krb5 (1.22.1-2ubuntu4) resolute; urgency=medium

  * d/p/default-enctype-list.patch: do not default to weak encryption
    algorithms (LP: #2144909)
  * d/NEWS: explain weak algorithms are no longer default options

 -- Athos Ribeiro <athos@ubuntu.com>  Thu, 19 Mar 2026 10:48:16 -0300

krb5 (1.22.1-2ubuntu3) resolute; urgency=medium

  * d/p/fix-strchr-conformance-to-c23.patch: Fix FTBFS with glibc2.43
    (LP: #2142893)

 -- Guilherme Puida Moreira <guilherme.moreira@canonical.com>  Wed, 04 Mar 2026 10:15:11 -0300

krb5 (1.22.1-2ubuntu2) resolute; urgency=medium

  * Fix FTBFS test t_otp.py (LP: #2142451):
    - d/p/set-fork-start-method-t-otpy.patch: Python 3.14 changes the default
      start method of multiprocessing to 'forkserver'. This introduces issues
      in the test t_otp.py that does not use a main block. Set the start
      method to force 'fork' instead.

 -- Simon Johnsson <simon.johnsson@canonical.com>  Mon, 23 Feb 2026 11:02:32 +0100

krb5 (1.22.1-2ubuntu1) resolute; urgency=medium

  * Add autopkgtest for includedir-ordering (LP: #2037321):
    - d/tests/includedir-ordering: Add new test.
    - d/tests/kinit: Create /etc/krb5.conf.d/ directory if it doesn't exist.
    - d/tests/util: Prepend includedir /etc/krb5.conf.d/ for the configuration
      file created in create_realm.

 -- Simon Johnsson <simon.johnsson@canonical.com>  Thu, 12 Feb 2026 16:15:24 +0100

krb5 (1.22.1-2) unstable; urgency=medium

  * Release to unstable

 -- Sam Hartman <hartmans@debian.org>  Fri, 14 Nov 2025 08:18:38 -0700

krb5 (1.22.1-1) experimental; urgency=medium

  * New upstream version
    - Builds with gcc-15, Closes: #1097099
  * Update symbols files

 -- Sam Hartman <hartmans@debian.org>  Tue, 07 Oct 2025 16:28:29 -0600

krb5 (1.21.3-5) unstable; urgency=medium

  * Non-maintainer upload with maintainer agreement.
  * Fix CVE-2025-24528: Prevent overflow when calculating
    ulog block size (Closes: #1094730)

 -- Bastien Roucariès <rouca@debian.org>  Sun, 23 Feb 2025 17:12:14 +0000

krb5 (1.21.3-4) unstable; urgency=medium

  [ Fabio Pedretti ]
  * fix bug closing syntax

  [ Sam Hartman ]
  * Do not set ownership in debian/rules so we can work without fakeroot,
  Thanks Guillem Jover for patch and for pointing out that setuid for ksu
  will still work, Closes: #1092384
  * Update standards-version to 4.7.0 (no change)
  * build-depend on pkgconf not pkg-config

 -- Sam Hartman <hartmans@debian.org>  Thu, 16 Jan 2025 11:26:01 -0700

krb5 (1.21.3-3) unstable; urgency=medium

  * Fix sysconfdir in call to configure, broken in previous upload, Closes: #1075813

 -- Sam Hartman <hartmans@debian.org>  Fri, 05 Jul 2024 11:25:26 -0600

krb5 (1.21.3-2) unstable; urgency=high

  * Enable lmdb database, Closes: #1075723
  * use libnss-myhostname to guarantee we have a hostname for builds, Closes: #1063648

 -- Sam Hartman <hartmans@debian.org>  Wed, 03 Jul 2024 13:47:10 -0600

krb5 (1.21.3-1) unstable; urgency=high

  * New Upstream version
    -     CVE-2024-37370: an unauthenticated attacker can modify the
    extra count in an RFC 4121 GSS token, causing the token to appear
    truncated.
    - CVE-2024-37371: an attacker can cause invalid memory reads by
    sending an invalid GSS token.
    - CVE-2024-26462: a memory leak vulnerability was found
      in /krb5/src/kdc/ndr.c. (Closes: #1064965)
  * Drop doxygen work around patch: applied upstream
  * Fix Python 3.12 tests: replace ssl.wrap_socket, Closes: #1067610

 -- Sam Hartman <hartmans@debian.org>  Thu, 27 Jun 2024 11:54:54 -0600

krb5 (1.21.2-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Remove constraints unnecessary since buster (oldstable)

  [ Otto Kekäläinen ]
  * Run 'wrap-and-sort'
  * Drop obsolete dependency on package lsb-base
  * Make package Lintian clean
  * Enable Salsa-CI

  [ Chris Hofstaedtler ]
  *  Install systemd unit overrides into /usr. (DEP17 M2). Closes: #1072915

  [ Sam Hartman ]
  * New Upstream version 1.21.2, Closes: #1070848
  * Update symbols and breaks for internal APIs that were removed
  * Allow kpropd to bind even if only loopback is configured, Closes: #1072952
  * Skip keyring tests if keyring blocked by seccomp

 -- Sam Hartman <hartmans@debian.org>  Fri, 14 Jun 2024 16:39:28 -0600

krb5 (1.20.1-6) unstable; urgency=medium

  * Fix up libverto1*->libverto1*t64, Closes: #1065702

 -- Sam Hartman <hartmans@debian.org>  Sun, 10 Mar 2024 19:36:33 -0600

krb5 (1.20.1-5.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1064164

 -- Lukas Märdian <slyon@debian.org>  Wed, 28 Feb 2024 15:25:37 +0000

krb5 (1.20.1-5) unstable; urgency=medium

  [ Helmut Grohne ]
  * Annotate test dependencies <!nocheck>. (Closes: #1054461)

  [ Sam Hartman ]
  * Fix keyutils to be linux-any

 -- Helmut Grohne <helmut@subdivi.de>  Tue, 24 Oct 2023 07:17:27 +0200

krb5 (1.20.1-4) unstable; urgency=low

  [ Steve Langasek ]
  * libkrb5support0: require strict binary dependency to deal with glibc 2.38, Closes: #1043184

  [Jelmer Vernooij]
  * krb5-user: Use alternatives for kinit, klist, kswitch, ksu, kpasswd,
    kdestroy, kadmin and ktutil. This allows installation
    together with heimdal-clients. Closes: #213316, #751203

  [ Sam Hartman ]
  * Enable build-time tests, Thanks Andreas Hasenack, Closes: #1017763
  * Work around doxygen change that breaks doc build, Thanks Greg
    Hudson, Closes: #1051523

 -- Sam Hartman <hartmans@debian.org>  Mon, 11 Sep 2023 11:06:57 -0600

krb5 (1.20.1-3) unstable; urgency=high

  * Fixes CVE-2023-36054: a  remote authenticated attacker can cause
    kadmind to free an uninitialized pointer.  Upstream believes remote
    code execusion is unlikely, Closes: #1043431 

 -- Sam Hartman <hartmans@debian.org>  Mon, 14 Aug 2023 14:06:53 -0600

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog krb5-doc`.
