(etcdir)/at.allow || test -f $(DESTDIR)$(etcdir)/at.deny || $(INSTALL) -o root -g $(DAEMON_GROUPNAME) -m 640 at.deny $(DESTDIR)$(etcdir)/
+-	$(INSTALL) -g $(DAEMON_GROUPNAME) -o $(DAEMON_USERNAME) -m 6755 at $(DESTDIR)$(bindir)
++	test -f $(DESTDIR)$(etcdir)/at.allow || test -f $(DESTDIR)$(etcdir)/at.deny || $(INSTALL) -m 600 at.deny $(DESTDIR)$(etcdir)/
++	$(INSTALL) -o $(INSTALL_ROOT_USER) -g $(DAEMON_GROUPNAME) pam_atd $(DESTDIR)$(etcdir)/pam.d/atd
++	$(INSTALL) -m 4755 at $(DESTDIR)$(bindir)
+ 	$(LN_S) -f at $(DESTDIR)$(bindir)/atq
+ 	$(LN_S) -f at $(DESTDIR)$(bindir)/atrm
+-	$(INSTALL) -g root -o root -m 755 batch $(DESTDIR)$(bindir)
+-	$(INSTALL) -g root -o root -m 755 batch-job $(DESTDIR)$(atdatadir)
+-	$(INSTALL) -d -o root -g root -m 755 $(DESTDIR)$(man1dir)
+-	$(INSTALL) -d -o root -g root -m 755 $(DESTDIR)$(man5dir)
+-	$(INSTALL) -d -o root -g root -m 755 $(DESTDIR)$(man8dir)
+-	$(INSTALL) -g root -o root -m 755 atd $(DESTDIR)$(sbindir)
+-	$(INSTALL) -g root -o root -m 755 atrun $(DESTDIR)$(sbindir)
+-	$(INSTALL) -g root -o root -m 644 at.1 $(DESTDIR)$(man1dir)/
++	$(INSTALL) -m 755 batch $(DESTDIR)$(bindir)
++	$(INSTALL) -m 755 batch-job $(DESTDIR)$(atdatadir)
++	$(INSTALL) -d -m 755 $(DESTDIR)$(man1dir)
++	$(INSTALL) -d -m 755 $(DESTDIR)$(man5dir)
++	$(INSTALL) -d -m 755 $(DESTDIR)$(man8dir)
++	$(INSTALL) -m 755 atd $(DESTDIR)$(sbindir)
++	$(INSTALL) -m 755 atrun $(DESTDIR)$(sbindir)
++	$(INSTALL) -m 644 at.1 $(DESTDIR)$(man1dir)/
+ 	cd $(DESTDIR)$(man1dir) && $(LN_S) -f at.1 atq.1 && $(LN_S) -f at.1 batch.1 && $(LN_S) -f at.1 atrm.1
+-	$(INSTALL) -g root -o root -m 644 atd.8 $(DESTDIR)$(man8dir)/
++	$(INSTALL) -m 644 atd.8 $(DESTDIR)$(man8dir)/
+ 	sed "s,\$${exec_prefix},$(exec_prefix),g" <atrun.8>tmpman
+-	$(INSTALL) -g root -o root -m 644 tmpman $(DESTDIR)$(man8dir)/atrun.8
++	$(INSTALL) -m 644 tmpman $(DESTDIR)$(man8dir)/atrun.8
+ 	rm -f tmpman
+-	$(INSTALL) -g root -o root -m 644 at.allow.5 $(DESTDIR)$(man5dir)/
++	$(INSTALL) -m 644 at.allow.5 $(DESTDIR)$(man5dir)/
+ 	cd $(DESTDIR)$(man5dir) && $(LN_S) -f at.allow.5 at.deny.5
+-	$(INSTALL) -g root -o root -m 644 $(DOCS) $(DESTDIR)$(atdocdir)
++	$(INSTALL) -m 644 $(DOCS) $(DESTDIR)$(atdocdir)
+ 	rm -f $(DESTDIR)$(mandir)/cat1/at.1* $(DESTDIR)$(mandir)/cat1/batch.1* \
+ 		$(DESTDIR)$(mandir)/cat1/atq.1*
+ 	rm -f $(DESTDIR)$(mandir)/cat1/atd.8*
diff --git a/at-3.1.18-nitpicks.patch b/at-3.2.5-nitpicks.patch
similarity index 68%
rename from at-3.1.18-nitpicks.patch
rename to at-3.2.5-nitpicks.patch
index 2bcaebb..3765552 100644
--- a/at-3.1.18-nitpicks.patch
+++ b/at-3.2.5-nitpicks.patch
@@ -1,7 +1,19 @@
-diff -up at-3.1.18/atd.c.nit at-3.1.18/atd.c
---- at-3.1.18/atd.c.nit	2016-03-23 12:46:49.222277787 +0100
-+++ at-3.1.18/atd.c	2016-03-23 12:47:50.521639804 +0100
-@@ -196,6 +196,18 @@ myfork()
+diff -ur b/at.1.in a/at.1.in
+--- b/at.1.in	2022-01-29 17:42:19.000000000 +0100
++++ a/at.1.in	2022-02-22 15:19:47.598996428 +0100
+@@ -226,7 +226,7 @@
+ .BR batch .
+ Queues with higher letters run with increased niceness.  The special
+ queue "=" is reserved for jobs which are currently running.
+-.P
++
+ If a job is submitted to a queue designated with an uppercase letter, the
+ job is treated as if it were submitted to batch at the time of the job.
+ Once the time is reached, the batch processing rules with respect to load
+diff -ur b/atd.c a/atd.c
+--- b/atd.c	2022-02-22 15:14:02.736336912 +0100
++++ a/atd.c	2022-02-22 15:19:02.163909540 +0100
+@@ -197,6 +197,18 @@
  
  #define fork myfork
  #endif
@@ -20,7 +32,7 @@ diff -up at-3.1.18/atd.c.nit at-3.1.18/atd.c
  
  #ifdef WITH_SELINUX
  static int
-@@ -339,6 +351,9 @@ run_file(const char *filename, uid_t uid
+@@ -340,6 +352,9 @@
  	free(newname);
  	return;
      }
@@ -30,51 +42,39 @@ diff -up at-3.1.18/atd.c.nit at-3.1.18/atd.c
      /* Let's see who we mail to.  Hopefully, we can read it from
       * the command file; if not, send it to the owner, or, failing that,
       * to root.
-@@ -507,6 +522,9 @@ run_file(const char *filename, uid_t uid
+@@ -508,6 +523,9 @@
  	    if (setuid(uid) < 0)
  		perr("Cannot set user id");
  
-+	    if (SIG_ERR == signal(SIGCHLD, SIG_DFL))
++        if (SIG_ERR == signal(SIGCHLD, SIG_DFL))
 +		perr("Cannot reset signal handler to default");
 +
  	    chdir("/");
  
  	    execle("/bin/sh", "sh", (char *) NULL, nenvp);
-@@ -572,6 +590,9 @@ run_file(const char *filename, uid_t uid
+@@ -573,6 +591,9 @@
  	    if (setuid(uid) < 0)
  		perr("Cannot set user id");
  
-+	    if (SIG_ERR == signal(SIGCHLD, SIG_DFL))
++        if (SIG_ERR == signal(SIGCHLD, SIG_DFL))
 +		perr("Cannot reset signal handler to default");
 +
  	    chdir ("/");
  
  #if defined(SENDMAIL)
-@@ -699,6 +720,7 @@ run_loop()
+@@ -707,6 +728,7 @@
  		 * Let's remove the lockfile and reschedule.
  		 */
  		strncpy(lock_name, dirent->d_name, sizeof(lock_name));
-+		lock_name[sizeof(lock_name)-1] = '\0';
++        lock_name[sizeof(lock_name)-1] = '\0';
  		lock_name[0] = '=';
  		unlink(lock_name);
  		next_job = now;
-@@ -733,6 +755,7 @@ run_loop()
+@@ -741,6 +763,7 @@
  	    run_batch++;
  	    if (strcmp(batch_name, dirent->d_name) > 0) {
  		strncpy(batch_name, dirent->d_name, sizeof(batch_name));
-+		batch_name[sizeof(batch_name)-1] = '\0';
++        batch_name[sizeof(batch_name)-1] = '\0';
  		batch_uid = buf.st_uid;
  		batch_gid = buf.st_gid;
  		batch_queue = queue;
-diff -up at-3.1.18/at.1.in.nit at-3.1.18/at.1.in
---- at-3.1.18/at.1.in.nit	2015-12-06 16:45:10.000000000 +0100
-+++ at-3.1.18/at.1.in	2016-03-23 12:46:49.226277876 +0100
-@@ -210,7 +210,7 @@ queue for
- .BR batch .
- Queues with higher letters run with increased niceness.  The special
- queue "=" is reserved for jobs which are currently running.
--.P
-+
- If a job is submitted to a queue designated with an uppercase letter, the
- job is treated as if it were submitted to batch at the time of the job.
- Once the time is reached, the batch processing rules with respect to load
diff --git a/at-3.1.18-noabort.patch b/at-3.2.5-noabort.patch
similarity index 69%
rename from at-3.1.18-noabort.patch
rename to at-3.2.5-noabort.patch
index 1154fb9..2d72301 100644
--- a/at-3.1.18-noabort.patch
+++ b/at-3.2.5-noabort.patch
@@ -1,7 +1,7 @@
-diff -up at-3.1.18/atd.c.noabort at-3.1.18/atd.c
---- at-3.1.18/atd.c.noabort	2016-03-23 12:49:15.147520116 +0100
-+++ at-3.1.18/atd.c	2016-03-23 12:49:15.148520138 +0100
-@@ -349,9 +349,12 @@ run_file(const char *filename, uid_t uid
+diff -ur b/atd.c a/atd.c
+--- b/atd.c	2022-02-22 16:09:15.683717386 +0100
++++ a/atd.c	2022-02-22 16:12:48.992989327 +0100
+@@ -344,9 +344,12 @@
       */
  
      pid = fork();
@@ -17,7 +17,7 @@ diff -up at-3.1.18/atd.c.noabort at-3.1.18/atd.c
      else if (pid != 0) {
  	free(mailname);
  	free(newname);
-@@ -669,15 +672,19 @@ run_loop()
+@@ -659,16 +662,20 @@
       * up.
       */
  
@@ -28,10 +28,11 @@ diff -up at-3.1.18/atd.c.noabort at-3.1.18/atd.c
 +        return next_job;
 +    }
  
-     if (nothing_to_do && buf.st_mtime <= last_chg)
+     if (nothing_to_do && buf.st_mtime == last_chg)
  	return next_job;
      last_chg = buf.st_mtime;
  
+     hupped = 0;
 -    if ((spool = opendir(".")) == NULL)
 -	perr("Cannot read " ATJOB_DIR);
 +    if ((spool = opendir(".")) == NULL) {
diff --git a/at-3.1.20-pam.patch b/at-3.2.5-pam.patch
similarity index 78%
rename from at-3.1.20-pam.patch
rename to at-3.2.5-pam.patch
index 418fa84..eba2f84 100644
--- a/at-3.1.20-pam.patch
+++ b/at-3.2.5-pam.patch
@@ -1,7 +1,7 @@
-diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
---- at-3.1.20/at.c.pam	2016-06-28 22:18:00.000000000 +0200
-+++ at-3.1.20/at.c	2016-07-01 09:44:22.251683924 +0200
-@@ -144,18 +144,13 @@ sigc(int signo)
+diff -ur b/at.c a/at.c
+--- b/at.c	2022-01-29 17:42:19.000000000 +0100
++++ a/at.c	2022-02-23 18:42:45.941757090 +0100
+@@ -155,18 +155,12 @@
  /* If the user presses ^C, remove the spool file and exit 
   */
      if (fcreated) {
@@ -16,20 +16,19 @@ diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
 -	    unlink(atfile);
 -        setregid(effective_gid, real_gid);
 -        /*
-+	unlink(atfile);
  	PRIV_END
 -        */
      }
      exit(EXIT_FAILURE);
  }
-@@ -315,26 +310,19 @@ writefile(time_t runtimer, char queue)
+@@ -326,26 +320,19 @@
  	 * bit.  Yes, this is a kluge.
  	 */
  	cmask = umask(S_IRUSR | S_IWUSR | S_IXUSR);
 -        seteuid(real_uid);
 +       if ((seteuid(effective_uid)) < 0)
 +	    perr("Error in seteuid: %s", errno);
- 	if ((fd = open(atfile, O_CREAT | O_EXCL | O_TRUNC | O_WRONLY, S_IRUSR)) == -1)
+ 	if ((fd = open(atfile, O_CREAT | O_EXCL | O_TRUNC | O_WRONLY | O_SYNC, S_IRUSR)) == -1)
  	    perr("Cannot create atjob file %.500s", atfile);
 -        seteuid(effective_uid);
  
@@ -52,7 +51,7 @@ diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
      /* We've successfully created the file; let's set the flag so it 
       * gets removed in case of an interrupt or error.
       */
-@@ -673,7 +661,7 @@ process_jobs(int argc, char **argv, int
+@@ -733,7 +720,7 @@
                      We need the unprivileged uid here since the file is owned by the real
                      (not effective) uid.
                      */
@@ -61,7 +60,7 @@ diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
  
  		    if (queue == '=') {
  			fprintf(stderr, "Warning: deleting running job\n");
-@@ -682,8 +670,8 @@ process_jobs(int argc, char **argv, int
+@@ -742,8 +729,8 @@
  			perr("Cannot unlink %.500s", dirent->d_name);
  			rc = EXIT_FAILURE;
  		    }
@@ -71,7 +70,7 @@ diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
  		    done = 1;
  
  		    break;
-@@ -693,7 +681,7 @@ process_jobs(int argc, char **argv, int
+@@ -753,7 +740,7 @@
  			FILE *fp;
  			int ch;
  
@@ -80,7 +79,7 @@ diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
  			fp = fopen(dirent->d_name, "r");
  
  			if (fp) {
-@@ -706,7 +694,7 @@ process_jobs(int argc, char **argv, int
+@@ -768,7 +755,7 @@
  			    perr("Cannot open %.500s", dirent->d_name);
  			    rc = EXIT_FAILURE;
  			}
@@ -89,10 +88,10 @@ diff -up at-3.1.20/at.c.pam at-3.1.20/at.c
  		    }
  		    break;
  
-diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
---- at-3.1.20/atd.c.pam	2016-06-28 22:14:39.000000000 +0200
-+++ at-3.1.20/atd.c	2016-07-01 09:44:22.251683924 +0200
-@@ -91,6 +91,10 @@ int selinux_enabled = 0;
+diff -ur b/atd.c a/atd.c
+--- b/atd.c	2022-01-29 17:42:19.000000000 +0100
++++ a/atd.c	2022-02-23 18:50:53.743511813 +0100
+@@ -91,6 +91,10 @@
  
  /* Macros */
  
@@ -103,7 +102,7 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
  #define BATCH_INTERVAL_DEFAULT 60
  #define CHECK_INTERVAL 3600
  
-@@ -114,7 +118,7 @@ static int run_as_daemon = 0;
+@@ -115,7 +119,7 @@
  
  static volatile sig_atomic_t term_signal = 0;
  
@@ -112,7 +111,7 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
  #include <security/pam_appl.h>
  
  static pam_handle_t *pamh = NULL;
-@@ -123,15 +127,7 @@ static const struct pam_conv conv = {
+@@ -124,15 +128,7 @@
  	NULL
  };
  
@@ -129,16 +128,16 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
  
  /* Signal handlers */
  RETSIGTYPE 
-@@ -292,7 +288,7 @@ run_file(const char *filename, uid_t uid
+@@ -293,7 +289,7 @@
      char fmt[64];
      unsigned long jobno;
-     int rc;
+     long rc;
 -#ifdef HAVE_PAM
 +#ifdef WITH_PAM
      int retcode;
  #endif
  
-@@ -449,17 +445,11 @@ run_file(const char *filename, uid_t uid
+@@ -450,17 +446,11 @@
      fstat(fd_out, &buf);
      size = buf.st_size;
  
@@ -161,12 +160,12 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
  #endif
  
      close(STDIN_FILENO);
-@@ -473,7 +463,14 @@ run_file(const char *filename, uid_t uid
-     else if (pid == 0) {
+@@ -475,6 +465,14 @@
  	char *nul = NULL;
  	char **nenvp = &nul;
-+	char **pam_envp=0L;
  
++	char **pam_envp=0L;
++ 
 +	PRIV_START
 +#ifdef WITH_PAM
 +	pam_envp = pam_getenvlist(pamh);
@@ -176,16 +175,15 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
  	/* Set up things for the child; we want standard input from the
  	 * input file, and standard output and error sent to our output file.
  	 */
-@@ -492,8 +489,6 @@ run_file(const char *filename, uid_t uid
+@@ -493,7 +491,6 @@
  	close(fd_in);
  	close(fd_out);
  
 -	PRIV_START
--
- 	    nice((tolower((int) queue) - 'a' + 1) * 2);
  
- #ifdef WITH_SELINUX
-@@ -514,9 +509,9 @@ run_file(const char *filename, uid_t uid
+ 	    nice((tolower((int) queue) - 'a') * 2);
+ 
+@@ -515,9 +512,9 @@
  
  	    chdir("/");
  
@@ -198,7 +196,7 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
  	PRIV_END
      }
      /* We're the parent.  Let's wait.
-@@ -529,14 +524,6 @@ run_file(const char *filename, uid_t uid
+@@ -530,14 +527,6 @@
       */
      waitpid(pid, (int *) NULL, 0);
  
@@ -213,7 +211,7 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
      /* Send mail.  Unlink the output file after opening it, so it
       * doesn't hang around after the run.
       */
-@@ -567,8 +554,13 @@ run_file(const char *filename, uid_t uid
+@@ -568,8 +557,13 @@
      unlink(newname);
      free(newname);
  
@@ -227,7 +225,7 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
  	PRIV_START
  
  	    if (initgroups(pentry->pw_name, pentry->pw_gid))
-@@ -590,7 +582,20 @@ run_file(const char *filename, uid_t uid
+@@ -591,7 +585,20 @@
  	    perr("Exec failed for mail command");
  
  	PRIV_END
@@ -236,7 +234,7 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
 +           syslog(LOG_ERR, "fork of mailer failed: %m");
 +     }
 +     /* Parent */
-+     waitpid(mail_pid, (int *) NULL, 0);
++     waitpid(mail_pid, (int *) NULL, 0); 
      }
 +
 +#ifdef WITH_PAM
@@ -248,10 +246,10 @@ diff -up at-3.1.20/atd.c.pam at-3.1.20/atd.c
      exit(EXIT_SUCCESS);
  }
  
-diff -up at-3.1.20/config.h.in.pam at-3.1.20/config.h.in
---- at-3.1.20/config.h.in.pam	2015-12-18 21:29:24.000000000 +0100
-+++ at-3.1.20/config.h.in	2016-07-01 09:44:22.251683924 +0200
-@@ -68,8 +68,8 @@
+diff -ur b/config.h.in a/config.h.in
+--- b/config.h.in	2022-01-29 17:42:19.000000000 +0100
++++ a/config.h.in	2022-02-23 18:51:31.467570176 +0100
+@@ -74,8 +74,8 @@
  /* Define to 1 if you have the <nlist.h> header file. */
  #undef HAVE_NLIST_H
  
@@ -262,10 +260,10 @@ diff -up at-3.1.20/config.h.in.pam at-3.1.20/config.h.in
  
  /* Define to 1 if you have the `pstat_getdynamic' function. */
  #undef HAVE_PSTAT_GETDYNAMIC
-diff -up at-3.1.20/configure.ac.pam at-3.1.20/configure.ac
---- at-3.1.20/configure.ac.pam	2016-06-28 22:55:52.000000000 +0200
-+++ at-3.1.20/configure.ac	2016-07-01 09:45:23.268092527 +0200
-@@ -78,7 +78,7 @@ AC_FUNC_GETLOADAVG
+diff -ur b/configure.ac a/configure.ac
+--- b/configure.ac	2022-01-29 17:42:19.000000000 +0100
++++ a/configure.ac	2022-02-23 18:53:08.516720324 +0100
+@@ -97,7 +97,7 @@
  AC_CHECK_FUNCS(getcwd mktime strftime setreuid setresuid sigaction waitpid)
  AC_CHECK_HEADERS(security/pam_appl.h, [
    PAMLIB="-lpam"
@@ -274,7 +272,7 @@ diff -up at-3.1.20/configure.ac.pam at-3.1.20/configure.ac
  ])
  
  dnl Checking for programs
-@@ -239,6 +239,13 @@ AC_ARG_WITH(daemon_username,
+@@ -260,6 +260,13 @@
  )
  AC_SUBST(DAEMON_USERNAME)
  
@@ -288,10 +286,10 @@ diff -up at-3.1.20/configure.ac.pam at-3.1.20/configure.ac
  AC_ARG_WITH(selinux,
  [ --with-selinux       Define to run with selinux (default=check)],
  [],
-diff -up at-3.1.20/Makefile.in.pam at-3.1.20/Makefile.in
---- at-3.1.20/Makefile.in.pam	2016-07-01 09:44:22.250683901 +0200
-+++ at-3.1.20/Makefile.in	2016-07-01 09:44:22.252683947 +0200
-@@ -68,7 +68,7 @@ LIST = Filelist Filelist.asc
+diff -ur b/Makefile.in a/Makefile.in
+--- b/Makefile.in	2022-02-23 18:33:26.999892289 +0100
++++ a/Makefile.in	2022-02-23 18:53:28.600751396 +0100
+@@ -76,7 +76,7 @@
  all: at atd atd.service atrun
  
  at: $(ATOBJECTS)
@@ -300,9 +298,9 @@ diff -up at-3.1.20/Makefile.in.pam at-3.1.20/Makefile.in
  	rm -f $(CLONES)
  	$(LN_S) -f at atq
  	$(LN_S) -f at atrm
-diff -up at-3.1.20/perm.c.pam at-3.1.20/perm.c
---- at-3.1.20/perm.c.pam	2015-08-22 00:09:22.000000000 +0200
-+++ at-3.1.20/perm.c	2016-07-01 09:44:22.252683947 +0200
+diff -ur b/perm.c a/perm.c
+--- b/perm.c	2022-01-29 17:42:19.000000000 +0100
++++ a/perm.c	2022-02-23 18:56:21.401018761 +0100
 @@ -51,6 +51,14 @@
  #define PRIV_END while(0)
  #endif
@@ -318,7 +316,7 @@ diff -up at-3.1.20/perm.c.pam at-3.1.20/perm.c
  /* Structures and unions */
  
  
-@@ -108,18 +116,45 @@ user_in_file(const char *path, const cha
+@@ -108,18 +116,45 @@
  int
  check_permission()
  {
@@ -367,10 +365,10 @@ diff -up at-3.1.20/perm.c.pam at-3.1.20/perm.c
    allow = user_in_file(ETCDIR "/at.allow", pentry->pw_name);
    if (allow==0 || allow==1)
      return allow;
-diff -up at-3.1.20/privs.h.pam at-3.1.20/privs.h
---- at-3.1.20/privs.h.pam	2015-08-22 00:09:22.000000000 +0200
-+++ at-3.1.20/privs.h	2016-07-01 09:44:22.252683947 +0200
-@@ -144,3 +144,63 @@ extern gid_t real_gid, effective_gid, da
+diff -ur b/privs.h a/privs.h
+--- b/privs.h	2022-01-29 17:42:19.000000000 +0100
++++ a/privs.h	2022-02-23 18:58:20.920203690 +0100
+@@ -144,3 +144,62 @@
  #error "Cannot implement user ID swapping without setreuid or setresuid"
  #endif
  #endif
@@ -433,4 +431,3 @@ diff -up at-3.1.20/privs.h.pam at-3.1.20/privs.h
 +}
 +
 +#endif
-+
diff --git a/at-3.2.5-past-date.patch b/at-3.2.5-past-date.patch
new file mode 100644
index 0000000..6344c40
--- /dev/null
+++ b/at-3.2.5-past-date.patch
@@ -0,0 +1,33 @@
+From 6c131df8c85cb2761faf551f8f9db179e216fc09 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Poho=C5=99elsk=C3=BD?= <opohorel@redhat.com>
+Date: Wed, 25 Jun 2025 14:35:31 +0200
+Subject: [PATCH] Reject past dates when using -t option
+
+-t option was missing validation to reject past dates, unlike the
+regular time parsing.
+
+Add the same past date validation used by parsetime() to the posixtime()
+code path to ensure consistent behavior when parsing time.
+---
+ at.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/at.c b/at.c
+index 8d0feaa..3fb0582 100644
+--- a/at.c
++++ b/at.c
+@@ -951,6 +951,11 @@ main(int argc, char **argv)
+ 		fprintf(stderr, "invalid date format: %s\n", optarg);
+ 		exit(EXIT_FAILURE);
+ 	    }
++	    /* Check if the parsed time is in the past */
++	    if (timer < time(NULL)) {
++		fprintf(stderr, "at: refusing to create job destined in the past\n");
++		exit(EXIT_FAILURE);
++	    }
+ 	    break;
+ 
+ 	case 'o':
+-- 
+2.49.0
+
diff --git a/at-tmpfiles.conf b/at-tmpfiles.conf
new file mode 100644
index 0000000..8eec9a7
--- /dev/null
+++ b/at-tmpfiles.conf
@@ -0,0 +1,6 @@
+# at - Tmpfiles configuration for at daemon
+# Create /var/spool/at directory structure for the at daemon
+
+d /var/spool/at 0700 root root - -
+d /var/spool/at/spool 0700 root root - -
+f /var/spool/at/.SEQ 0600 root root - -
diff --git a/at.spec b/at.spec
index c6032fd..60d9fd4 100644
--- a/at.spec
+++ b/at.spec
@@ -1,43 +1,45 @@
 %bcond_without pam
 
-Summary:	Job spooling tools
-Name:		at
-Version:	3.1.23
-Release:	5%{?dist}
+Summary:    Job spooling tools
+Name:       at
+Version:    3.2.5
+Release:    20%{?dist}
 # http://packages.debian.org/changelogs/pool/main/a/at/current/copyright
 # + install-sh is MIT license with changes under Public Domain
-License:	GPLv3+ and GPLv2+ and ISC and MIT and Public Domain
-URL:		http://ftp.debian.org/debian/pool/main/a/at
+License:    GPL-3.0-or-later AND GPL-2.0-or-later AND ISC
+URL:        http://ftp.debian.org/debian/pool/main/a/at
 
-Source:		http://ftp.debian.org/debian/pool/main/a/at/at_%{version}.orig.tar.gz
+Source:     http://software.calhariz.com/at/at_%{version}.orig.tar.gz
 # git upstream source git://git.debian.org/git/collab-maint/at.git
-Source1:	pam_atd
-Source3:	atd.sysconf
-Source5:	atd.systemd
+Source1:    pam_atd
+Source2:    at-tmpfiles.conf
+Source3:    atd.sysconf
+Source5:    atd.systemd
 
-Patch0:		at-aarch64.patch
-Patch1:		at-3.1.18-make.patch
-Patch2:		at-3.1.20-pam.patch
-Patch4:		at-3.1.14-opt_V.patch
-Patch5:		at-3.1.20-shell.patch
-Patch6:		at-3.1.18-nitpicks.patch
-Patch8:		at-3.1.14-fix_no_export.patch 
-Patch9:		at-3.1.14-mailwithhostname.patch
-Patch10:	at-3.1.14-usePOSIXtimers.patch
-Patch12:	at-3.1.20-aborted-jobs.patch
-Patch13:	at-3.1.18-noabort.patch
-Patch14:	at-3.1.16-fclose-error.patch
-Patch15:	at-3.1.16-clear-nonjobs.patch
-Patch16:	at-3.1.18-utc-dst.patch
-Patch17:	at-3.1.20-lock-locks.patch
-Patch18:	at-3.1.23-document-n.patch
-Patch19:	at-3.1.20-log-jobs.patch
+Patch:      at-3.2.5-address-sast.patch
+Patch:      at-aarch64.patch
+Patch:      at-3.2.5-make.patch
+Patch:      at-3.2.5-pam.patch
+Patch:      at-3.1.14-opt_V.patch
+Patch:      at-3.2.2-shell.patch
+Patch:      at-3.2.5-nitpicks.patch
+Patch:      at-3.1.14-fix_no_export.patch
+Patch:      at-3.2.5-mailwithhostname.patch
+Patch:      at-3.2.5-aborted-jobs.patch
+Patch:      at-3.2.5-noabort.patch
+Patch:      at-3.1.16-fclose-error.patch
+Patch:      at-3.1.16-clear-nonjobs.patch
+Patch:      at-3.2.2-lock-locks.patch
+Patch:      at-3.1.23-document-n.patch
+Patch:      at-3.1.20-log-jobs.patch
+Patch:      at-3.2.5-past-date.patch
 
 BuildRequires: gcc
 BuildRequires: flex flex-static bison autoconf
 BuildRequires: libselinux-devel >= 1.27.9
 BuildRequires: perl(Test::Harness)
 BuildRequires: perl(Test::More)
+BuildRequires: systemd-rpm-macros
 
 %if %{with pam}
 BuildRequires: pam-devel
@@ -45,6 +47,7 @@ BuildRequires: pam-devel
 Conflicts: crontabs <= 1.5
 # No, I'm not kidding
 BuildRequires: smtpdaemon
+BuildRequires: make
 
 Requires(post): systemd-units
 Requires(preun): systemd-units
@@ -65,62 +68,44 @@ need to be repeated at the same time every day/week, etc. you should
 use crontab instead.
 
 %prep
-%setup -q
+%autosetup -N
 cp %{SOURCE1} .
-%patch0 -p1 -b .arm
-%patch1 -p1 -b .make
-%patch2 -p1 -b .pam
-%patch4 -p1 -b .opt_V
-%patch5 -p1 -b .shell
-%patch6 -p1 -b .nit
-%patch8 -p1 -b .export
-%patch9 -p1 -b .mail
-%patch10 -p1 -b .posix
-%patch12 -p1 -b .aborted
-%patch13 -p1 -b .noabort
-%patch14 -p1 -b .fclose
-%patch15 -p1 -b .clear-nojobs
-%patch16 -p1 -b .dst
-%patch17 -p1 -b .lock-locks
-%patch18 -p1 -b .document-n
-%patch19 -p1 -b .log-jobs
+%autopatch -p1
 
 %build
-# patch9 touches configure.in
-autoconf
 # uselles files
 rm -f lex.yy.* y.tab.*
+
 %configure --with-atspool=%{_localstatedir}/spool/at/spool \
-	--with-jobdir=%{_localstatedir}/spool/at \
-	--with-daemon_username=root  \
-	--with-daemon_groupname=root \
-	--with-selinux \
-%if %{with pam}
-	--with-pam
-%endif
+    --with-jobdir=%{_localstatedir}/spool/at \
+    --with-daemon_username=root  \
+    --with-daemon_groupname=root \
+    --with-selinux \
+    %{?with_pam:--with-pam}
 
 make
 
 %install
 make install \
-	DAEMON_USERNAME=`id -nu`\
-	DAEMON_GROUPNAME=`id -ng` \
-	DESTDIR=%{buildroot}\
-	sbindir=%{buildroot}%{_prefix}/sbin\
-	bindir=%{buildroot}%{_bindir}\
-	prefix=%{buildroot}%{_prefix}\
-	exec_prefix=%{buildroot}%{_prefix}\
-	docdir=%{buildroot}/usr/doc\
-	mandir=%{buildroot}%{_mandir}\
-	etcdir=%{buildroot}%{_sysconfdir} \
-	ATJOB_DIR=%{buildroot}%{_localstatedir}/spool/at \
-	ATSPOOL_DIR=%{buildroot}%{_localstatedir}/spool/at/spool \
-	INSTALL_ROOT_USER=`id -nu` \
-	INSTALL_ROOT_GROUP=`id -nu`;
+    DAEMON_USERNAME=`id -nu` \
+    DAEMON_GROUPNAME=`id -ng` \
+    DESTDIR=%{buildroot} \
+    sbindir=%{_bindir} \
+    bindir=%{_bindir} \
+    datadir=%{_datadir} \
+    prefix=%{_prefix} \
+    exec_prefix=%{_prefix} \
+    docdir=%{_prefix}/doc \
+    mandir=%{_mandir} \
+    etcdir=%{_sysconfdir} \
+    ATJOB_DIR=%{_localstatedir}/spool/at \
+    ATSPOOL_DIR=%{_localstatedir}/spool/at/spool \
+    INSTALL_ROOT_USER=`id -nu` \
+    INSTALL_ROOT_GROUP=`id -nu`;
 
 echo > %{buildroot}%{_sysconfdir}/at.deny
 mkdir docs
-cp  %{buildroot}/%{_prefix}/doc/at/* docs/
+cp  %{buildroot}%{_prefix}/doc/at/* docs/
 
 mkdir -p %{buildroot}%{_sysconfdir}/pam.d
 install -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pam.d/atd
@@ -132,18 +117,24 @@ install -m 644 %{SOURCE3} %{buildroot}/etc/sysconfig/atd
 mkdir -p %{buildroot}/%{_unitdir}/
 install -m 644 %{SOURCE5} %{buildroot}/%{_unitdir}/atd.service
 
+# install tmpfiles configuration
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 644 %{SOURCE2} %{buildroot}%{_tmpfilesdir}/at.conf
+
 # remove unpackaged files from the buildroot
 rm -r  %{buildroot}%{_prefix}/doc
+# Remove .SEQ file created by make install - tmpfiles will create it
+rm -f %{buildroot}%{_localstatedir}/spool/at/.SEQ
 
 %check
 make test
 
 %post
-touch %{_localstatedir}/spool/at/.SEQ
-chmod 600 %{_localstatedir}/spool/at/.SEQ
-chown root:root %{_localstatedir}/spool/at/.SEQ
 %systemd_post atd.service
 
+# Create directories and files using tmpfiles
+%tmpfiles_create at.conf
+
 %preun
 %systemd_preun atd.service
 
@@ -166,22 +157,114 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 %files
 %license Copyright COPYING
 %doc README timespec ChangeLog
-%attr(0644,root,root)		%config(noreplace) %{_sysconfdir}/at.deny
-%attr(0644,root,root)		%config(noreplace) %{_sysconfdir}/sysconfig/atd
-%attr(0700,root,root)		%dir %{_localstatedir}/spool/at
-%attr(0600,root,root)		%verify(not md5 size mtime) %ghost %{_localstatedir}/spool/at/.SEQ
-%attr(0700,root,root)		%dir %{_localstatedir}/spool/at/spool
-%attr(0644,root,root)		%config(noreplace) %{_sysconfdir}/pam.d/atd
-%{_sbindir}/atrun
-%attr(0755,root,root)		%{_sbindir}/atd
+%attr(0644,root,root)       %config(noreplace) %{_sysconfdir}/at.deny
+%attr(0644,root,root)       %config(noreplace) %{_sysconfdir}/sysconfig/atd
+%attr(0644,root,root)       %config(noreplace) %{_sysconfdir}/pam.d/atd
+%attr(0700,root,root)       %dir %{_localstatedir}/spool/at
+%attr(0700,root,root)       %dir %{_localstatedir}/spool/at/spool
+%{_tmpfilesdir}/at.conf
+%{_bindir}/atrun
+%attr(0755,root,root)       %{_bindir}/atd
 %{_mandir}/man*/*
 %{_bindir}/batch
 %{_bindir}/atrm
 %{_bindir}/atq
-%attr(4755,root,root)		%{_bindir}/at
-%attr(0644,root,root)		/%{_unitdir}/atd.service
+%attr(4755,root,root)       %{_bindir}/at
+%{_datadir}/at/
+%attr(0644,root,root)       /%{_unitdir}/atd.service
 
 %changelog
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-20
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Thu Sep 18 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-19
+- Add /var/spool/at and /var/spool/at/spool directories into %%files section
+- Resolves: rhbz#2396330
+
+* Wed Aug 27 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-18
+- Use systemd-tmpfiles for /var/spool/at directories
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-17
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Wed Jun 25 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-16
+- Fix past date handling with -t option
+
+* Mon May 05 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-15
+- Claim ownership of /usr/share/at
+- Resolves: rhbz#2283298
+
+* Mon Jan 27 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-14
+- Unify bin and sbin directories
+- Resolves: rhbz#2339910
+
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Thu Aug 8 2024 Ales Nezbeda <anezbeda@redhat.com> - 3.2.5-12
+- Backport fixes from upstream PR
+- https://salsa.debian.org/debian/at/-/merge_requests/34
+
+* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Thu May 02 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-10
+- Corrected document-n patch
+- Resolves: rhbz#2276918
+
+* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Mon Jun 26 2023 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-6
+- Convert licenses to SPDX format
+- Dropped MIT and Public Domain license as they are not present in upstream sources
+
+* Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Thu Mar 31 2022 Jan Staněk <jstanek@redhat.com> - 3.2.5-3
+- Add preceding newline to delimiter in at-3.2.2-shell.patch
+
+* Tue Mar 08 2022 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-2
+- Add mising directory and batch-job script into at-3.2.5-make.patch
+- Defined datadir in %%install section and listed batch-job in %%files section
+
+* Tue Mar 01 2022 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.5-1
+- Update to new upstream release
+- Removed at-3.1.14-usePOSIXtimers.patch and at-3.2.23-coverity-fix.patch, because
+  upstream implemented them
+- Defined folder paths without %%{buildroot} in order to make them work with latest
+  Makefile changes
+- Resolves: rhbz#2048132
+
+* Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Fri May 21 2021 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.2-1
+- Update to new upstream release
+
+* Fri Apr 16 2021 Jan Staněk <jstanek@redhat.com> - 3.1.23-8
+- Patch issues found by coverity (rhbz#1938678)
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.1.23-7
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.1.23-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
 * Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.1.23-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 
@@ -317,7 +400,7 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
 
 * Mon Nov 14 2011 Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-5
-- 754156 fix typo in script 
+- 754156 fix typo in script
 
 * Mon Nov 14 2011 Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-5
 - fix incorrect option in test in 56atd
@@ -359,7 +442,7 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - 617320 systemd init script replacement
 
 * Mon Mar 15 2010 Marcela Mašláňová <mmaslano@redhat.com> - 3.1.12-5
-- 568222 interrupted 'at' job creates empty job for non-root 
+- 568222 interrupted 'at' job creates empty job for non-root
 
 * Mon Mar  1 2010 Marcela Mašláňová <mmaslano@redhat.com> - 3.1.12-4
 - 568779 atd is alway runnig after suspend/resume
@@ -416,8 +499,8 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - 486227 add hyphen date into manual page.
 
 * Wed Dec 3 2008 Marcela Mašláňová <mmaslano@redhat.com> - 3.1.10-27
-- 464393 add script into pm-utils, because daemon wasn't taking all jobs 
-	after suspend/hibernate
+- 464393 add script into pm-utils, because daemon wasn't taking all jobs
+    after suspend/hibernate
 
 * Fri Oct 24 2008 Marcela Mašláňová <mmaslano@redhat.com> - 3.1.10-26
 - update init script according to SysVInitScript
@@ -494,7 +577,7 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - rhbz#224597
 
 * Fri Oct 27 2006 Marcela Maslanova <mmaslano@redhat.com> - 3.1.10-6
-- fix daylight-saving again 
+- fix daylight-saving again
 - fix #214759 - problem with seteuid
 
 * Wed Oct 25 2006 Marcela Maslanova <mmaslano@redhat.com> - 3.1.10-5
@@ -529,11 +612,11 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - use include instead of pam_stack in pam config
 
 * Fri Jun 03 2005 Jason Vas Dias <jvdias@redhat.com> 3.1.8-78
-- fix bug 159220: add pam_loginuid to pam session stack in /etc/pam.d/atd 
+- fix bug 159220: add pam_loginuid to pam session stack in /etc/pam.d/atd
 - fix bug 102341: add '-r' synonym for '-d' / atrm for POSIX / SuS conformance
 
 * Fri Apr 08 2005 Jason Vas Dias <jvdias@redhat.com> 3.1.8-77
-- always call pam_setcred(pamh, PAM_DELETE_CRED) before session 
+- always call pam_setcred(pamh, PAM_DELETE_CRED) before session
 - close
 
 * Tue Apr 05 2005 Jason Vas Dias <jvdias@redhat.com> 3.1.8-70
@@ -544,7 +627,7 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - user can know when using at(1) if PAM permission is denied.
 
 * Tue Mar 08 2005 Jason Vas Dias <jvdias@redhat.com> 3.1.8-67
-- better fix for bug 150131: change DAEMON_USERNAME and 
+- better fix for bug 150131: change DAEMON_USERNAME and
 - DAEMON_GROUPNAME to 'root' .
 
 * Mon Mar 07 2005 Jason Vas Dias <jvdias@redhat.com> 3.1.8-66
@@ -562,7 +645,7 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - details of blacklisted variables.
 
 * Tue Sep 28 2004 Rik van Riel <riel@redhat.com> 3.1.8-58
-- fix typo in man page, bug 112303 
+- fix typo in man page, bug 112303
 - (regenerated at-3.1.8-man-timespec-path.patch with fix)
 
 * Tue Aug 03 2004 Jason Vas Dias <jvdias@redhat.com>
@@ -695,7 +778,7 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 - updated patch update, still bug #46546
 
 * Wed Jul 18 2001 Crutcher Dunnavant <crutcher@redhat.com>
-- applied enrico.scholz@informatik.tu-chemnitz.de's change to the env patch to 
+- applied enrico.scholz@informatik.tu-chemnitz.de's change to the env patch to
 - address bug #46546
 
 * Mon Jun 25 2001 Crutcher Dunnavant <crutcher@redhat.com>
@@ -778,7 +861,7 @@ chown root:root %{_localstatedir}/spool/at/.SEQ
 * Mon May 24 1999 Jeff Johnson <jbj@redhat.com>
 - reset SIGCHLD before exec (#3016).
 
-* Sun Mar 21 1999 Cristian Gafton <gafton@redhat.com> 
+* Sun Mar 21 1999 Cristian Gafton <gafton@redhat.com>
 - auto rebuild in the new build environment (release 8)
 
 * Thu Mar 18 1999 Cristian Gafton <gafton@redhat.com>
diff --git a/plans/ci.fmf b/plans/ci.fmf
new file mode 100644
index 0000000..c1627f9
--- /dev/null
+++ b/plans/ci.fmf
@@ -0,0 +1,5 @@
+summary: Basic smoke test
+discover:
+    how: fmf
+execute:
+    how: tmt
diff --git a/sources b/sources
index c8bc7c4..9e44a81 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (at_3.1.23.orig.tar.gz) = ee5cf5abf32cf1e89746e427d1cc20005ef49fad47db55512c90042a77e86b2c15f5de029c79573bc86ce4aead6ed2d561b89812510aadbc5763f9288b467cfd
-SHA512 (at_3.1.23.orig.tar.gz.asc) = ccc32753d31cccd6257c25acfda3f407c3cab52ca9b6c120eca852207cb00e143daa78b81bc65cc2703c5f94cf5d7fae08d301cfc57541e1ebd31df6ae2121bb
+SHA512 (at_3.2.5.orig.tar.gz) = 542e8948bbdc1d06934070cbfe242688b541ef6342c6b0351255f8b9d7a3ed915a9304b5cf5442dfc15845b3d2b926ebecbfc5bccd204519d0a2775b27f8139c
+SHA512 (at_3.2.5.orig.tar.gz.sig) = 5a38cb7da5b85233ede79e7b90aec7705250e315c5b4bcccb9c1c9a6453a9cc5c79c840023a44ac5d087137596c2b4b98971e233ea1fbbaa0c82833e53dcd8ac
diff --git a/tests/at b/tests/at
deleted file mode 160000
index 30cccc8..0000000
--- a/tests/at
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 30cccc88a2064eb05018a09d65164a26972cd5b5
diff --git a/tests/initscript/main.fmf b/tests/initscript/main.fmf
new file mode 100644
index 0000000..275b067
--- /dev/null
+++ b/tests/initscript/main.fmf
@@ -0,0 +1,12 @@
+summary: Initscript sanity
+description: ''
+contact: Radek Biba <rbiba@redhat.com>
+component:
+  - at
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+  - at
+duration: 5m
+extra-summary: /CoreOS/at/Sanity/initscript
+extra-task: /CoreOS/at/Sanity/initscript
diff --git a/tests/initscript/runtest.sh b/tests/initscript/runtest.sh
index a84aecb..67ecc2d 100755
--- a/tests/initscript/runtest.sh
+++ b/tests/initscript/runtest.sh
@@ -27,7 +27,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 # Include rhts environment
-. /usr/share/rhts-library/rhtslib.sh
+. /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="at"
 SERVICE="atd"
diff --git a/tests/tests.yml b/tests/tests.yml
deleted file mode 100644
index 751a586..0000000
--- a/tests/tests.yml
+++ /dev/null
@@ -1,13 +0,0 @@
----
-# This first play always runs on the local staging system
-- hosts: localhost
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    - container
-    - atomic
-    tests:
-    - initscript
-    required_packages:
-    - at       # Required to run initscript