opencryptoki (3.23.0+dfsg-0ubuntu3.1) noble-security; urgency=medium

  * d/p/lp-2163181-cca-adjust-host-library-version-detection.patch: Fix
    CCA host library version detection for newer CCA versions, needed to
    support CCA 8.4; without it, the CCA host library version is reported
    as invalid. (LP: #2163181)
  * d/p/lp-2163253-fix-ber-der-decoder-out-of-bounds-access.patch: Fix
    possible out-of-bounds access in BER decode functions. (LP: #2163253)
    (CVE-2026-40253)
  * d/p/lp-2163254-fix-symlink-following-vulnerabilities.patch: Fix
    symlink-following vulnerabilities (CWE-59). (LP: #2163254)
    (CVE-2026-23893)

 -- Frank Heimes <frank.heimes@canonical.com>  Tue, 18 Aug 2026 15:24:04 +0000

opencryptoki (3.23.0+dfsg-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 20:23:07 +0000

opencryptoki (3.23.0+dfsg-0ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 20:29:43 +0000

opencryptoki (3.23.0+dfsg-0ubuntu1) noble; urgency=medium

  * New upstream release (LP: #2050014)
    - Solves 'EP11 token support for FIPS 2021-session bound EP11 keys'.
    - Adjust d/p/01-disable-testcases.patch due to changed context.
    - Add 'Pre-Depends: ${misc:Pre-Depends}' to d/control to fix
      lintian warning 'skip-systemd-native-flag-missing-pre-depends'.

 -- Frank Heimes <frank.heimes@canonical.com>  Thu, 15 Feb 2024 11:31:50 +0100

opencryptoki (3.22.0+dfsg-0ubuntu1) noble; urgency=medium

  * New upstream release (LP: #2050023), incl. support for:
    - CCA token: PKCS #11 3.0 supporting AES_XTS (LP: #2025924)
    - Adjust d/p/01-disable-testcases.patch due to slightly changed context.
    - Refresh d/p/03-dlopen-soname.patch due to fuzz.
    - Remove the following patches, since they are all incl. in upstream 3.22:
      - d/p/lp-2026732-common-Correctly-set-default-attributes-for-*.patch
      - d/p/lp-2026732-p11sak-Fix-user-confirmation-prompt-behavior-*.patch
      - d/p/lp-2026732-pkcsstats-Fix-handling-of-user-name.patch
      - d/p/lp-2026732-p11sak-fix-length-handling-when-importing-and-*.patch
      - d/p/lp-2026732-p11sak-Fix-listing-of-key-objects-when-other-*.patch
      - d/p/lp-2026732-p11sak-Fix-parsing-of-slot-number-0.patch
  * Update 'Standards-Version' in d/control from 4.6.1.0 to latest 4.6.2.
  * Change 'Forwarded' field from "no" or "not-needed" in
    d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 02 Feb 2024 16:15:29 +0100

opencryptoki (3.21.0+dfsg-0ubuntu2) noble; urgency=medium

  * Fix opencryptoki package install issue (LP: #2039783)
    - Remove d/opencryptoki.tmpfile since upstream opencryptoki.conf
      from build output should be used.
    - Leave the handling of non-persistent file and folders
      (like /run/opencryptoki/ and /var/lock/opencryptoki) entirely
      to systemd-tmpfiles and tmpfiles.d/opencryptoki.conf, means:
      - remove them from d/openstack.dirs
      - and instead call systemd-tmpfiles in d/openstack.postinst
      - this also allows to consolidate and remove commands from postinst
    - Ensure that pkcs11 is a supplementary group for root.
    - Modify d/opencryptoki.postrm and remove pkcsslotd user before
      removing pkcs11 group (otherwise it'll never be empty).
    - Remove obsolete Depends on lsb-base to avoid a lintian error report.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 01 Dec 2023 16:32:47 +0100

opencryptoki (3.21.0+dfsg-0ubuntu1) mantic; urgency=medium

  * New upstream release (LP: #2026732), incl. support for:
    - concurrent MK rotation for ep11 token (LP: #2025917)
    - concurrent MK rotation for cca token (LP: #2025926)
    - cca token: protected key support (LP: #2025923)
    - pkcsslotd hardening (LP: #2025922)
    Required modifications:
    - add libcap-dev to Build-Depends
    - adjust and refresh d/p/01-disable-testcases.patch due to changed context
    - adjust and refresh d/p/04-pkcsslotd-cmdline-args.patch due to changed
      context and fuzz
    - adjust, expand and refresh
      d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
      due to changed context and changes around pkcsslotd, which req. folders
      added to d/opencryptoki.dirs and modifications in d/opencryptoki.postinst
      and d/opencryptoki.postrm to work properly.
    Fix selected issues on top of v3.21 and add:
    - d/p/lp-2026732-common-Correctly-set-default-attributes-for-certific.patch
    - d/p/lp-2026732-p11sak-Fix-user-confirmation-prompt-behavior-when-st.patch
    - d/p/lp-2026732-pkcsstats-Fix-handling-of-user-name.patch
    - d/p/lp-2026732-p11sak-fix-length-handling-when-importing-and-export.patch
    - d/p/lp-2026732-p11sak-Fix-listing-of-key-objects-when-other-object-.patch
    - d/p/lp-2026732-p11sak-Fix-parsing-of-slot-number-0.patch
  * According to LP: #2022088 comment #4, revert d/rules, d/triggers
    d/libopencryptoki0.{install,links} back, but do not instead add 
    d/p/lp-2022088-fix-p11sak-failure-to-find-libopencryptoki.so.patch
    to fix 'failure that p11sak is not able to find libopencryptoki',
    since the p11sak code was refactored and changed significantly in v3.21.
    To fix this now expand d/p/03-dlopen-soname.patch with hunks for
    usr/sbin/p11sak/p11sak.h, usr/sbin/pkcshsm_mk_change/pkcshsm_mk_change.c,
    usr/sbin/pkcsstats/pkcsstats.c, testcases/common/common.c and
    testcases/policy/policytest.c
  * d/libopencryptoki0.links{.s390x} Merge files, since the content of the
    s390x version of this file applies to all platforms.
  * d/*: changes due to wrap-and-sort run

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 07 Jul 2023 12:15:35 +0200

opencryptoki (3.20.0+dfsg-0ubuntu2) mantic; urgency=medium

  * d/rules, d/triggers, d/libopencryptoki0.install: keep tmp/etc/ld.so.conf.d
    content, add opencryptoki conf file to /etc/ld.so.conf.d/
    and add trigger for ldconfig to allow tools like
    p11sak to find libopencryptoki shared object file. (LP: #2022088)
  * d/control, d/compat: Bump dh compat level to 13 to remove dh-exec
    dependency and remove executable flags from d/*.install*, d/*.links*.
  * d/rules: remove the explicit dh_missing call, and rely instead on dh
    to call it and erroring out on missing files.
  * d/opencryptoki.install: install entire content of etc/opencryptoki build
    folder to esp. catch all existing conf files and on top make the arch-
    specific file 'opencryptoki.install.s390x' obsolete. (LP: #2018911)
  * d/opencryptoki.postinst: change strength.conf file permissions to 640
    which is checked/forced by the code. (LP: #2018908)

 -- Frank Heimes <frank.heimes@canonical.com>  Wed, 31 May 2023 21:28:48 +0200

opencryptoki (3.20.0+dfsg-0ubuntu1) lunar; urgency=medium

  * New upstream release (LP: #2003847), includes support for:
    - ep11 token: master key consistency (LP: #2003629)
    - ica and soft tokens: PKCS #11 3.0 - support AES_XTS (LP: #2003630)
    - ep11 token: PKCS #11 3.0 - support AES_XTS (LP: #2003632)
    - Support of ep11 token for new IBM Z Hardware (IBM z16) (LP: #2003635)
    - ep11 token: vendor specific key derivation (LP: #2003638)
    - key gen. with expected MKVP only on CCA and EP11 tokens (LP: #2003639)
    - p11sak support Dilithium and Kyber keys (LP: #2003669)
  * Remove patch
    d/p/lp-1982842-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch
    since it's included in 3.19 and newer.
  * Remove patch 
    d/p/lp-1989558-common-fix-memory-leak-in-save_private_token_object.patch
    since it's included in 3.19 and newer.
  * Adjust patch d/p/01-disable-testcases.patch due to minor change in context.
  * Refresh patch d/p/03-dlopen-soname.patch to fix 'fuzz'.
  * Modified patch
    d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
    due to change in context, refresh it to fix 'fuzz' and remove addgroup
    from Makefile.am, since this is handled in d/opencryptoki.postinst.
  * Add opencryptoki.pc to d/libopencryptoki-dev.install.
  * Add new config file ccatok.conf to d/opencryptoki.install.s390x.
  * Consolidate multiple /etc/opencryptoki/*.conf entries in
    d/opencryptoki.install to one line and make it more generic.
  * Migrate in d/rules from 'dh_install --fail-missing --sourcedir=debian/tmp'
    to 'dh_install --sourcedir=debian/tmp' and 'dh_missing --fail-missing'.
  * Update 'Standards-Version' field in d/control to latest version 4.6.1.0.
  * Expand the copyright year range in d/copyright relfecting the latest code.

 -- Frank Heimes <frank.heimes@canonical.com>  Mon, 13 Feb 2023 10:10:45 +0100

opencryptoki (3.18.0+dfsg-0ubuntu3) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 15 Dec 2022 19:52:07 +0000

opencryptoki (3.18.0+dfsg-0ubuntu2) kinetic; urgency=medium

  * Add quilt patch
    d/p/lp-1989558-common-fix-memory-leak-in-save_private_token_object.patch
    to fix a failure of opencryptoki C_GenerateKeyPair() that occurs after
    having generated more that 500 RSA keys with CEX7 and CEX8 crypto cards.
    (LP: #1989558)

 -- Frank Heimes <frank.heimes@canonical.com>  Wed, 14 Sep 2022 15:01:02 +0200

opencryptoki (3.18.0+dfsg-0ubuntu1) kinetic; urgency=medium

  * New upstream release, with:
    - minor adjustment in 01-disable-testcases.patch due to different context
    - remove of d/p/6759faed-EP11-Fix-host-library-version-query.patch 
      since it's now included in 3.18 upstream
    - remove file AUTHORS from debian/opencryptoki.docs
      since it got removed in 3.18 upstream
    This new version solves LP bugs (feature requests):
    - "openCryptoki: PKCS #11 3.1 - support CKA_DERIVE_TEMPLATE" (LP: #1982842)
    - "openCryptoki: support crypto profiles" (LP: #1959549)
    - "openCryptoki: add crypto counters" (LP: #1959551)
    - Assign pkcs11 group to p11sak_defined_attrs.conf and strength.conf
      in debian/opencryptoki.postinst rather than of Makefile.am
      to solve "invalid group ‘pkcs11’" issues during build.
      Also extend debian/opencryptoki.install and
      debian/opencryptoki.install.s390x to pick up
      /etc/opencryptoki/p11sak_defined_attrs.conf and
      /etc/opencryptoki/strength.conf.

 -- Frank Heimes <frank.heimes@canonical.com>  Mon, 15 Aug 2022 12:29:35 +0200

opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu2) kinetic; urgency=medium

  * d/p/6759faed-EP11-Fix-host-library-version-query.patch
    fixing fix inavailability of Dilithium support in OpenCryptoki >= 3.13
    with upgraded EP11 host library
    Thanks to Ingo Franzki (LP: #1973296)

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 13 May 2022 19:56:35 +0200

opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu1) jammy; urgency=medium

  * New upstream release LP: #1959419
    based on 3.17 + master (b40982e) at date 20220202
    - Update d/p/01-disable-testcases.patch
    - Refresh d/p/03-dlopen-soname.patch
    - Update and Refresh d/p/04-pkcsslotd-cmdline-args.patch
    - Drop lp1928780-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch
    - Add libudev-dev to d/control Build-Depends
    - Remove 'BSD' entry for usr/lib/pkcs11/aep_stdll/* from d/copyright,
      since this (sub-)folder got removed
    - Update relevant IBM license years in d/copyright
    - Remove testcases/crypto/abfunc.c from Files-Excluded in d/copyright,
      since it's clearly under IBM copyright, that is listed further down
    - Upstream 'doc' folder is now required and cannot be excluded anymore,
      hence changed Files-Excluded from doc to more specific doc/README.*
    - New version expands key management tool p11sak functionality,
      hence solves LP: #1959577

 -- Frank Heimes <frank.heimes@canonical.com>  Tue, 15 Feb 2022 09:30:48 +0100

opencryptoki (3.16.0+dfsg-0ubuntu3) jammy; urgency=medium

  * No-change rebuild against libica4

 -- Simon Chopin <simon.chopin@canonical.com>  Mon, 07 Feb 2022 16:44:49 +0100

opencryptoki (3.16.0+dfsg-0ubuntu2) jammy; urgency=medium

  * No-change rebuild against openssl3

 -- Simon Chopin <simon.chopin@canonical.com>  Tue, 07 Dec 2021 15:44:43 +0100

opencryptoki (3.16.0+dfsg-0ubuntu1) impish; urgency=medium

  * New upstream release (LP: #1928767)
    + Refresh d/p/03-dlopen-soname.patch
    + Drop patches merged upstream:
      - d/p/d15736b3d586518bfa2359e7eb28b90837b5de22.patch
      - d/p/821bc7ab4635e189d31bc3c808c626b9fcda5d02.patch
      - d/p/2d16f003911ceee50967546f4b3c7cac2db9ba86.patch
      - d/p/f1f176cbb4183bcb8a0f7b4d7f649d84a731dd43.patch
      - d/p/1e98001ff63cd7e75d95b4ea0d3d2a69965d8890.patch
  * d/copyright: only remove actually unlicensed files
  * Cherry-pick a fix from master (LP: #1928780)

 -- Simon Chopin <simon.chopin@canonical.com>  Mon, 26 Jul 2021 18:55:27 +0200

opencryptoki (3.15.1+dfsg-0ubuntu2) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 17:54:27 -0400

opencryptoki (3.15.1+dfsg-0ubuntu1) hirsute; urgency=medium

  * New upstream release LP: #1906369.
  * Add patch f1f176cbb4183bcb8a0f7b4d7f649d84a731dd43 fixing migration of a
    master key from OLD register to CURRENT register (LP: #1915517).
  * Add patch 2d16f003911ceee50967546f4b3c7cac2db9ba86 fixing compiling with
    c++.
  * Add patch 821bc7ab4635e189d31bc3c808c626b9fcda5d02 with error message
    handling for p11sak remove-key command.
  * Add patch 1e98001ff63cd7e75d95b4ea0d3d2a69965d8890 fixing a problem with
    C_Get/SetOperationState and digest contexts.

 -- Brian Murray <brian@ubuntu.com>  Mon, 22 Feb 2021 16:48:12 -0800

opencryptoki (3.14.0+dfsg-0ubuntu3) groovy; urgency=medium

  * Fix token migration and conversion LP: #1893216

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 17 Sep 2020 15:14:34 +0100

opencryptoki (3.14.0+dfsg-0ubuntu2) groovy; urgency=medium

  * Cherrypick fixes from master LP: #1854944

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 09 Jul 2020 15:36:36 +0100

opencryptoki (3.14.0+dfsg-0ubuntu1) groovy; urgency=medium

  * New upstream release LP: #1882808

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 18 Jun 2020 14:05:53 +0100

opencryptoki (3.13.0+dfsg-0ubuntu5) focal; urgency=medium

  * Enable locks by default, on all architectures, which is the new
    upstream default. Previously, only armhf used locks, and all other
    architectures used transactional memory (dispite --disable-locks
    option actually _enabling_ locks in the past)

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 03 Apr 2020 10:43:37 +0100

opencryptoki (3.13.0+dfsg-0ubuntu4) focal; urgency=medium

  * Fix build that disables locks.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 02 Apr 2020 16:13:35 +0100

opencryptoki (3.13.0+dfsg-0ubuntu1) focal; urgency=medium

  * New upstream release LP: #1858792, LP: #1853300

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 26 Feb 2020 17:26:37 +0000

opencryptoki (3.12.1+dfsg-0ubuntu1) focal; urgency=medium

  * New upstream release LP: #1854148, LP: #1852089, LP: #1850294

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 06 Feb 2020 14:59:50 +0000

opencryptoki (3.11.1+dfsg-0ubuntu3) focal; urgency=medium

  * Fix toleration of CEX7P and CEX6P cards, when both are present.
    (LP: #1847031)

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 22 Oct 2019 15:28:41 +0100

opencryptoki (3.11.1+dfsg-0ubuntu2) eoan; urgency=medium

  * Add TLS 1.3 mechanisms to the libica token.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 12 Aug 2019 13:03:54 +0100

opencryptoki (3.11.1+dfsg-0ubuntu1) eoan; urgency=medium

  * New upstream release LP: #1826193

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 30 Apr 2019 13:02:04 +0100

opencryptoki (3.11.0+dfsg-0ubuntu2) disco; urgency=medium

  * EP11: Fix target_list passing for EP11-session logon/logoff. LP:
    #1814521

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 21 Feb 2019 11:42:49 +0100

opencryptoki (3.11.0+dfsg-0ubuntu1) disco; urgency=medium

  * New upstream release LP: #1803994
  * Fix up debian/watch file
  * Refresh patches

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 10 Dec 2018 12:20:56 +1100

opencryptoki (3.10.0+dfsg-0ubuntu1) cosmic; urgency=medium

  * New upstream release. LP: #1776210

 -- Dimitri John Ledkov 🌈 <xnox@ubuntu.com>  Thu, 14 Jun 2018 10:11:14 +0100

opencryptoki (3.9.0+dfsg-0ubuntu2) cosmic; urgency=medium

  * Build without symbolic-functions, as that makes opencryptoki fail to
    load multiple tokens/plugins correctly.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 17 May 2018 12:01:17 +0100

opencryptoki (3.9.0+dfsg-0ubuntu1) bionic; urgency=medium

  * New upstream release LP: #1751272
  * Specify Format in debian/copyright
  * Drop custom dfsg script, and list directories to exclude in the
    debian/copyright file
  * libitm is not available on armhf, drop build-depends, and disable
    locks on armhf.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 26 Feb 2018 13:05:48 +0000

opencryptoki (3.8.2+dfsg-0ubuntu1) bionic; urgency=medium

  * New upstream release LP: #1742437
  * Drop upstreamed patches

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 08 Feb 2018 15:30:04 +0000

opencryptoki (3.8.1+dfsg-3build1) bionic; urgency=high

  * No change rebuild against openssl1.1.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 05 Feb 2018 22:32:53 +0000

opencryptoki (3.8.1+dfsg-3) unstable; urgency=emergency

  * Remove wrong tmpfiles.conf file present in systemd path. Closes: #881222
  * Updated install files.
  * Updated rules.

 -- Paulo Vital <pvital@gmail.com>  Thu, 09 Nov 2017 09:52:15 -0200

opencryptoki (3.8.1+dfsg-2) unstable; urgency=medium

  * Updated install files for s390x. Closes: #880657

 -- Paulo Vital <pvital@gmail.com>  Fri, 03 Nov 2017 09:23:52 -0200

opencryptoki (3.8.1+dfsg-1) unstable; urgency=medium

  * New upstream release
  * Removed patch 08-reset-tpm-structures.patch
  * Removed patch systemd-targets.patch
  * Added patch tmpfiles-dir-creation.patch
  * Added patch icsf-spelling.patch
  * Fix Lintian error build-depends-on-obsolete-package:
    Removed dh-systemd since used debhelper (>= 10)
  * Fix Lintian wanring useless-autoreconf-build-depends:
    removed autotools-dev
  * Updated Standards-Version to 4.1.1

 -- Paulo Vital <pvital@gmail.com>  Tue, 31 Oct 2017 10:16:06 -0200

opencryptoki (3.7.0+dfsg-4) unstable; urgency=medium

  * Fix broken links for libopencryptoki0. Closes: #866152, 640812
  * Change to compat level 10.
  * Update debian/rules with compat level 10 changes.

 -- Paulo Vital <pvital@gmail.com>  Tue, 27 Jun 2017 19:24:50 -0300

opencryptoki (3.7.0+dfsg-3) unstable; urgency=medium

  * Add libitm1 as build dependency to restrict arch. Closes: #865315

 -- Paulo Vital <pvital@gmail.com>  Tue, 20 Jun 2017 11:54:25 -0300

opencryptoki (3.7.0+dfsg-2) unstable; urgency=medium

  * Drop /etc/pkcs11 symlink. Closes: #864052
  * Enable Hardening
  * Update Standards-Version to 4.0.0
  * Fix quilt-patch-missing-description in systemd-targets.patch
  * Fix misspelling word in usr/lib/pkcs11/api/api_interfaces.c
  * Overrides Lintian possible-gpl-code-linked-with-openssl since the
    GPL code of the package is the debian files only.
  * experimental-to-unstable

 -- Paulo Vital <pvital@gmail.com>  Mon, 19 Jun 2017 10:41:50 -0300

opencryptoki (3.7.0+dfsg-1) experimental; urgency=medium

  * New upstream release.
  * Updated debian/watch and script to get releases from git repository.
  * Removed pacthes already applied upstream.

 -- Paulo Vital <pvital@gmail.com>  Fri, 26 May 2017 11:13:03 -0300

opencryptoki (3.6.2+dfsg-2) experimental; urgency=medium

  * Add support to MultiArch (debhelper >=9)
  * Fixed errors from Lintian
  * New maintainer. Closes: #543925

 -- Paulo Vital <pvital@gmail.com>  Thu, 09 Mar 2017 16:30:18 -0300

opencryptoki (3.6.2+dfsg-1) experimental; urgency=medium

  * New upstream release LP: #1666502

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 21 Feb 2017 14:57:28 +0000

opencryptoki (3.6.1+dfsg-1) unstable; urgency=medium

  * New upstream release.
  * Drop cherry-picked patches, included in this release.
  * Upload to unstable. Closes: #845729

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 03 Jan 2017 13:14:42 +0000

opencryptoki (3.6+dfsg-2) experimental; urgency=medium

  * Cherry-pick upstream patches for openssl 1.1 compat.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 14 Dec 2016 11:41:02 +0000

opencryptoki (3.6+dfsg-1) experimental; urgency=medium

  * QA upload.
  * New upstream release
  * Refresh patches
  * Set standards version to 3.9.8

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 28 Nov 2016 14:22:55 +0000

opencryptoki (3.5+dfsg-2) unstable; urgency=medium

  * QA upload.
  * Updated systemd-tmpfiles debian/opencryptoki.tmpfiles snippet to
    create TOK_OBJ per-token subdirectories with correct
    permissions. Upstream should probably ship tmpfiles snippet. LP:
    #1595192.
  * Import upstream patches to create/validate lock & lib directories for
    all tokens. LP: #1594386

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 16 Aug 2016 09:55:02 +0100

opencryptoki (3.5+dfsg-1) unstable; urgency=low

  * QA upload.
  * New upstream release.
  * Add extra symlink to the unversioned libopencrypto.so in the -dev
    package.
  * Add missing links for cca, ep11, icsf, and ica tokens.
  * New upstream release

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 19 Jul 2016 10:06:59 +0100

opencryptoki (3.4.1+dfsg-1) unstable; urgency=low

  * QA upload.
  * Update debian/watch file.
  * New upstream release
    - Resolves CVE-2012-4454
    - Resolves CVE-2012-4455
    - Closes: #689417
  * Drop applied upstream, or no longer applicable patches:
    - 02-disable-user-handling.patch
    - 05-build-fix-for-kbsd.patch
    - 06-add-whatis-entry-to-manpages.patch
    - 07-add-manpage-for-pkcs_slot.patch
    - 0009-Fix-wrong-LIB_PATH.patch
    - 0010-Remove-one-hardcoded-lib64-path.patch
  * Enable systemd units.
  * Drop pkcs11_startup call and opencryptoki provides from the init
    script, adjust PIDFILE location to /var/run/pkcsslotd.pid and source
    lsb init-functions.
  * Add bison and flex build dependencies.
  * Do not change group permissions during install stage of the package
    build.
  * Install new opencryptoki.conf config file.
  * Drop dbg package, rely on the autogenerated one instead.
  * Bump debhelper compat to 9.
  * Rename opencryptoki init file to pkcsslotd, to match actuall daemon
    started and the systemd unit name.
  * Don't use full-path check for deluser, instead just call it
    unconditionally on removal, it's guarded with || true anyway.
  * Patch spelling typos.
  * Drop After=syslog.target from systemd unit file.
  * Simplify 04-pkcsslotd-cmdline-args.patch.
  * Add tmpfiles snippet, and mimic same in the init.d script.
  * Add libica-dev build-dependency on s390x.
  * Set standards version to 3.9.6.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 08 Feb 2016 05:00:09 +0000

opencryptoki (2.3.1+dfsg-3) unstable; urgency=low

  * QA upload.
  * Fix pkcs11_startup module paths (Closes: #641080)

 -- Guido Trotter <ultrotter@debian.org>  Sat, 10 Sep 2011 09:20:39 +0100

opencryptoki (2.3.1+dfsg-2) unstable; urgency=low

  * QA upload.
  * Add patch to reset TPM datastructures on init, and not just logout,
    fixes TPM token reinitialization failure on reload.
    Thanks to David Smith for the patch (Closes: #603104, LP: #645576)

 -- Alessio Treglia <alessio@debian.org>  Tue, 26 Jul 2011 12:18:45 +0200

opencryptoki (2.3.1+dfsg-1) unstable; urgency=low

  * QA upload.

  [ Johann Felix Soden ]
  * New upstream release
  * Solving a FTBFS on GNU/kFreeBSD (Closes: #559405).
    - thanks to Cyril Brulebois <kibi@debian.org> for the prospective patch.
  * debian/rules:
   - Do no install /etc/ld.so.conf.d/opencryptoki-i486.conf
   - Creating instead soft-links in /usr/lib
  * Depending on autoconf, automake, libtool because of new upstream build
    procedure.
  * Adding small man-page for pkcs_slot and missing whereis entries.
  * Improving init script according to lintian.
  * Fixing wrong year in debian/copyright.
  * Adding get-orig-source target to debian/rules.
  * Adding watch file.
  * Removing the unnecessary "for Linux" from package descriptions.

  [ Alessio Treglia ]
  * Fix dangling symlinks in /usr/lib/pkcs11/ (Closes: #570527).

 -- Johann Felix Soden <johfel@gmx.de>  Sun, 05 Jun 2011 11:22:04 +0200

opencryptoki (2.2.8+dfsg-5) unstable; urgency=low

  * QA upload.
  * Get rid of unneeded *.la files (Closes: #622435).
  * Switch to 3.0 (quilt) format.
  * Bump debhelper build-dep to (>= 7.0.50~).
  * Use DH's autotools_dev addon to update config.{guess,sub} files rather
    than copy&and restore them in debian/rules.
  * Fix lintian "binary-control-field-duplicates-source field section in
    package opencryptoki" warning.
  * Bump Standards.

 -- Alessio Treglia <alessio@debian.org>  Fri, 03 Jun 2011 12:23:26 +0200

opencryptoki (2.2.8+dfsg-4) unstable; urgency=low

  * QA upload
  * Add root to the pkcs11 group (closes: #567572)

 -- Andrew Pollock <apollock@debian.org>  Mon, 08 Feb 2010 09:37:15 -0800

opencryptoki (2.2.8+dfsg-3) unstable; urgency=low

  * Removing vcs fields.
  * Orphaning package.

 -- Daniel Baumann <daniel@debian.org>  Thu, 27 Aug 2009 16:25:14 +0200

opencryptoki (2.2.8+dfsg-2) unstable; urgency=low

  * Updating maintainer field.
  * Updating vcs fields.
  * Updating package to standards version 3.8.2.
  * Sorting and updating depends.
  * Tidy debhelper install file.
  * Wrapping patch description in dlopen-soname.patch.
  * Minimizing rules file.

 -- Daniel Baumann <daniel@debian.org>  Fri, 14 Aug 2009 12:19:39 +0200

opencryptoki (2.2.8+dfsg-1) unstable; urgency=low

  * Merging upstream version 2.2.8+dfsg.
  * Correcting wrong libdir information.

 -- Daniel Baumann <daniel@debian.org>  Sun, 17 May 2009 15:51:08 +0200

opencryptoki (2.2.7+dfsg-1) unstable; urgency=low

  * Merging upstream version 2.2.7+dfsg.
  * Using correct rfc-2822 date formats in changelog.
  * Updating package to standards 3.8.1.
  * Removing old conflicts and replaces.
  * Using quilt rather than dpatch.
  * Updating section of debug packages.
  * Updating year in copyright file.
  * Updating rules to current state of the art.

 -- Daniel Baumann <daniel@debian.org>  Sun, 17 May 2009 14:41:13 +0200

opencryptoki (2.2.6+dfsg2-1) unstable; urgency=low

  * Replacing obsolete dh_clean -k with dh_prep.
  * Merging upstream version 2.2.6+dfsg2.

 -- Daniel Baumann <daniel@debian.org>  Fri, 07 Nov 2008 23:09:00 +0100

opencryptoki (2.2.6+dfsg-5) unstable; urgency=low

  * Updating vcs fields in control file.
  * Using patch-stamp rather than patch in rules file.
  * Adding patch from David Smith <dds@google.com> to add command line arguments
    for logging, verbosity, and daemonizing pkcsslotd.

 -- Daniel Baumann <daniel@debian.org>  Sat, 11 Oct 2008 20:01:00 +0200

opencryptoki (2.2.6+dfsg-4) unstable; urgency=medium

  * Don't FTBFS if automake is installed (Closes: #463760).

 -- Daniel Baumann <daniel@debian.org>  Wed, 03 Sep 2008 10:54:00 +0200

opencryptoki (2.2.6+dfsg-3) unstable; urgency=medium

  * Removing accidentally double files from libopencryptoki and opencryptoki
    (Closes: #492156).

 -- Daniel Baumann <daniel@debian.org>  Sun, 03 Aug 2008 15:19:00 +0200

opencryptoki (2.2.6+dfsg-2) unstable; urgency=medium

  * Applying patch from Philipp Matthias Hahn <pmhahn@debian.org> to
    correct init script and stop pkcsslotd (Closes: #463763).
  * Adding conflicts/replaces against previous version in order to allow
    upgrades from pre-frozen lenny to frozen/final lenny (Closes: #492156).

 -- Daniel Baumann <daniel@debian.org>  Sun, 27 Jul 2008 19:24:00 +0200

opencryptoki (2.2.6+dfsg-1) unstable; urgency=medium

  * Moving soname-independent symlinks for private library modules from
    libopencryptoki0 to opencryptoki
  * Updating 01-disable-testcases.dpatch for new upstream version.
  * Merging upstream version 2.2.6+dfsg.

 -- Daniel Baumann <daniel@debian.org>  Thu, 17 Jul 2008 23:12:00 +0200

opencryptoki (2.2.5+dfsg-2) unstable; urgency=high

  * Adding dh_link call in rules in order to get symlinks policy compliant.
  * Calling pkcs11_startup unconditionally in initscript (Closes: #459683).
  * Adding patch to the executables to open libopencryptoki with soname major
    (Closes: #463593).
  * Adding build-conflicts against automake1.9 (Closes: #463760).
  * Using less alarming 'skipping' rather than 'aborting' when not starting the
    daemon through the initscript.
  * Avoiding doublicated start-stop-daemon calls in restart section of the
    initscript.
  * Correcting start-stop-daemon call in order to create and use a pidfile in
    the initscript (Closes: #463763).
  * Updating cross handling in rules.
  * Moving soname-independent symlinks for private library modules from
    libopencryptoki-dev to libopencryptoki0 (Closes: #481453).
  * Updating to standards 3.8.0.
  * Reordering rules file.
  * Using lintian debhelper to install lintian overrides.
  * Rewriting copyright file in machine-interpretable format.
  * Adding vcs fields in control file.
  * Upgrading package to debhelper 7.
  * Reverting config.guess and config.sub to upstream.
  * Don't fail on removing non-empty group in postrm (Closes: #463764).

 -- Daniel Baumann <daniel@debian.org>  Wed, 02 Jul 2008 11:51:00 +0200

opencryptoki (2.2.5+dfsg-1) unstable; urgency=low

  * New upstream release (Closes: #459684).

 -- Daniel Baumann <daniel@debian.org>  Tue, 08 Jan 2008 07:01:00 +0100

opencryptoki (2.2.4.1+dfsg-2) unstable; urgency=low

  * Fixed changelog line wrapping.
  * Added manpages based on doc/*.
  * Added patch from William Lima <wlima.amadeus@gmail.com> to disable user
    handling in pkcs11_startup.

 -- Daniel Baumann <daniel@debian.org>  Thu, 27 Dec 2007 13:19:00 +0100

opencryptoki (2.2.4.1+dfsg-1) unstable; urgency=low

  * Initial release (Closes: #409586).
  * Rebuild upstream tarball without testcases (contains some unlicensed
    files), and a pdf in doc (missing source).

 -- Daniel Baumann <daniel@debian.org>  Wed, 05 Dec 2007 23:18:00 +0100
