Release 2016.10

First, this release reverts a previous change to use a mtime of `1`
back to `0`.  This will affect flatpak and users who have set up
build systems to set that mtime, but it restores compatibility
with systems which were using the previous zero value.  For more information,
see https://github.com/ostreedev/ostree/pull/495

Another notable bit is we fixed a race condition in pull when the
upstream ref hadn't changed.

OSTree also learned about split metadata/content fetches and
`mirrorlist` URIs.  Generally, the idea with this is that you set up a
centralized set of metadata servers that are secured via pinned TLS
etc., and content fetches can occur via more local mirrors.

Besides that, there is continued work on initramfs-less systems, and
some fixes for resource use during delta generation.

Colin Walters (8):
      repo: Revert default timestamp from 1 back to 0
      delta: Add missing `goto out` for failure to mmap()
      repo: Only use mmap() for metadata > 16k
      delta: Unreference files we've processed
      fetcher: Fix another finalization deadlock
      sysroot: Avoid double cleanup, and ensure no cleanup if specified
      core: Make OSTREE_TIMESTAMP public API
      Release 2016.10

Dan Nicholson (3):
      build: Set --enable-man during distcheck
      build: Distribute man page XML source
      build: Actually distribute man page XML source

Giuseppe Scrivano (1):
      gpg: do not segfault when the algorithm name is not known

Jonathan Lebon (7):
      pull code: support contenturl setting
      trivial-httpd: prepend timestamp in log file
      pull: drop fetching_sync_uri
      pull: add mirrorlist support
      libtest: add has_gpgme() helper function
      tests: add tests for contenturl and mirrorlist
      pull code: clean up mirrorlist hack

William Manley (4):
      switchroot: Fix build on Ubuntu
      switchroot: Fix test-switchroot now autotools can build static
      ostree-prepare-root: Error if realpath fails
      ostree-prepare-root: Fix running with musl

Git-EVTag-v0-SHA512: affd25071654468e3fcc1d321afb6ade531550dc4f31fe3cd425adeeee9ecd4f56108a12aadd4c5404256409cf00c7821ff10d33afaa50dc38604c2323dc7901
-----BEGIN PGP SIGNATURE-----

iQEwBAABCgAaBQJX0gd9Exx3YWx0ZXJzQHZlcmJ1bS5vcmcACgkQ3EX9WSHBPwut
SwgA0S+guy40Ojeob4ojYdklqaZrYLk0yHcVCzQizKYaLxvpC1GMVFW/PuO6RgUM
opyslT02gLP2pV16r0e9e9vMB85cnod3sC1Ls3B4hq6Anmg0t1wnZcqa0BHeZWb6
vw+r8S64Sl61+SCidTIBsgj/45lGQiFegz497NA0WeiMQ/MHip4eJ7PcuazBssV/
58QlHHajvvE8ftu0jD2REbFao4Lsi7fU0o5FL4bvMydUKrzCCquOTwPRwDGIgpBY
J/8ag9FtepD+lST0zatLv9JZGKYp4Bt8V7z8orgau/pMkBR2Bdp1FJYR8sENhrHn
QbUNwIkq8HgSWTjz3LqMrUIzeQ==
=yyBK
-----END PGP SIGNATURE-----