gnupg2 (2.4.9-4ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2154019). Remaining changes:
    - Honor http_proxy= environment variables by default in the
      systemd user session dirmngr service
    - Don't build the gpgv-win32 package which only debian-installer
      uses
    - gnupg: Demote gnupg-l10n to Recommends
    - Demote all Recommends: gnupg to Suggests
    - Stop building gpg-wks-server, gpg-wks-client on i386
    - Demote gpg-wks-client to Recommends
    - gpg{,sm}: Recommend gpg-agent, dirmngr
    - Disable swtpm, libtss2-dev build-dep on i386
  * Drop Changes:
    - CVE-2025-68973.patch: fix memory corruption in armor parser
      [Fixed in 2.4.9-1]
    - CVE-2026-24882.patch: fix stack-based buffer overflow in tpm2daemon
      [Fixed in 2.4.9-2]

 -- Varun Varma <varun.varma@canonical.com>  Mon, 25 May 2026 18:37:47 -0400

gnupg2 (2.4.9-4) unstable; urgency=medium

  * Upload to unstable.

 -- Andreas Metzler <ametzler@debian.org>  Thu, 05 Mar 2026 13:06:49 +0100

gnupg2 (2.4.9-3) experimental; urgency=medium

  * Update to STABLE-BRANCH-2-4 HEAD.
  * Add explicit build-dependency on libc-dev-bin.  (Needed for future
    versions of dh_builtusing.) See
    https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2025-November/010393.html

 -- Andreas Metzler <ametzler@debian.org>  Sat, 28 Feb 2026 15:30:18 +0100

gnupg2 (2.4.9-2) experimental; urgency=low

  [ Andreas Metzler ]
  * Update gpg.fail Debian status info.
  * Highlight/exclude minisign issues.
  * Add accelerator keys for "Wrong" and "Correct".
    Patch from uostream GIT master. (Closes: #1126259)
  * Fix stack-based buffer overflow in tpm2daemon.  CVE-2026-24882 Patches
    (bugfix and regression) from upstream GIT master. (Closes: #1126631)

  [ Luca Boccassi ]
  * dirmngr: drop unused adduser dependency.
    None of the adduser binaries are used anymore, drop the dependency.
    The postinst that used it was removed shortly after it was
    introduced, by commit 279bf10f4e0ccf238710a0f9881e79f16420bcb4

 -- Andreas Metzler <ametzler@debian.org>  Sat, 21 Feb 2026 15:27:53 +0100

gnupg2 (2.4.9-1) experimental; urgency=medium

  * new upstream release
  * refresh patches, align with FreePG 2.4 series

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 30 Dec 2025 12:14:10 -0500

gnupg2 (2.4.8-6) experimental; urgency=medium

  * gpg: Do not use a default when asking for another output filename.
    https://gpg.fail/filename #2
    Unfuzzed patch from GIT master
  * Write up gpg.fail status in debian/gpg.fail.md
  * agent: Fix a memory leak.
    Patch from STABLE-BRANCH-2-4
  * Use CVE-2025-68973 patch from STABLE-BRANCH-2-4.
    Replace backported patchset from master with the
    newly available one on STABLE-BRANCH-2-4.
  * Upload to experimental to avoid delaying propagation of -5 to trixie.

 -- Andreas Metzler <ametzler@debian.org>  Tue, 30 Dec 2025 15:29:50 +0100

gnupg2 (2.4.8-5) unstable; urgency=high

  [ Salvatore Bonaccorso ]
  * common: Reformat some comments in iobuf.c
  * gpg: Fix possible memory corruption in the armor parser (CVE-2025-68973)
    (Closes: #1124221) https://gpg.fail/memcpy #5

  [ Andreas Metzler ]
  * Avoid potential downgrade to SHA1 in 3rd party key signatures.
    https://gpg.fail/sha1 #12
    Patch from STABLE-BRANCH-2-4
  * gpg: Error out on unverified output for non-detached signatures.
    https://gpg.fail/detached #1
    Patch from STABLE-BRANCH-2-4

 -- Andreas Metzler <ametzler@debian.org>  Mon, 29 Dec 2025 18:03:49 +0100

gnupg2 (2.4.8-4ubuntu3) resolute; urgency=medium

  * SECURITY UPDATE: stack-based buffer overflow in tpm2daemon
    - debian/patches/CVE-2026-24882.patch: fix possible buffer overflow in
      PKDECRYPT in tpm2d/tpm2.c.
    - CVE-2026-24882

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 29 Jan 2026 08:57:30 -0500

gnupg2 (2.4.8-4ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: Remote Code Execution
    - debian/patches/CVE-2025-68973.patch: gpg: Fix possible memory
      corruption in the armor parser.
    - CVE-2025-68973

 -- Allen Huang <allen.huang@canonical.com>  Mon, 05 Jan 2026 23:02:06 +0000

gnupg2 (2.4.8-4ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2130739). Remaining changes:
    - Honor http_proxy= environment variables by default in the systemd user
      session dirmngr service
    - Don't build the gpgv-win32 package which only debian-installer uses
    - gnupg: Demote gnupg-l10n to Recommends
    - Demote all Recommends: gnupg to Suggests
    - Stop building gpg-wks-server, gpg-wks-client on i386
    - Demote gpg-wks-client to Recommends instead
    - gpg{,sm}: Recommend gpg-agent, dirmngr
    - Disable swtpm, libss2-dev build-dep on i386

 -- Florent 'Skia' Jacquet <skia@ubuntu.com>  Wed, 05 Nov 2025 18:18:29 +0100

gnupg2 (2.4.8-4) unstable; urgency=medium

  * Make OpenPGP compliance mode require a self-sig for each UID
  * debian/watch: move to version 5
  * Drop Rules-Requires-Root: no (now the default)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 22 Oct 2025 16:39:23 -0400

gnupg2 (2.4.8-3) unstable; urgency=low

  [ Pino Toscano ]
  * Restrict the TPM integration to Linux, as it is available mostly there:
    - limit the libtss2-dev build dependency as linux-any
    - set the architecture of the tpm2daemon binary package as linux-any
    - suggest tpm2daemon in gpg-agent only on Linux
  * Enable the libusb-1.0-0-dev build dependency also on Hurd, as it is
    available now.
  * Limit the libpam-systemd suggest in gpg-agent, and dirmngr as linux-any,
    as systemd exists only on Linux.

 -- Andreas Metzler <ametzler@debian.org>  Thu, 21 Aug 2025 17:55:06 +0200

gnupg2 (2.4.8-2ubuntu2) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Fri, 05 Sep 2025 11:39:24 +0000

gnupg2 (2.4.8-2ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2120550). Remaining changes:
    - Honor http_proxy= environment variables by default in the systemd user
      session dirmngr service
    - Stop building gpg-wks-server, gpg-wks-client on i386
    - gnupg: Demote gnupg-l10n to Recommends
    - Demote all Recommends: gnupg to Suggests
    - Demote gpg-wks-client to Recommends instead
    - gpg{,sm}: Recommend gpg-agent, dirmngr
    - Don't build the gpgv-win32 package which only debian-installer uses
    - Disable swtpm, libss2-dev build-dep on i386

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Wed, 13 Aug 2025 13:03:16 +0200

gnupg2 (2.4.8-2) unstable; urgency=medium

  * Upload to unstable.

 -- Andreas Metzler <ametzler@debian.org>  Mon, 11 Aug 2025 13:45:57 +0200

gnupg2 (2.4.8-1) experimental; urgency=medium

  * New upstream version.
  * Drop cherry-picked patches, unfuzz.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 29 Jun 2025 14:12:41 +0200

gnupg2 (2.4.7-21ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Honor http_proxy= environment variables by default in the systemd user
      session dirmngr service
    - Stop building gpg-wks-server, gpg-wks-client on i386
    - gnupg: Demote gnupg-l10n to Recommends
    - Demote all Recommends: gnupg to Suggests
    - Demote gpg-wks-client to Recommends instead
    - gpg{,sm}: Recommend gpg-agent, dirmngr
    - Don't build the gpgv-win32 package which only debian-installer uses
    - Disable swtpm, libss2-dev build-dep on i386

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Fri, 18 Jul 2025 16:10:08 +0200

gnupg2 (2.4.7-21) unstable; urgency=medium

  * update Dutch po file (Closes: #1104540)
  * Upload to unstable.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 01 Jun 2025 06:45:25 +0200

gnupg2 (2.4.7-20) experimental; urgency=medium

  * Add Built-Using/Static-Built-Using data for gpgv-static
    (Thanks, Aurelien Jarno) Closes: #1106800
  * Also set Built-Using for gpgv-win32

 -- Andreas Metzler <ametzler@debian.org>  Sat, 31 May 2025 12:55:36 +0200

gnupg2 (2.4.7-19) unstable; urgency=medium

  * Upload to unstable.

 -- Andreas Metzler <ametzler@debian.org>  Wed, 14 May 2025 06:22:05 +0200

gnupg2 (2.4.7-18) experimental; urgency=medium

  [ Daniel Kahn Gillmor ]
  * Handle certification-only pubkeys correctly (Closes: #1101007)

  [ Andreas Metzler ]
  * Cherry-pick fixes from upstream STABLE-BRANCH-2-4:
    + Fix key generation with existing key from card.
      (2.4.7 regression) https://dev.gnupg.org/T7457
    + gpgconf: Fix reload and kill of keyboxd
      https://dev.gnupg.org/T7569
    + keyboxd: Convert upper-case email-address search string to lower-case
      https://dev.gnupg.org/T7576
    + Fix use of undefined behavior in ksba-io-support.c
      (Use memchr since calling strchr on a non-NUL terminated string is
      undefined behavior.)
    + Fix --list-filter select='disabled-f'.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 11 May 2025 13:04:10 +0200

gnupg2 (2.4.7-17ubuntu3) questing; urgency=medium

  * Do not build tpm2daemon on i386

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 09 May 2025 21:07:52 +0200

gnupg2 (2.4.7-17ubuntu2) questing; urgency=medium

  * Disable swtpm, libss2-dev build-dep on i386

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 09 May 2025 20:15:39 +0200

gnupg2 (2.4.7-17ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Honor http_proxy= environment variables by default in the systemd user
      session dirmngr service
    - Stop building gpg-wks-server, gpg-wks-client on i386
    - gnupg: Demote gnupg-l10n to Recommends
    - Demote all Recommends: gnupg to Suggests
    - Demote gpg-wks-client to Recommends instead
    - gpg{,sm}: Recommend gpg-agent, dirmngr
    - Don't build the gpgv-win32 package which only debian-installer uses
  * Dropped changes, merged in Debian:
    - Cherry-pick Debian commit on git c4d2593b178de88ce22004d78a116f977f9bc5d6
    - revert-rfc4880bis.patch; Debian imported more elaborate freepg patchset
    - Dropped build dependencies for t64 rebuilds; those have been dealt with
      using build profiles in Debian.
    - Do not use keyboxd by default (merged in Debian)
    - Suggest keyboxd, keyboxd is now in the gpg package.
    - debian/migrate-pubring-from-classic-gpg: Add 2.4 to allowlist
    - d/tests/simple-tests: Use RSA keys for now.
  * Dropped changes, merged upstream:
    - CVE-2025-30258 security patchews
    - FTBFS fixes, all applied upstream
    - The --assert-pubkey_algo feature patch

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 09 May 2025 19:31:41 +0200

gnupg2 (2.4.7-17) unstable; urgency=medium

  * re-enable piuparts in salsa-ci, keyboxd package is no more.
  * disable missing-breaks salsa ci. (fp: gpg-from-sq)
  * Add pkg.gnupg2.gpgvonly build profile. (Thanks, Helmut Grohne)
    Closes: #1104210

 -- Andreas Metzler <ametzler@debian.org>  Mon, 28 Apr 2025 18:13:47 +0200

gnupg2 (2.4.7-16) unstable; urgency=medium

  * Hardcode the list of archs where swtpm is available (Closes: #1103931)

 -- Andreas Metzler <ametzler@debian.org>  Sat, 26 Apr 2025 16:19:09 +0200

gnupg2 (2.4.7-15) unstable; urgency=medium

  [ Andreas Metzler ]
  * Fix typo in gpg's README.Debian
  * Skip debian-archive-trixie-stable.gpg in ci migration test
  * Add NEWS entry for smartcard related changes in 2.4. (Closes: #1102717)

  [ Daniel Kahn Gillmor ]
  * d/tests/migration: use *.pgp instead of *.gpg

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 15 Apr 2025 23:06:01 -0400

gnupg2 (2.4.7-14) unstable; urgency=medium

  * gpgv: Avoid dependencies on npth and libassuan
    (Closes: #1102621)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 11 Apr 2025 18:50:53 -0400

gnupg2 (2.4.7-13) unstable; urgency=medium

  * Release to unstable
  * d/tests/verify-openpgp: allow stderr
  * override warning about FreePG README
  * d/changelog: merging in old entries

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 10 Apr 2025 15:12:43 -0400

gnupg2 (2.4.7-12) experimental; urgency=medium

  * d/tests/verify-openpgp: add test to ensure default output of
    OpenPGP-compatible data
  * Standards-Version: bump to 4.7.2 (no changes needed)
  * Forward no-keyboxd.patch upstream

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 08 Apr 2025 13:20:39 -0400

gnupg2 (2.4.7-11) experimental; urgency=medium

  * Drop duplicate systemd-user files in gnupg/examples/
  * Add CVE number to 2.4.7-5 changelog entry
  * Also remove duplicate dirmngr and keyboxd systemd files
  * Formatting fixes for migrate-pubring-from-classic-gpg.1
    (Thanks to Bjarni Ingi Gislason) Closes: #1100793
  * Revert FreePG patch for CSF newline cleanup. Closes: #1101011

 -- Andreas Metzler <ametzler@debian.org>  Mon, 31 Mar 2025 18:04:35 +0200

gnupg2 (2.4.7-10) experimental; urgency=medium

  * Do not set use-keyboxd when initializing ~/.gnupg/ (Patch copied from
    Ubuntu.)
  * Patch from -7 (Verify text-mode signatures ...) included in FreePG,
    rename.

 -- Andreas Metzler <ametzler@debian.org>  Mon, 17 Mar 2025 18:22:04 +0100

gnupg2 (2.4.7-9) experimental; urgency=medium

  * avoid a double-free (pulled from STABLE-BRANCH-2-4 upstream)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 13 Mar 2025 10:12:31 -0400

gnupg2 (2.4.7-8) experimental; urgency=medium

  * Avoid regression on sig verification for expired or revoked keys
    (Closes: #1099141)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 07 Mar 2025 13:54:17 -0500

gnupg2 (2.4.7-7) experimental; urgency=medium

  * Merge FreePG changes
  * Support large RSA keygen in non-batch mode (following FreePG)
  * Verify text-mode signatures over binary literal data packets

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 05 Mar 2025 16:25:05 -0500

gnupg2 (2.4.7-6) experimental; urgency=medium

  * refresh patches from FreePG (adopted OpenPGP compliance)
  * refresh non-FreePG patches
  * lintian-override for filename of distsigkey.gpg
  * override Lintian warning about unused FreePG gitlab CI

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 26 Feb 2025 17:21:31 -0500

gnupg2 (2.4.7-5) experimental; urgency=medium

  [ Andreas Metzler ]
  * Refresh patches from FreePG
  * Two more patches accepted by FreePG, adapt patch series.

  [ Daniel Kahn Gillmor ]
  * Align CSF generation and verification with standard
  * Avoid DoS on signature verification. CVE-2025-30258

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 21 Feb 2025 17:24:15 -0500

gnupg2 (2.4.7-4) experimental; urgency=medium

  [ Daniel Kahn Gillmor ]
  * Note relationship between tpm2daemon and gpg-agent
  * patch 21: use git format-patch style attribution
  * keyboxd.socket: drop FileDescriptorName, not needed
  * override lintian tag spare-manual-page on keyboxd.1
  * drop GSM_SKIP_SSH_AGENT_WORKAROND hack

  [ Andreas Metzler ]
  * block-ptrace-on-secret-daemons accepted into FreePG, rename.
  * Tag patch as forwarded

  [ Daniel Kahn Gillmor ]
  * move keyboxd into the gpg package (Closes: #1095451)
  * Emit only OpenPGP artifacts by default
  * Modernize reasoning for KOO as default keyserver
  * consolidate ssh-agent emulation socket changes in snyc with FreePG proposal
  * Disallow compressed signatures and certificates: point to FreePG proposal

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Sat, 08 Feb 2025 01:26:40 -0500

gnupg2 (2.4.7-3) experimental; urgency=medium

  [ Jonathan McDowell ]
  * Enable tpm2daemon for TPM backed keys (Closes: #1058571)

  [ Daniel Kahn Gillmor ]
  * Stop shipping CA certificate for SKS pool
  * Disallow compressed signatures and certificates (thanks, Demi Marie
    Obenour!)
  * swtpm is only needed during build for tests
  * tpm2daemon: tweak grammar in package description
  * run tests serially due to TPM port collisions

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 28 Jan 2025 18:17:36 -0500

gnupg2 (2.4.7-2) experimental; urgency=medium

  [ Richard Hansen ]
  * debian/control: Allow backported libgpg-error-mingw-w64-dev
  * debian/Xsession.d/90gpg-agent: Add comment explaining GPG_AGENT_INFO
  * gpg-agent.socket: Set GPG_AGENT_INFO in systemd for gnupg1

  [ Daniel Kahn Gillmor ]
  * use FreePG variants of relevant patches
  * move the FreePG patches to the beginning
  * refresh FreePG

  [ Andreas Metzler ]
  * Enable freepg patch Ship-sample-systemd-unit-files.patch
  * Import keyboxd systemd support files into a patch
  * Import improvements to systemd files into patches
  * Use/install systemd files from (patched) source.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 26 Jan 2025 13:25:38 +0100

gnupg2 (2.4.7-1) experimental; urgency=medium

  * New upstream version.
    + Drop cherry-picked patch.
    + Fixes change of binary representation of Ed25519 OpenPGP signature
      packets on export/import. Closes: #1087821

 -- Andreas Metzler <ametzler@debian.org>  Sat, 30 Nov 2024 11:49:02 +0100

gnupg2 (2.4.6-1) experimental; urgency=medium

  * New upstream version.
  * Drop superfluous patches
    001-gpg-Minor-fix-when-building-with-disable-exec.patch and
    restore-nl.po.patch .
  * Ship new binary in gpg-mail-tube in gnupg-utils.
  * Run wrap-and-sort -ast
  * Rename debian/keyboxd.8 to .1 to match section in .TH command
  * Add patch to avoid installing gnupg.7.html into mandir.
  * Do not err on importing rev-cert for expired key.
    Cherry-picked 48aa9e82657902ceb7ef081c6c55adbea5dd0217 from upstream GIT
    master. (Closes: #1086140)
  * Add myself to uploaders.
  * Update copyright info for 2.4.6

 -- Andreas Metzler <ametzler@debian.org>  Mon, 04 Nov 2024 07:16:37 +0100

gnupg2 (2.4.5-3) experimental; urgency=medium

  [ Daniel Kahn Gillmor ]
  * autopkgtest: Add a test for #1071552

  [ Richard Hansen ]
  * d/gpg-agent.gpg-agent-ssh.user.socket: Only set the SSH_AUTH_SOCK
    environment variable if gpg-agent's enable-ssh-support option is enabled
    (in ~/.gnupg/gpg-agent.conf).  This prevents gpg-agent from overriding
    ssh-agent (from the openssh-client package) unless the user explicitly
    requests it. (Closes: #1078787)

  [ Andreas Metzler ]
  * Pull upstream fix to fix FTBFS with gcc 14. Closes: #1078870
  * Bump libgpg-error-mingw-w64-dev b-d to get fixed 1.50 version.
    Closes: #1081807

 -- Andreas Metzler <ametzler@debian.org>  Mon, 16 Sep 2024 18:17:09 +0200

gnupg2 (2.4.5-2) experimental; urgency=medium

  [ Andreas Metzler ]
  * Team upload.
  * Demote gnupg metapackage dependency on gpg-wks-server to Suggests since it
    pulls in an MTA. Closes: #1070879
  * Build with --enable-maintainer-mode and re-add b-d on librsvg2-bin.
  * Merge unstable changelog.
  * Drop b-d on transfig, it is provided by fig2dev.
  * Add patches to avoid setting AEAD: OCB key-preference on generated keys
    and to avoid using OCB-mode even if AEAD: OCB key preference is set
    on recipient key.
  * Version imagemagick b-d to prevent installation of
    graphicsmagick-imagemagick-compat instead.
  * Fix blhc test with 'blhc: ignore-line-regexp'.
  * Disable piuparts CI test, it is thrown by having to test upgrade/downgrade
    (because some parts of gpg are installed by default) with additional
    compilation that the package set has grown by keyboxd.

  [ Daniel Kahn Gillmor ]
  * Standards-Version: bump to 4.7.0 (no changes needed)
  * d/copyright: Update dates, add Andreas Metzler for debian/*
  * d/changelog: correct old misspelling of "ghostscript"
  * Generate documentation artifacts from source, respecting nodoc
  * Stop shipping upstream ChangeLog (/usr/share/doc/*/changelog.gz)
  * Use debian standard UnicodeData.txt
  * Rebuild generated header files in common/
  * Strip Changelog-2011 files when building too
  * Restore nl.po
  * Enable Salsa-Ci (MR !16 by Otto Kekäläinen)
  * Port scripts from bash to /bin/sh (MR !10 by
    наб <nabijaczleweli@nabijaczleweli.xyz>).
  * Move the gnupg package into the metapackages section.
  * Move gpgv, gnupg-utils, and gpg-wks-client from Depends into Recommends
    of gnupg.
  * Stop pointing VCS-GIT at non-existent debian/main branch. (MR !12 by наб
    <nabijaczleweli@nabijaczleweli.xyz>)

 -- Andreas Metzler <ametzler@debian.org>  Mon, 20 May 2024 11:00:57 +0200

gnupg2 (2.4.5-1) experimental; urgency=low

  * Team upload.
  * New upstream version.
    + Drop spelling-fixes.diff, included upstream.
  * [lintian] B-d on pkgconf instead of pkg-config.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 16 Mar 2024 11:16:01 +0100

gnupg2 (2.4.4-4) experimental; urgency=low

  * Team upload.
  * Turn debian/gnupg-l10n.install into an executable that parses
    $DEB_BUILD_PROFILES. This seems to be the only working solution to avoid
    bad interaction of dh_install/dh_missing with nodoc.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 09 Mar 2024 14:40:53 +0100

gnupg2 (2.4.4-3) experimental; urgency=low

  * Team upload.
  * gpgcompose cleanup, drop orphaned manpage and mention in package
    description.
  * Fix autopkgtests, mr!14. (Thanks, Julian Andres Klode)
  * Add support for nodoc build-profile to ease bootstrapping.
    Closes: #980768

 -- Andreas Metzler <ametzler@debian.org>  Sat, 09 Mar 2024 09:13:09 +0100

gnupg2 (2.4.4-2ubuntu24) questing; urgency=medium

  * Cherry-pick Debian commit on git c4d2593b178de88ce22004d78a116f977f9bc5d6,
    to fix autopkgtests failures with new debian-archive-keyring

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 01 May 2025 21:01:27 +0200

gnupg2 (2.4.4-2ubuntu23) plucky; urgency=medium

  * SECURITY UPDATE: verification DoS via crafted subkey data
    - debian/patches/CVE-2025-30258-1.patch: lookup key for merging/
      inserting only by primary key in g10/getkey.c, g10/import.c,
      g10/keydb.h.
    - debian/patches/CVE-2025-30258-2.patch: remove a signature check
      function wrapper in g10/mainproc.c, g10/packet.h, g10/sig-check.c.
    - debian/patches/CVE-2025-30258-3.patch: fix a verification DoS due to
      a malicious subkey in the keyring in g10/getkey.c, g10/gpg.h,
      g10/keydb.h, g10/mainproc.c, g10/packet.h, g10/sig-check.c.
    - debian/patches/CVE-2025-30258-4.patch: fix regression for the recent
      malicious subkey DoS fix in g10/getkey.c, g10/packet.h.
    - debian/patches/CVE-2025-30258-5.patch: fix double free of internal
      data in g10/sig-check.c.
    - CVE-2025-30258

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 28 Mar 2025 11:23:49 -0400

gnupg2 (2.4.4-2ubuntu22) plucky; urgency=medium

  * Don't build the gpgv-win32 package which only debian-installer uses

 -- Adrien Nader <adrien.nader@canonical.com>  Fri, 10 Jan 2025 14:24:01 +0100

gnupg2 (2.4.4-2ubuntu21) plucky; urgency=medium

  * revert-rfc4880bis.patch: Revert the "LibrePGP" changes that introduce
    the standards-incompatible v5 keyformat and others by default.

 -- Julian Andres Klode <juliank@ubuntu.com>  Wed, 04 Dec 2024 10:25:09 +0100

gnupg2 (2.4.4-2ubuntu20) plucky; urgency=medium

  * debian/patches/fix-disable-exec-ftbfs.patch: Fix FTBFS on amd64 by
    dropping this previous patch which appears to not be needed anymore.
  * debian/patches/fix-return-in-void-function.patch: Add minimal patch to
    remove erroneous return statement in g10/photid.c which results in
    FTBFS due to -Wreturn-mismatch (LP: #2090843)

 -- Alex Murray <alex.murray@canonical.com>  Tue, 03 Dec 2024 10:40:26 +1030

gnupg2 (2.4.4-2ubuntu19) plucky; urgency=medium

  * Rebuild against latest libassuan

 -- Jeremy Bícha <jbicha@ubuntu.com>  Thu, 21 Nov 2024 10:40:56 -0500

gnupg2 (2.4.4-2ubuntu18) oracular; urgency=medium

  * debian/patches/fix-disable-exec-ftbfs.patch: Fix FTBFS. Minor fix when
    building with --disable-exec. Also remove get_max_fds() from
    exechelp-w32.c since this function definition is already part of
    gpg-error.h

 -- Nishit Majithia <nishit.majithia@canonical.com>  Thu, 22 Aug 2024 12:28:14 +0530

gnupg2 (2.4.4-2ubuntu17) noble; urgency=medium

  * No-change rebuild against libnpth0t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 06 Apr 2024 16:25:03 +0000

gnupg2 (2.4.4-2ubuntu16) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 00:07:54 +0000

gnupg2 (2.4.4-2ubuntu15) noble; urgency=medium

  * Also drop build dependency on libcurl4-gnutls-dev.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Mar 2024 10:32:56 +0100

gnupg2 (2.4.4-2ubuntu13) noble; urgency=medium

  * Old drop build dependency on ghostscript, only used in maintainer mode.
  * Rebuild with gnutls28 t64 packages.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 06 Mar 2024 09:31:32 +0100

gnupg2 (2.4.4-2ubuntu11) noble; urgency=medium

  * Drop imagemagick & transfig build dependency,
    only used in maintainer mode.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 05 Mar 2024 10:39:06 +0100

gnupg2 (2.4.4-2ubuntu9) noble; urgency=medium

  * d/p/no-keyboxd.patch: Do not use keyboxd by default
  * gpg{,sm}: Recommend gpg-agent, dirmngr; suggest keyboxd

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 01 Mar 2024 09:25:55 +0100

gnupg2 (2.4.4-2ubuntu8) noble; urgency=medium

  * Regenerate status-codes.h and reenable --assert-pubkey_algo (LP: #2055193)

 -- Julian Andres Klode <juliank@ubuntu.com>  Wed, 28 Feb 2024 13:35:53 +0100

gnupg2 (2.4.4-2ubuntu7) noble; urgency=medium

  * Fix a typo: Syntax error in Recommends: gpg-wks-client

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 22 Feb 2024 19:36:17 +0100

gnupg2 (2.4.4-2ubuntu6) noble; urgency=medium

  * Demote gpg-wks-client to Recommends instead

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 22 Feb 2024 19:19:54 +0100

gnupg2 (2.4.4-2ubuntu5) noble; urgency=medium

  * Do not depend on gpg-wks-client on i386

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 22 Feb 2024 19:06:44 +0100

gnupg2 (2.4.4-2ubuntu4) noble; urgency=medium

  * Stop building gpg-wks-server, gpg-wks-client on i386

 -- Julian Andres Klode <juliank@ubuntu.com>  Wed, 21 Feb 2024 16:22:49 +0100

gnupg2 (2.4.4-2ubuntu3) noble; urgency=medium

  * debian/migrate-pubring-from-classic-gpg: Add 2.4 to allowlist
  * d/tests/simple-tests: Use RSA keys for now.
    'default' key type does not work in batch mode anymore due to needing two
    subkeys (ed25519 for signing, and cv25519 for encryption).
  * gnupg: Demote gpg-wks-server to Suggests.
    We don't want this installed by default, it pulls in an mta, and we don't
    host wks servers by default.
  * gnupg: Demote gnupg-l10n to Recommends.
    Translations are nice, but I want to be able to remove them on
    an English system without breaking Depends.
  * Demote all Recommends: gnupg to Suggests.
    If we selectively install a specific part of gpg it should not
    by default pull in the entire suite again.

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 16 Feb 2024 11:03:09 +0100

gnupg2 (2.4.4-2ubuntu2) noble; urgency=medium

  * Disable add-option-assert-pubkey_algo.patch for now

 -- Julian Andres Klode <juliank@ubuntu.com>  Tue, 13 Feb 2024 12:08:30 +0100

gnupg2 (2.4.4-2ubuntu1) noble; urgency=medium

  * Merge with Debian experimental. Remaining changes:
    - Honor http_proxy= environment variables by default in the systemd
      user session dirmngr service.
    - Drop the gpgv-win32 test
  * The dirmngr change now patches debian/dirmngr.user.service directly
  * Import upstream patch gpg: Add option --assert-pubkey_algo

 -- Julian Andres Klode <juliank@ubuntu.com>  Tue, 13 Feb 2024 10:44:42 +0100

gnupg2 (2.4.4-2) experimental; urgency=low

  * Fix binary-all FTBFS by running a regular build for arch-all builds.
    Otherwise the test suite was run against /usr/bin/gpg for
    binary-all builds and failed if it was missing.
  * Drop now unused (gpgcompose was removed upstream) build with
    --enable-maintainer-mode.
  * Speed up indep build by only running needed dh_auto_configure instances.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 28 Jan 2024 09:02:36 +0100

gnupg2 (2.4.4-1) experimental; urgency=low

  * Team upload.
  * Drop transitional gpgv2 package (requested in #873186) and update CI
    test dependencies. Also remove Breaks/Replaces against ancient
    (pre-buster) versions of gpgv2.
  * Drop Breaks/Replaces against ancient versions of gnupg/gnupg2.
  * Delete keyboxd's Breaks/Replaces against gnupg2 - They are not needed.
  * Update CI test dependencies (gnupg2 --> gnupg).
  * New upstream version.
    + Drop from-master/keep-the-status-output.patch, unfuzz
      Use-hkps-keys.openpgp.org-as-the-default-keyserver.patch.
    + Update gnutls b-d version requirement.
    + Update debian/copyright.
    + spelling-fixes.diff: Fix errors found by lintian.
  * Fixup recommends of architecture-any packages on architecture-all package
    "gnupg" to use (= ${source:Version}) instead of binary:Version. (Thanks,
    James McCoy) Closes: #1060366
  * Set --with-mailprog=/usr/sbin/sendmail and add a dependency on
    default-mta | mail-transport-agent to gpg-wks-server. Closes: #1025782
  * Run wrap-and-sort -ast.

 -- Andreas Metzler <ametzler@debian.org>  Sat, 27 Jan 2024 13:44:25 +0100

gnupg2 (2.4.3-2) experimental; urgency=low

  * Duplicate lintian override for embedded-library in gpgv-static in old
    lintian syntax to avoid auto-reject.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 24 Sep 2023 19:09:42 +0200

gnupg2 (2.4.3-1) experimental; urgency=low

  [ Andreas Metzler ]
  * Team upload.
  * New upstream version.
    + Update patch-queue.
    + Ship /usr/lib/gnupg/gpg-auth in scdaemon package.
    + Tighten b-d as required.
    + gpg-zip script dropped, bugreport therefore irrelevant. Closes: #913060
    + Also drop unused debian/gpg-zip.1.
    + systemd user unit examples dropped upstream (2.4.1).
  * Merge changes from stable uploads after 2.2.27-2.
  * Drop unused b-d on libcurl4-gnutls-dev. (See #980768, the other to be
    removed b-ds could be necessary if at some point the respective doc
    sources were patched in the Debian package.)
  * Drop autopkgtests explicit dependency on essential package diffutils.
    Closes: #953570
  * Support the noudeb build profile. (Closes: #1024921) (Thanks, Helmut
    Grohne)
  * Drop dirmngr dependency on lsb-base. (Empty transitional package
    depending on essential package)
  * Drop unused lintian overrides for gpg-wks-client.1.
  * Run wrap-and-sort -ast.

  [ Bastien Roucariès ]
  * Improve systemd integration for gpg-agent SSH emulation.

  [ NIIBE Yutaka ]
  * Fix debian/gpg-agent.install (not including keyboxd).
  * Update debian/patches/series for gpg-agent-idling.
  * Add gpg-agent-idling patch set from upstream (delete old implimatation).
  * Update debian/patches/series for three patches of the following.
  * Recover the behavior of BEGIN_ENCRYPTION status output.
    - from-master/keep-the-status-output.patch: New.
  * debian/control (keyboxd): New package.
  * Add keybox systemd support.
    - Add debian/keyboxd.user.service.
    - Add debian/keyboxd.user.socket.
    - debian-packaging/keyboxd-systemd-support.patch: New.
    - debian/keyboxd.8: New.
    - debian/keyboxd.README.Debian: New.
    - debian/keyboxd.install: New.
    - debian/keyboxd.manpages: New.
  * Recover systemd-user support.
    - Add debian/*.user.service.
    - Add debian/*.user.socket.
    - debian/rules (override_dh_installsystemduser): New.
    - debian-packaging/keep-systemd-support.patch: New.

 -- Andreas Metzler <ametzler@debian.org>  Sun, 24 Sep 2023 14:44:27 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog gnupg-l10n`.
