dpkg (1.22.6ubuntu6.6) noble-security; urgency=medium

  * SECURITY UPDATE: infinite loop uncompressing a zstd-compressed .deb archive
    - lib/dpkg/compress.c: terminate zstd decompression when we have no
      more data.
    - 6610297a62c0780dd0e80b0e302ef64fdcc9d313
    - CVE-2026-2219

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 06 May 2026 13:38:18 -0400

dpkg (1.22.6ubuntu6.5) noble-security; urgency=medium

  [ Joy Latten ]
  * SECURITY UPDATE:
  - Fix cleanup for control member with restricted directories. LP: #2122053
  - Fixes CVE-2025-6297

 -- Serge Hallyn <serge.hallyn@ubuntu.com>  Thu, 18 Sep 2025 12:43:59 -0500

dpkg (1.22.6ubuntu6.2) noble; urgency=medium

  [ Zixing Liu ]
  * Add RUSTFLAGS to define frame pointers for Rust toolchain (LP: #2082636).
  * Replaces mainline version number 1.22.6ubuntu12 with 1.22.6ubuntu6.2 in
    the documentation to avoid confusion with backported version.

  [ Benjamin Drung ]
  * buildflags: document RUSTFLAGS
  * buildflags: Always set RUSTFLAGS

 -- Zixing Liu <zixing.liu@canonical.com>  Thu, 26 Sep 2024 13:14:01 -0600

dpkg (1.22.6ubuntu6.1) noble-security; urgency=medium

  * SRU:
    - Disable framepointer on ppc64el. LP: #2064539.
    - Disable framepointer on s390x, leaving only -mbackchain. LP: #2064538.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 17 Jul 2024 11:09:50 +0200

dpkg (1.22.6ubuntu6) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 30 Mar 2024 23:51:17 +0000

dpkg (1.22.6ubuntu5) noble; urgency=medium

  * Use -fcf-protection=none instead of -fno-cf-protection.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 26 Mar 2024 17:31:13 +0100

dpkg (1.22.6ubuntu4) noble; urgency=medium

  * Also revert the test case.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 18 Mar 2024 20:18:27 +0000

dpkg (1.22.6ubuntu3) noble; urgency=medium

  * Revert upstream change to enable -Werror=implicit-function-declaration
    by default on all archs: this makes it easier for developers to 
    reproduce build failures on armhf due to time_t, but at the cost of 
    increasing the number of build failures on non-armhf archs and also 
    introducing risk of misbuilds due to failing configure-time checks.  
    Users who need to reproduce armhf build failures can set 
    DEB_BUILD_OPTIONS=qa=+bug-implicit-func, and leaf packages that 
    fail to build only on armhf can be removed from
    the release.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 18 Mar 2024 19:58:54 +0000

dpkg (1.22.6ubuntu2) noble; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - Change native source version/format mismatch errors into warnings
      until the dust settles on Debian bug 737634 about override options.
    - Add DPKG_UNTRANSLATED_MESSAGES environment check so that higher-level
      tools can get untranslated dpkg terminal log messages while at the
      same time having translated debconf prompts.
    - Map unqualified package names of multiarch-same packages to the native
      arch instead of throwing an error, so that we don't break on upgrade
      when there are unqualified names stored in the dpkg trigger database.
    - Apply a workaround from mvo to consider ^rc packages as multiarch,
      during the dpkg consistency checks. (see LP: 1015567 and 1057367).
    - dpkg-gencontrol: Fix Package-Type override handling for ddeb support.
    - scripts/Dpkg/Vendor/Ubuntu.pm, scripts/dpkg-buildpackage.pl: set
      'nocheck' in build options by default on Ubuntu/riscv64.  Overridable
      in debian/rules with
      'DEB_BUILD_OPTIONS := $(filter-out nocheck,$(DEB_BUILD_OPTIONS))'.
    - dpkg-dev: Depend on lto-disabled-list.
    - dpkg-buildflags: Read package source names from lto-disabled-list,
      to build without lto optimizations. When adding a source package to the
      list, please also file a launchpad issue and tag it with 'lto'.
    - scripts/Dpkg/Vendor/Ubuntu.pm: set 'noudeb' build profile by
      default. Override this by exporting DEB_BUILD_PROFILE='!noudeb' which
      will be stripped, and thus building with udebs.
    - build: Switch default dpkg-deb compression from xz to zstd.
      Keep compressing dpkg.deb with xz to help bootstrapping on non-Ubuntu
      systems.
    - set default zstd compression level to 19
    - scripts/Dpkg/Vendor/Debian.pm: Always include "-fdebug-prefix-map"
      to build flags.  Map path to "/usr/src/PKGNAME-PKGVER" instead of
      ".", honouring the DWARF standard which prohibits relative paths
      in DW_AT_comp_dir.
    - scripts/{mk/buildflags.mk,t.mk}: Add support for DEB_BUILD_DEBUGPATH.
    - man/dpkg-buildflags.pod: Document new behaviour of "fdebugmap" and
      new DEB_BUILD_DEBUGPATH variable.
    - Disable -fstack-clash-protection on armhf since it causes crashes
    - dpkg-buildflags: Add a new feature "framepointer" in the "qa" area.
    - Turn on the use of frame pointers by default on 64bit architectures.
    - Update _FORTIFY_SOURCE documentation.
    - Update Dpkg_BuildFlags test case.
    - Fix debian/rules duplicate invocations of dh_builddeb
    - lib/dpkg/compress.c: clean up override of the default zstd compression
      level
    - dpkg-buildflags: Explicitly turn off hardening flags when requested.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 16 Mar 2024 07:45:39 +0100

dpkg (1.22.6) unstable; urgency=medium

  [ Guillem Jover ]
  * dpkg-deb: Fix up compressor parameters for default legacy format.
  * Perl modules:
    - Dpkg::Vendor::Debian: Make it possible to disable qa=-bug-implicit-func.
      Closes: #1065371
    - Dpkg::Vendor::Debian: Unconditionally set qa bug-implicit-func.
      See #1065371.
  * Documentation:
    - man: Document dpkg versions supporting SOURCE_DATE_EPOCH for various
      tools.
  * Code internals:
    - libdpkg: Use array access instead of pointer arithmetic for meminfo
      parser.
    - libdpkg: Use a macro to define the zstd default compression level.
  * Build system:
    - Test with minimal library dependencies in CI.
    - Add gen-release script.
  * Packaging:
    - Fix typo in man page reference in changelog.
  * Test suite:
    - Refactor OpenPGP backend and commands list.
    - Refactor certfile and keyfile filenames for OpenPGP test.
    - Skip OpenPGP tests if the backend does not have a verify command.
      Closes: #1065648
  * Localization:
    - Fix typos in Swedish man pages translations.
      Thanks to Andreas Rönnquist <gusnan@debian.org>. Closes: #1065672
    - Fix typos in Swedish man pages translations. Closes: #1065575
    - Update Dutch man pages translations.
      Thanks to Frans Spiesschaert <Frans.Spiesschaert@yucom.be>.
      Closes: #1065518
    - Update Portuguese man pages translations.
      Thanks to Américo Monteiro <a_monteiro@gmx.com>. Closes: #1065401

  [ Helge Kreutzmann ]
  * Localization:
    - Update German man pages translation.

 -- Guillem Jover <guillem@debian.org>  Sun, 10 Mar 2024 20:21:24 +0100

# For older changelog entries, run 'apt-get changelog dselect'
