libvirt (12.6.0-1ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2153207). Remaining changes:
    - d/*(post|pre)(rm|inst), d/*.install: drop generated files
    - d/rules: set qemu-group to kvm (for compat with older ubuntu)
    - d/rules,d/libvirt-daemon-common.*: apport hook
    - autostart default bridged network (As upstream does, but not Debian).
      In addition to just enabling it our solution provides:
      + do not autostart if subnet is already taken (e.g. in guests).
      + iterate some alternative subnets before giving up
      + d/t/network: Test automatic virbr0 setup via autopkgtest.
    - d/libvirt-daemon-driver-qemu.postinst.in: add sudo users to libvirt group.
      This would allow sudo users to interact with libvirtd via unix sockets.
    - update README.Debian with Ubuntu changes
    - d/p/u/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
    - fix autopkgtests (LP 1899180)
      + d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
        vmlinuz available and accessible (Debian bug 848314)
      + d/t/control: replace libvirt-daemon by libvirt-daemon-system as
        dependency of the test smoke-qemu-session
      + d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
        long as the following undefine succeeds
      + d/t/smoke-lxc: use systemd instead of sysV to restart the service
      + d/t/control, d/t/smoke-lxc: retry service restart and skip test if
        failing; This was flaky on some release/architectures
      + d/t/smoke-lxc: retry check_domain being flaky on arm64
    - dnsmasq related enhancements
      + run dnsmasq as libvirt-dnsmasq (LP 1743718)
      + d/libvirt-daemon-config-network.postinst*: add libvirt-dnsmasq user
        and group
      + d/libvirt-daemon-config-network.postrm*: remove libvirt-dnsmasq user
        and group on purge
      + d/p/ubuntu/dnsmasq-as-priv-user: write dnsmasq config with user
        libvirt-dnsmasq and adapt the self tests to expect that config
      + Add dnsmasq configuration to work with system wide dnsmasq-base
    - d/p/u/set-default-machine-to-ubuntu.patch: to select default
      machine type correctly with newer qemu/libvirt
    - d/p/u/lp-1861125-ubuntu-models: recognize Ubuntu models for
      (LP 1861125) fixups
    - d/p/ubuntu/wait-for-qemu-kvm.patch: avoid hangs on startup (LP 1887592)
    - d/libvirt-daemon-common.libvirt-guests.default: shut guests down
      in parallel
    - apparmor Delta that is Ubuntu specific or yet to be upstreamed
      split into logical pieces. File names in debian/patches/ubuntu-aa/:
      + 0020-virt-aa-helper-ubuntu-storage-paths.patch:
        apparmor, virt-aa-helper: Allow various storage pools and image
        locations
      + 0029-appmor-libvirt-qemu-Add-9p-support.patch: appmor,
        libvirt-qemu: Add 9p support
      + 0032-apparmor-libvirt-qemu-Allow-reading-charm-specific-c.patch:
        apparmor, libvirt-qemu: Allow reading charm-specific ceph config
      + 0033-UBUNTU-only-apparmor-for-kvm.powerpc-LP-1680384.patch: allow
        commands executed by ubuntu only kvm wrapper on ppc64el
        (LP 1686621 LP 1680384 LP 1784023)
      + 0034-apparmor-virt-aa-helper-access-for-snapped-nova.patch:
        apparmor, virt-aa-helper: access for snapped nova
      + lp-1815910-allow-vhost-hotplug.patch: avoid apparmor issues
        with vhost-net/vhost-vsock/vhost-scsi hotplug (LP 1815910)
      + d/p/u-aa/lp2079869-*: allow access for bridge helper to sys node
        (LP 2079869)
      + Support both GNU and Rust coreutils paths in apparmor policy (LP 2123870)
        d/p/u-aa/lp2123870-apparmor-use-the-coreutils-tunable-for-coreutils.patch
      + d/p/u-aa/lp2144665-*: grant access to unix socket for QGSD
        (LP 2144665)
    - libvirt should not use user/group tss for swtpm (LP 1948880)
      + d/libvirt-daemon-system.postinst: modify ownership of swtpm logdir
      + d/libvirt-daemon-driver-qemu.sysusers: add swtpm user and group
      + d/p/u/swtpm-by-swtpm-user.patch: change default spawned swtpm processes
        to user swtpm and adapt expected self test result changes.
    - d/control: Demote passt to Suggests (from Recommends) for
      libvirt-daemon-driver-qemu, because passt is in universe.
    - d/control: Make libvirt-daemon Suggest (instead of Recommend)
      libvirt-daemon-plugin-sanlock, which is in universe.
    - default to qemu:///system libvirt URI (LP 2027838)
      On Ubuntu we always want to initialize the URI to qemu:///system,
      regardless if running as privileged daemon or not. This keeps backward
      compatibility with Ubuntu's default behavior, while still allowing users
      more flexibility in changing that default, through config files or
      environment variables.
      Redesign the solution by getting rid of the libvirt-uri.sh script used
      up until now to achieve the same behavior.
      + d/p/u/lp-2027838-conf-Default-to-qemu-system-libvirt-URI.patch
      + d/t/default-uri: add basic test for LIBVIRT_DEFAULT_URI handling
    - enable MSR kernel module load
      d/p/u/x86-install-modules-load.d-file-to-load-msr-module.patch
      d/arches.mk, d/libvirt-common.install.in, debian/libvirt-common.postinst.in
      (LP 2106791)
    - d/control: re-generate from d/control-in: we stop changing both files
      and eventually re-generate from d/control-in at built as intended.
    - d/{control,control.in}: add dependencies to -hwe components (LP 2143146)
  * New changes:
    - d/p/u-aa/lp2056441-allow-vfio-ccw-hostdev-sysfs-access.patch:
      Allow vfio-ccw hostdev sysfs access (LP: #2056441)
    - d/NEWS: add section about migration to polkit
  * Dropped changes:
    - d/control.in: Disable libssh2 support (universe dependency)
      [libssh2 is now in main]
    - 0031-virt-aa-helper-Ask-for-no-deny-rule-for-readonly-dis.patch:
      virt-aa-helper: Ask for no deny rule for readonly disk
      [Fixed in upstream 11.5.0]
    - Fix excessive memory allocation when physical_package_id is large
      (LP 2153530).
      + d/p/ubuntu/lp2153530-fix-max-socket-calculation.patch: compute socket
        count from unique package IDs instead of the maximum value.
      [Fixed in upstream 12.5.0]
    - Fix a logic bug to improve performance for some interface types when
      setting ingress-only QoS rules (LP 2155755)
      + d/p/ubuntu/lp2155755-split-virNetDevBandwidthClear-into-helpers.patch
      + d/p/ubuntu/lp2155755-only-clear-qdisc-for-defined-directions.patch
      [Fixed in upstream 12.5.0]
    - d/control.in: add libzfslinux-dev to build-deps
      [useless delta]
    - d/libvirt-daemon-system.postinst: create user/group swtpm if not present
      due to swtpm-tools (LP 1951975)
    - fix ubuntu users management for sudoers (LP 2142453)
      [squashed into the delta Allow-libvirt-group-to-access-the-socket]
    - d/libvirt-clients.conffiles: Remove libvirt-uri.sh profile.d script
      [Dropped after 26.04, part of default to qemu:///system libvirt URI]
    - d/l-d-config-network.{pre,post}inst.in: diversions for network config.
      [Dropped after 26.04, part of autostart default bridged network]
    - d/l-d-config-network.{pre,post}inst.in: retain non pkg owned network
      config.
      [Dropped after 26.04, part of autostart default bridged network]
    - d/control: Add Breaks/Replaces, to account for the move of configuration
      of the default bridged network to libvirt-daemon-config-network.
      (LP 2107448)
      [Dropped after 26.04, part of autostart default bridged network]
    - d/l-d-config-network.postinst: clear 'autostarted' state, to activate
      network on install (LP 2093864)
      [Dropped after 26.04, part of autostart default bridged network]
    - d/p/u/ovmf_paths.patch: adjust paths to secboot.fd UEFI
      Secure Boot enabled variants of the OVMF firmware and variable store for
      the paths where we ship these files in Ubuntu.
      [this is the legacy firmare discovery mechanism, json descriptors is
       now the de-facto mechanism, this delta can now be dropped]
    - d/p/u/Allow-libvirt-group-to-access-the-socket.patch: This is
      the group based access to libvirt functions as it was used in Ubuntu
      for quite a long time.
      + d/p/ubuntu/daemon-augeas-fix-expected.patch fix some related tests
        due to the group access change.
      + d/libvirt-daemon-driver-qemu.postinst*: add users in sudo to the libvirt
        group.
      [To align with Debian and upstreams recommended default on using polkit]

 -- Hector Cao <hector.cao@canonical.com>  Wed, 19 Aug 2026 11:04:44 +0200

libvirt (12.6.0-1) unstable; urgency=medium

  * [542853e] New upstream version 12.6.0

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 03 Aug 2026 22:02:12 +0200

libvirt (12.5.0-1) unstable; urgency=medium

  * [5942ad9] New upstream version 12.5.0
  * [e7bac77] control: Bump Standards-Version to 4.7.4
    - No changes needed

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 03 Jul 2026 22:10:28 +0200

libvirt (12.4.0-1) unstable; urgency=medium

  * [cad230c] New upstream version 12.4.0
  * [f8de382] common: Add several CPU models

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 14 Jun 2026 00:31:15 +0200

libvirt (12.3.0-1) unstable; urgency=medium

  [ Andrea Bolognani ]
  * [fc8fbe1] New upstream version 12.3.0
  * [3839c78] patches: Drop debian/Drop-handling-of-secret-encryption-[...]
    - The issue that was preventing us from enabling this
      functionality has been fixed upstream
  * [5267f7e] Add Multi-Arch field for packages that were missing it

  [ Pino Toscano ]
  * [e64433c] Build libvirt-clients-qemu only on QEMU architectures
  * [f7c3ccd] Drop QEMU driver on 32bit architectures
    - No longer supported as host architectures starting with QEMU 11.0
    - Closes: #1134873

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 10 May 2026 22:37:28 +0200

libvirt (12.2.0-1) unstable; urgency=medium

  * [9779e02] New upstream version 12.2.0

 -- Andrea Bolognani <eof@kiyuko.org>  Sat, 18 Apr 2026 01:03:59 +0200

libvirt (12.1.0-1) experimental; urgency=medium

  * [6b2d3ee] New upstream version 12.1.0
    - Addresses various issues related to the interactions between
      AppArmor and snapshot handling
    - Closes: #932456
    - Closes: #1061725
    - Closes: #1093955
  * [8e9b871] patches: Add debian/Drop-handling-of-secret-encryption-[...]
    - The feature is implemented in a way that makes libvirtd
      completely unusable if the secret driver is not installed, so
      we're going to keep it disabled for the time being

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 29 Mar 2026 22:33:37 +0200

libvirt (12.0.0-1ubuntu7) stonking; urgency=medium

  * Fix a logic bug to improve performance for some interface types when
    setting ingress-only QoS rules (LP: #2155755)
    - d/p/ubuntu/lp2155755-split-virNetDevBandwidthClear-into-helpers.patch
    - d/p/ubuntu/lp2155755-only-clear-qdisc-for-defined-directions.patch

 -- Wesley Hershberger <wesley.hershberger@canonical.com>  Wed, 24 Jun 2026 13:16:19 -0500

libvirt (12.0.0-1ubuntu6) stonking; urgency=medium

  * Fix excessive memory allocation when physical_package_id is large
    (LP: #2153530).
    - d/p/ubuntu/lp2153530-fix-max-socket-calculation.patch: compute socket
      count from unique package IDs instead of the maximum value.

 -- Seyeong Kim <seyeong.kim@canonical.com>  Thu, 21 May 2026 03:50:35 +0000

libvirt (12.0.0-1ubuntu5) resolute; urgency=medium

  * d/p/u-aa/lp2144665-* : grant access to unix socket for QGSD
    (LP: #2144665)

 -- Hector Cao <hector.cao@canonical.com>  Tue, 17 Mar 2026 17:27:03 +0100

libvirt (12.0.0-1ubuntu4) resolute; urgency=medium

  * d/control : add dependencies to -hwe components (LP: #2143146)

 -- Hector Cao <hector.cao@canonical.com>  Wed, 11 Mar 2026 12:27:46 +0100

libvirt (12.0.0-1ubuntu3) resolute; urgency=medium

  * add swtpm user and group via sysusers (LP: #2142761)

 -- Hector Cao <hector.cao@canonical.com>  Fri, 27 Feb 2026 09:29:57 +0100

libvirt (12.0.0-1ubuntu2) resolute; urgency=medium

  * fix users management for ubuntu (LP: #2142453)
    - drop swtpm user/group creation since we do not
      need this delta anymore, it is taken care by swtpm-tools.
    - remove useless add_users_groups() since we moved to
      sysusers.d
    - fix ubuntu users management for sudoers

 -- Hector Cao <hector.cao@canonical.com>  Tue, 24 Feb 2026 11:16:57 +0100

libvirt (12.0.0-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2126022). Remaining changes:
    - d/*(post|pre)(rm|inst), d/*.install: drop generated files
    - d/control.in: Disable libssh2 support (universe dependency)
    - d/control.in: add libzfslinux-dev to build-deps
    - d/p/ovmf_paths.patch: adjust paths to secboot.fd UEFI
      Secure Boot enabled variants of the OVMF firmware and variable store for
      the paths where we ship these files in Ubuntu.
    - d/rules: Set qemu-group to kvm (for compat with older ubuntu)
    - d/rules, d/libvirt-daemon-common.*: Additional apport package-hook
    - autostart default bridged network (As upstream does, but not Debian).
      In addition to just enabling it our solution provides:
      + do not autostart if subnet is already taken (e.g. in guests).
      + iterate some alternative subnets before giving up
      + d/t/network: Test automatic virbr0 setup via autopkgtest.
      + d/l-d-config-network.postinst: clear 'autostarted' state, to activate
        network on install (LP 2093864)
      + d/control: Add Breaks/Replaces, to account for the move of configuration
        of the default bridged network to libvirt-daemon-config-network.
        (LP 2107448)
      + d/l-d-config-network.{pre,post}inst.in: diversions for network config.
      + d/l-d-config-network.{pre,post}inst.in: retain non pkg owned network
        config.
    - d/p/u/Allow-libvirt-group-to-access-the-socket.patch: This is
      the group based access to libvirt functions as it was used in Ubuntu
      for quite a long time.
      + d/p/ubuntu/daemon-augeas-fix-expected.patch fix some related tests
        due to the group access change.
      + d/libvirt-daemon-driver-qemu.postinst*: add users in sudo to the libvirt
        group.
    - update README.Debian with Ubuntu changes
    - d/p/u/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
    - fix autopkgtests (LP 1899180)
      + d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
        vmlinuz available and accessible (Debian bug 848314)
      + d/t/control: fix smoke-qemu-session by ensuring the service will run
        installing libvirt-daemon-system
      + d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
        long as the following undefine succeeds
      + d/t/smoke-lxc: use systemd instead of sysV to restart the service
      + d/t/control, d/t/smoke-lxc: retry service restart and skip test if
        failing; This was flaky on some release/architectures
      + d/t/smoke-lxc: retry check_domain being flaky on arm64
    - dnsmasq related enhancements
      + run dnsmasq as libvirt-dnsmasq (LP 1743718)
      + d/libvirt-daemon-config-network.postinst*: add libvirt-dnsmasq user
        and group
      + d/libvirt-daemon-config-network.postrm*: remove libvirt-dnsmasq user
        and group on purge
      + d/p/ubuntu/dnsmasq-as-priv-user: write dnsmasq config with user
        libvirt-dnsmasq and adapt the self tests to expect that config
      + Add dnsmasq configuration to work with system wide dnsmasq-base
    - d/p/u/set-default-machine-to-ubuntu.patch: to select default
      machine type correctly with newer qemu/libvirt
    - d/p/u/lp-1861125-ubuntu-models: recognize Ubuntu models for
      (LP 1861125) fixups
    - d/p/ubuntu/wait-for-qemu-kvm.patch - avoid hangs on startup (LP 1887592)
    - d/libvirt-daemon-common.libvirt-guests.default: shut guests down
      in parallel
    - apparmor Delta that is Ubuntu specific or yet to be upstreamed
      split into logical pieces. File names in debian/patches/ubuntu-aa/:
      + 0020-virt-aa-helper-ubuntu-storage-paths.patch:
        apparmor, virt-aa-helper: Allow various storage pools and image
        locations
      + 0029-appmor-libvirt-qemu-Add-9p-support.patch: appmor,
        libvirt-qemu: Add 9p support
      + 0031-virt-aa-helper-Ask-for-no-deny-rule-for-readonly-dis.patch:
        virt-aa-helper: Ask for no deny rule for readonly disk
      + 0032-apparmor-libvirt-qemu-Allow-reading-charm-specific-c.patch:
        apparmor, libvirt-qemu: Allow reading charm-specific ceph config
      + 0033-UBUNTU-only-apparmor-for-kvm.powerpc-LP-1680384.patch: allow
        commands executed by ubuntu only kvm wrapper on ppc64el
        (LP 1686621 LP 1680384 LP 1784023)
      + 0034-apparmor-virt-aa-helper-access-for-snapped-nova.patch:
        apparmor, virt-aa-helper: access for snapped nova
      + lp-1815910-allow-vhost-hotplug.patch: avoid apparmor issues
        with vhost-net/vhost-vsock/vhost-scsi hotplug (LP 1815910)
      + d/p/u-aa/lp2079869-*: allow access for bridge helper to sys node
        (LP 2079869)
      + Support both GNU and Rust coreutils paths in apparmor policy (LP 2123870)
        d/p/u-aa/lp2123870-apparmor-use-the-coreutils-tunable-for-coreutils.patch
    - libvirt should not use user/group tss for swtpm (LP 1948880)
      + d/libvirt-daemon-system.postinst: own swtpm logdir by user swtpm
      + d/p/u/swtpm-by-swtpm-user.patch: change default spawned swtpm processes
        to user swtpm and adapt expected self test result changes triggered by
        this
      + d/libvirt-daemon-system.postinst: create user/group swtpm if not present
        due to swtpm-tools (LP 1951975)
    - d/control: Demote passt to Suggests (from Recommends) for
      libvirt-daemon-driver-qemu, because passt is in universe.
    - d/control: Make libvirt-daemon Suggest (instead of Recommend)
      libvirt-daemon-plugin-sanlock, which is in universe.
    - d/control: re-generate from d/control-in: we stop changing both files
      and eventually re-generate from d/control-in at built as intended.
    - default to qemu:///system libvirt URI (LP 2027838)
      On Ubuntu we always want to initialize the URI to qemu:///system,
      regardless if running as privileged daemon or not. This keeps backward
      compatibility with Ubuntu's default behavior, while still allowing users
      more flexibility in changing that default, through config files or
      environment variables.
      Redesign the solution by getting rid of the libvirt-uri.sh script used
      up until now to achieve the same behavior.
        + d/p/u/lp-2027838-conf-Default-to-qemu-system-libvirt-URI.patch
        + d/libvirt-clients.conffiles: Remove libvirt-uri.sh profile.d script
          on upgrade
        + d/t/default-uri: add basic test for LIBVIRT_DEFAULT_URI handling
    - enable MSR kernel module load (LP 2106791)
  * Dropped changes [in Upstream 12.0.0]:
    - d/p/u-aa/lp2127492-*: apparmor: Allow AMD-SEV device access for
      AMD-SEV VM (LP 2127492)
    - cpu_map: fix vmx-* MSR features (LP 2083293)
      d/p/u/lp2083293-cpu_map-update-vmx-features.patch
    - d/p/u-aa/lp2079869-* : virt-aa-helper: Avoid duplicate when append rule
      (LP 2120278)
    - SECURITY UPDATE: memory consumption DoS via XML parsing, CVE-2025-12748
    - SECURITY UPDATE: incorrect world-readable permissions on snapshots
      CVE-2025-13193

 -- Hector Cao <hector.cao@canonical.com>  Thu, 22 Jan 2026 13:34:09 +0100

libvirt (12.0.0-1) unstable; urgency=medium

  * [f56956f] New upstream version 12.0.0
  * [e391236] control: Bump Standards-Version to 4.7.3
    - No changes needed
  * [7497157] watch: Update to version 5 syntax
  * [e6faaf7] debconf: Add Chinese translation
    - Thanks to Yangfl (Closes: #1125068)

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 16 Jan 2026 01:12:18 +0100

libvirt (11.10.0-2) experimental; urgency=medium

  [ Luca Boccassi ]
  * [5f62c20] Install and use sysusers.d config files
    - Replace existing bespoke handling of user/groups in
      maintainer scripts with a declarative approach. It should
      be completely transparent for users, except for the fact
      that users/groups are no longer deleted on purge, which
      prevents accidental ownership transfer for existing files

  [ Andrea Bolognani ]
  * [7f00f6b] Tweak details for libvirt-qemu user
    - Improve GECOS field and change home directory to /nonexistent.
      This only affects new installations: existing users will not
      be modified

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 08 Dec 2025 23:11:12 +0100

libvirt (11.10.0-1) unstable; urgency=medium

  * [13462ab] New upstream version 11.10.0
    - Perform ACL checks earlier, preventing malicious users
      from potentially being able to crash the daemon
      - Closes: #1120584 (CVE-2025-12748)
    - Ensure that newly-created snapshots are not world-readable
      - Closes: #1120119 (CVE-2025-13193)
    - Apply the detect_zeroes settings across all layers of the
      backing chain instead of just the topmost one
      - Closes: #1121280
  * [5732866] common: Add several CPU models

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 01 Dec 2025 23:25:35 +0100

libvirt (11.9.0-2) unstable; urgency=medium

  * [2b22a1b] daemon-plugin-sanlock: Always install augeas config
    - Fixes FTBFS on architectures that don't enable the QEMU driver

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 06 Nov 2025 21:37:35 +0100

libvirt (11.9.0-1) unstable; urgency=medium

  * [a76d51f] New upstream version 11.9.0

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 04 Nov 2025 00:49:02 +0100

libvirt (11.8.0-2) unstable; urgency=medium

  * [a17e07a] patches: Add backports
    - Fix building against Wireshark 4.6.0
    - Closes: #1118069

 -- Andrea Bolognani <eof@kiyuko.org>  Wed, 15 Oct 2025 14:29:57 +0200

libvirt (11.8.0-1) unstable; urgency=medium

  * [b4ab89e] New upstream version 11.8.0
  * [3e1d30b] upstream: Update keyring

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 03 Oct 2025 01:14:48 +0200

libvirt (11.7.0-1) unstable; urgency=medium

  [ Nuri KÜÇÜKLER ]
  * [192b7f1] debconf: Add Turkish translation
    - Closes: #1110365

  [ Andrea Bolognani ]
  * [cc15910] New upstream version 11.7.0

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 01 Sep 2025 21:28:23 +0200

libvirt (11.6.0-1ubuntu8) resolute; urgency=medium

  * cpu_map: fix vmx-* MSR features (LP: #2083293)
     - d/p/u/lp2083293-cpu_map-update-vmx-features.patch
  * Enable MSR kernel module load (LP: #2106791)
    In recent CPUs, some CPU features detection is done by reading
    Model Specific Registers (MSR). To do that, libvirt needs the
    msr kernel module to be loaded.
     - d/p/d/x86-install-modules-load.d-file-to-load-msr-module.patch
     - debian/libvirt-common.install.in : install msr.conf file
     - debian/libvirt-common.postinst.in : trigger the module load

 -- Hector Cao <hector.cao@canonical.com>  Mon, 12 Jan 2026 15:58:40 +0100

libvirt (11.6.0-1ubuntu7) resolute; urgency=medium

  * SECURITY UPDATE: memory consumption DoS via XML parsing
    - debian/patches/CVE-2025-12748-1.patch: add virDomainDefIDsParseString
      in src/conf/domain_conf.c, src/conf/domain_conf.h,
      src/libvirt_private.syms.
    - debian/patches/CVE-2025-12748-2.patch: check ACLs before parsing the
      whole domain XML in src/bhyve/bhyve_driver.c.
    - debian/patches/CVE-2025-12748-3.patch: check ACLs before parsing the
      whole domain XML in src/libxl/libxl_driver.c,
    - debian/patches/CVE-2025-12748-4.patch: check ACLs before parsing the
      whole domain XML in src/lxc/lxc_driver.c.
    - debian/patches/CVE-2025-12748-5.patch: check ACLs before parsing the
      whole domain XML in src/vz/vz_driver.c.
    - debian/patches/CVE-2025-12748-6.patch: check ACLs before parsing the
      whole domain XML in src/ch/ch_driver.c.
    - debian/patches/CVE-2025-12748-7.patch: check ACLs before parsing the
      whole domain XML in src/qemu/qemu_driver.c,
      src/qemu/qemu_migration.c, src/qemu/qemu_migration.h,
      src/qemu/qemu_saveimage.c, src/qemu/qemu_saveimage.h,
      src/qemu/qemu_snapshot.c.
    - debian/patches/CVE-2025-12748-8.patch: fix typo in bhyve driver in
      src/bhyve/bhyve_driver.c.
    - CVE-2025-12748
  * SECURITY UPDATE: incorrect world-readable permissions on snapshots
    - debian/patches/CVE-2025-13193.patch: set umask for qemu-img when
      creating external inactive snapshots in src/qemu/qemu_snapshot.c.
    - CVE-2025-13193

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 08 Dec 2025 09:16:59 -0500

libvirt (11.6.0-1ubuntu6) resolute; urgency=medium

  * d/p/u-aa/lp2127492-*: apparmor: Allow AMD-SEV device access for
    AMD-SEV VM (LP: #2127492)

 -- Hector Cao <hector.cao@canonical.com>  Wed, 29 Oct 2025 09:34:08 +0000

libvirt (11.6.0-1ubuntu5) resolute; urgency=medium

  * Cherry-pick from Debian git repo
    - [a17e07a] patches: Add backports
    - Fix building against Wireshark 4.6.0
    - Closes: #1118069

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 18 Oct 2025 20:02:01 +0200

libvirt (11.6.0-1ubuntu4) resolute; urgency=medium

  * Rebuild against new libwireshark19.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 18 Oct 2025 19:43:53 +0200

libvirt (11.6.0-1ubuntu3) questing; urgency=medium

  * Support both GNU and Rust coreutils paths in apparmor policy (LP: #2123870)
    - d/p/u-aa/lp2123870-apparmor-use-the-coreutils-tunable-for-coreutils.patch

 -- Georgia Garcia <georgia.garcia@canonical.com>  Thu, 23 Sep 2025 15:53:13 -0300

libvirt (11.6.0-1ubuntu2) questing; urgency=medium

  [ Lukas Märdian ]
  * Default to qemu:///system libvirt URI (LP: #2027838)
    On Ubuntu we always want to initialize the URI to qemu:///system,
    regardless if running as privileged daemon or not. This keeps backward
    compatibility with Ubuntu's default behavior, while still allowing users
    more flexibility in changing that default, through config files or
    environment variables.
    - d/p/u/lp-2027838-conf-Default-to-qemu-system-libvirt-URI.patch
  * d/t/default-uri: add basic test for LIBVIRT_DEFAULT_URI handling
  * d/libvirt-clients.conffiles: Remove libvirt-uri.sh profile.d script
  * Drop Changes:
    - libvirt-uri.sh, d/rules: Automatically switch default libvirt URI
      for users via user profile (qemu:///system)

  [ Hector Cao ]
  * d/p/u-aa/lp2079869-* : virt-aa-helper: Avoid duplicate when append rule
    (LP: #2120278)

 -- Hector Cao <hector.cao@canonical.com>  Wed, 27 Aug 2025 10:18:49 +0200

libvirt (11.6.0-1ubuntu1) questing; urgency=medium

  * Merge with Debian experimental (LP: #2115181). Remaining changes:
  * Remaining changes:
    - d/p/u-aa/lp2079869-*: allow access for bridge helper to sys node
      (LP 2079869)
    - d/*(post|pre)(rm|inst), d/*.install: drop generated files
    - Disable libssh2 support (universe dependency)
    - d/control: add libzfslinux-dev to build-deps
    - debian/patches/ubuntu/ovmf_paths.patch: adjust paths to secboot.fd UEFI
      Secure Boot enabled variants of the OVMF firmware and variable store for
      the paths where we ship these files in Ubuntu.
    - Set qemu-group to kvm (for compat with older ubuntu)
    - Additional apport package-hook
    - Autostart default bridged network (As upstream does, but not Debian).
      In addition to just enabling it our solution provides:
      + do not autostart if subnet is already taken (e.g. in guests).
      + iterate some alternative subnets before giving up
      + d/t/network: Test automatic virbr0 setup via autopkgtest.
      + d/l-d-config-network.postinst: clear 'autostarted' state, to activate
        network on install (LP 2093864)
      + d/l-d-config-network.{pre,post}inst.in: diversions for network config.
      + d/l-d-config-network.{pre,post}inst.in: retain non pkg owned network
        config.
      + d/control: Add Breaks/Replaces, to account for the move of configuration
        of the default bridged network to libvirt-daemon-config-network.
        (LP 2107448)
    - d/p/u/Allow-libvirt-group-to-access-the-socket.patch: This is
      the group based access to libvirt functions as it was used in Ubuntu
      for quite a long time.
      + d/p/u/daemon-augeas-fix-expected.patch fix some related tests
        due to the group access change.
      + d/libvirt-daemon-driver-qemu.postinst*: add users in sudo to the libvirt
        group.
    - Update README.Debian with Ubuntu changes
    - d/p/ubuntu/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
    - fix autopkgtests (LP 1899180)
      + d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
        vmlinuz available and accessible (Debian bug 848314)
      + d/t/control: fix smoke-qemu-session by ensuring the service will run
        installing libvirt-daemon-system
      + d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
        long as the following undefine succeeds
      + d/t/smoke-lxc: use systemd instead of sysV to restart the service
      + d/t/control, d/t/smoke-lxc: retry service restart and skip test if
        failing; This was flaky on some release/architectures
      + d/t/smoke-lxc: retry check_domain being flaky on arm64
    - dnsmasq related enhancements
      + run dnsmasq as libvirt-dnsmasq (LP 1743718)
      + d/libvirt-daemon-config-network.postinst*: add libvirt-dnsmasq user
        and group
      + d/libvirt-daemon-config-network.postrm*: remove libvirt-dnsmasq user
        and group
        on purge
      + d/p/ubuntu/dnsmasq-as-priv-user: write dnsmasq config with user
        libvirt-dnsmasq and adapt the self tests to expect that config
      + Add dnsmasq configuration to work with system wide dnsmasq-base
    - d/p/ubuntu/set-default-machine-to-ubuntu.patch: to select default
      machine type correctly with newer qemu/libvirt
    - d/p/ubuntu/lp-1861125-ubuntu-models: recognize Ubuntu models for
      (LP 1861125) fixups
    - d/p/ubuntu/wait-for-qemu-kvm.patch - avoid hangs on startup (LP 1887592)
    - d/libvirt-daemon-common.libvirt-guests.default: shut guests down
      in parallel
    - Apparmor Delta that is Ubuntu specific or yet to be upstreamed
      split into logical pieces. File names in debian/patches/ubuntu-aa/:
      + 0020-virt-aa-helper-ubuntu-storage-paths.patch:
        apparmor, virt-aa-helper: Allow various storage pools and image
        locations
      + 0029-appmor-libvirt-qemu-Add-9p-support.patch: appmor,
        libvirt-qemu: Add 9p support
      + 0031-virt-aa-helper-Ask-for-no-deny-rule-for-readonly-dis.patch:
        virt-aa-helper: Ask for no deny rule for readonly disk
      + 0032-apparmor-libvirt-qemu-Allow-reading-charm-specific-c.patch:
        apparmor, libvirt-qemu: Allow reading charm-specific ceph config
      + 0033-UBUNTU-only-apparmor-for-kvm.powerpc-LP-1680384.patch: allow
        commands executed by ubuntu only kvm wrapper on ppc64el
        (LP 1686621 LP 1680384 LP 1784023)
      + 0034-apparmor-virt-aa-helper-access-for-snapped-nova.patch:
        apparmor, virt-aa-helper: access for snapped nova
      + lp-1815910-allow-vhost-hotplug.patch: avoid apparmor issues
        with vhost-net/vhost-vsock/vhost-scsi hotplug (LP 1815910)
    - libvirt should not use user/group tss for swtpm (LP 1948880)
      + d/libvirt-daemon-system.postinst: own swtpm logdir by user swtpm
      + d/p/u/swtpm-by-swtpm-user.patch: change default spawned swtpm processes
        to user swtpm and adapt expected self test result changes triggered by
        this
      + d/libvirt-daemon-system.postinst: create user/group swtpm if not present
        due to swtpm-tools (LP 1951975)
    - d/libvirt-clients.lintian-overrides: Add script-not-executable lintian
      override
    - libvirt-uri.sh, d/rules: Automatically switch default libvirt URI
      for users via user profile (qemu:///system)
      + Update: Set LIBVIRT_DEFAULT_URI to "qemu:///system" in all
        cases. (LP #2027838)
    - d/control: Demote passt to Suggests (from Recommends) for
      libvirt-daemon-driver-qemu, because passt is in universe.
    - d/control: Make libvirt-daemon Suggest (instead of Recommend)
      libvirt-daemon-plugin-sanlock, which is in universe.
    - d/control: re-generate from d/control-in: we stop changing both files
      and eventually re-generate from d/control-in at built as intended.
  * Updated changes
    - d/p/u/ovmf_paths.patch: update to match new upstreams qemu.conf
    - d/p/u/swtpm-by-swtpm-user.patch: update to match new upstreams qemu.conf

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Mon, 04 Aug 2025 13:24:59 +0200

libvirt (11.6.0-1) experimental; urgency=medium

  * [047260f] New upstream version 11.6.0

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 01 Aug 2025 23:22:24 +0200

libvirt (11.5.0-1) experimental; urgency=medium

  * [0ae9dd8] New upstream version 11.5.0

 -- Andrea Bolognani <eof@kiyuko.org>  Wed, 02 Jul 2025 21:22:39 +0200

libvirt (11.4.0-1ubuntu2) questing; urgency=medium

  * d/l-d-config-network.postinst: clear 'autostarted' state, to activate
    network on install (LP: #2093864)
  * Drop Changes: [Replaced by the above]
    - Start default network on install (LP 2093864)
      + d/l-d-config-network.postinst: add explicit virsh net-start workaround
      + d/control: add libvirt-clients Recommends to l-d-config-network
      + d/l-d-config-network.dirs: add var/libvirt/dnsmasq to store lease files
        to avoid a warning on install

 -- Lukas Märdian <slyon@ubuntu.com>  Wed, 25 Jun 2025 11:02:02 +0200

libvirt (11.4.0-1ubuntu1) questing; urgency=medium

  [ Christian Ehrhardt ]
  * Merge with Debian experimental (LP: #2110424)
  * Among many other imrpovements this fixes
    - ppc64: P11 Support in Libvirt (LP: #2109469)
    - s390x: KVM: Implement virsh hypervisor-cpu-models (LP: #2027925)
  * Remaining changes:
    - d/p/u-aa/lp2079869-*: allow access for bridge helper to sys node
      (LP 2079869)
    - d/*(post|pre)(rm|inst), d/*.install: drop generated files
    - Disable libssh2 support (universe dependency)
    - d/control: add libzfslinux-dev to build-deps
    - debian/patches/ubuntu/ovmf_paths.patch: adjust paths to secboot.fd UEFI
      Secure Boot enabled variants of the OVMF firmware and variable store for
      the paths where we ship these files in Ubuntu.
    - Set qemu-group to kvm (for compat with older ubuntu)
    - Additional apport package-hook
    - Autostart default bridged network (As upstream does, but not Debian).
      In addition to just enabling it our solution provides:
      + do not autostart if subnet is already taken (e.g. in guests).
      + iterate some alternative subnets before giving up
    - d/p/ubuntu/Allow-libvirt-group-to-access-the-socket.patch: This is
      the group based access to libvirt functions as it was used in Ubuntu
      for quite a long time.
      + d/p/ubuntu/daemon-augeas-fix-expected.patch fix some related tests
        due to the group access change.
      + d/libvirt-daemon-driver-qemu.postinst*: add users in sudo to the libvirt
        group.
    - Update README.Debian with Ubuntu changes
    - d/p/ubuntu/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
    - fix autopkgtests (LP 1899180)
      + d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
        vmlinuz available and accessible (Debian bug 848314)
      + d/t/control: fix smoke-qemu-session by ensuring the service will run
        installing libvirt-daemon-system
      + d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
        long as the following undefine succeeds
      + d/t/smoke-lxc: use systemd instead of sysV to restart the service
      + d/t/control, d/t/smoke-lxc: retry service restart and skip test if
        failing; This was flaky on some release/architectures
      + d/t/smoke-lxc: retry check_domain being flaky on arm64
    - dnsmasq related enhancements
      + run dnsmasq as libvirt-dnsmasq (LP 1743718)
      + d/libvirt-daemon-driver-qemu.postinst*: add libvirt-dnsmasq user
        and group
      + d/libvirt-daemon-driver-qemu.postrm*: remove libvirt-dnsmasq user
        and group
        on purge
      + d/p/ubuntu/dnsmasq-as-priv-user: write dnsmasq config with user
        libvirt-dnsmasq and adapt the self tests to expect that config
      + d/libvirt-daemon-system.postinst: fix old libvirt-dnsmasq users group
      + Add dnsmasq configuration to work with system wide dnsmasq-base
    - d/p/ubuntu/set-default-machine-to-ubuntu.patch: to select default
      machine type correctly with newer qemu/libvirt
    - d/p/ubuntu/lp-1861125-ubuntu-models: recognize Ubuntu models for
      (LP 1861125) fixups
    - d/p/ubuntu/wait-for-qemu-kvm.patch - avoid hangs on startup (LP 1887592)
    - d/libvirt-daemon-common.libvirt-guests.default: shut guests down
      in parallel
    - Apparmor Delta that is Ubuntu specific or yet to be upstreamed
      split into logical pieces. File names in debian/patches/ubuntu-aa/:
      + 0020-virt-aa-helper-ubuntu-storage-paths.patch:
        apparmor, virt-aa-helper: Allow various storage pools and image
        locations
      + 0029-appmor-libvirt-qemu-Add-9p-support.patch: appmor,
        libvirt-qemu: Add 9p support
      + 0031-virt-aa-helper-Ask-for-no-deny-rule-for-readonly-dis.patch:
        virt-aa-helper: Ask for no deny rule for readonly disk
      + 0032-apparmor-libvirt-qemu-Allow-reading-charm-specific-c.patch:
        apparmor, libvirt-qemu: Allow reading charm-specific ceph config
      + 0033-UBUNTU-only-apparmor-for-kvm.powerpc-LP-1680384.patch: allow
        commands executed by ubuntu only kvm wrapper on ppc64el
        (LP 1686621 LP 1680384 LP 1784023)
      + 0034-apparmor-virt-aa-helper-access-for-snapped-nova.patch:
        apparmor, virt-aa-helper: access for snapped nova
      + lp-1815910-allow-vhost-hotplug.patch: avoid apparmor issues
        with vhost-net/vhost-vsock/vhost-scsi hotplug (LP 1815910)
    - libvirt should not use user/group tss for swtpm (LP 1948880)
      + d/libvirt-daemon-system.postinst: own swtpm logdir by user swtpm
      + d/p/u/swtpm-by-swtpm-user.patch: change default spawned swtpm processes
        to user swtpm and adapt expected self test result changes triggered by
        this
      + d/libvirt-daemon-system.postinst: create user/group swtpm if not present
        due to swtpm-tools (LP 1951975)
    - d/libvirt-clients.lintian-overrides: Add script-not-executable lintian
      override
    - libvirt-uri.sh, d/rules: Automatically switch default libvirt URI
      for users via user profile (qemu:///system)
      + Update: Set LIBVIRT_DEFAULT_URI to "qemu:///system" in all
        cases. (LP #2027838)
    - d/control: Demote passt to Suggests (from Recommends) for
      libvirt-daemon-driver-qemu, because passt is in universe.
    - d/control: Make libvirt-daemon Suggest (instead of Recommend)
      libvirt-daemon-plugin-sanlock, which is in universe.
  * Added changes
    - d/control: re-generate from d/control-in: we stop changing both files
      and eventually re-generate from d/control-in as it is meant to be.
      Having more than just d/control-in is only a git-import artifact anyway.
  * Drop changes [in Debian 11.1.0-2]
    - Fix potential issue in regard to conffile transfer on upgrades
      (LP 2105496)
  * Drop changes [in Upstream 11.1.0]
    - d/control: drop libvirt-lxc, vbox and xen drivers to suggest
    - apparmor: Allow SGX if configured (LP 2100024)
    - d/p/u/lp2097886: Enable virtio-mem support not in 11.0 (LP 2097886)

  [ Lukas Märdian ]
  * Move autostart of default bridged network from libvirt-daemon-driver-qemu
    to libvirt-daemon-config-network.postinst, as it depends on the default.xml
    template shipped by the latter. (LP: #2107448)
    - Move dnsmasq related enhancements to libvirt-daemon-config-network
      + run dnsmasq as libvirt-dnsmasq (LP: 1743718)
      + d/libvirt-daemon-config-network.postinst*: add libvirt-dnsmasq
        user/group, as moved from d/libvirt-daemon-driver-qemu.postinst.
      + d/libvirt-daemon-config-network.postrm*: remove libvirt-dnsmasq
        user/group on purge, as moved from d/libvirt-daemon-driver-qemu.postinst
      + Move dnsmasq configuration to work with system wide dnsmasq-base from
        libvirt-daemon-driver-qemu.post* to libvirt-daemon-config-network.post*
    - d/control: Add Breaks/Replaces, to account for the move of configuration
      of the default bridged network to libvirt-daemon-config-network.
      As per https://wiki.debian.org/PackageTransition case #9.
    - d/t/network: Test automatic virbr0 setup via autopkgtest.
    - d/l-d-config-network.{pre,post}inst.in: Add diversions for network config.
    - d/l-d-config-network.{pre,post}inst.in: retain non pkg owned network
      config.
  * Start default network on install (LP: #2093864)
    - d/l-d-config-network.postinst: add explicit virsh net-start workaround
    - d/control: add libvirt-clients Recommends to l-d-config-network
    - d/l-d-config-network.dirs: add var/libvirt/dnsmasq to store lease files
      to avoid a warning on install
  * Drop Changes:
    - d/libvirt-daemon-system.postinst: fix old libvirt-dnsmasq users group
      [Upgrade path for 4.0.0-1ubuntu5~ not relevant anymore]

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Wed, 11 Jun 2025 13:11:23 +0200

libvirt (11.4.0-1) experimental; urgency=medium

  * [f8bc946] New upstream version 11.4.0
  * [f4cca9f] control: daemon-common Depends on kmod
  * [3dd784b] control: Drop several Build-Depends

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 05 Jun 2025 00:07:28 +0200

libvirt (11.3.0-3) unstable; urgency=medium

  * [d10b70f] patches: Add backports
    - backport/qemu-Be-more-forgiving-when-acquiring-QUERY-job-[...]

 -- Andrea Bolognani <eof@kiyuko.org>  Wed, 02 Jul 2025 22:15:28 +0200

libvirt (11.3.0-2) unstable; urgency=medium

  * [eb4a97a] patches: Add backports
    - backport/[...]-Don-t-setup-qemu-for-inco.patch
      - Closes: #1104735

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 01 Jun 2025 16:39:44 +0200

libvirt (11.3.0-1) unstable; urgency=medium

  * [228f666] New upstream version 11.3.0

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 02 May 2025 22:25:28 +0200

libvirt (11.2.0-3) experimental; urgency=medium

  * [0b16592] control: Introduce ARCHES_WIRESHARK
    - Don't build the Wireskark dissector on m68k or x32
  * [07012be] patches: Add debian/Drop-inter-package-Also-lines-[...]
    - Work around a limitation in deb-systemd-helper
    - Closes: #1082939
  * [c192aea] daemon-system: Only build on ARCHES_QEMU
    - It depends on the QEMU driver

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 22 Apr 2025 22:27:04 +0200

libvirt (11.2.0-2) unstable; urgency=medium

  * [d984f9c] control: Overhaul package descriptions
  * [0360fd6] patches: Add backport/cpu_map-Install-Ampere-1-[...]
    - Closes: #1102133

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 08 Apr 2025 11:57:53 +0200

libvirt (11.2.0-1) unstable; urgency=medium

  * [56cf4c6] New upstream version 11.2.0
  * [a5b5314] control: Bump Standards-Version to 4.7.2
    - No changes needed

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 04 Apr 2025 22:09:21 +0200

libvirt (11.1.0-2) experimental; urgency=medium

  * [9e2b202] snippets: Drop custom conffile transfer logic
    - It was intended to make upgrades smoother, but unfortunately
      it caused serious issues in certain scenarios. Let dpkg's
      built-in logic take care of everything instead
    - Closes: #1094583
  * [efe5fbc] daemon: Drop Recommends on non-QEMU hypervisor drivers
  * [904900c] control: Drop more unnecessary package relationships

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 23 Mar 2025 18:10:38 +0100

libvirt (11.1.0-1) unstable; urgency=medium

  * [da3bd66] New upstream version 11.1.0
  * [88ce3fd] control: Bump Standards-Version to 4.7.1
    - No changes needed

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 03 Mar 2025 22:15:15 +0100

libvirt (11.0.0-2) unstable; urgency=medium

  [ Michael Biebl ]
  * [4e3c6ef] daemon-config-*: Use dpkg triggers for daemon restart
    - Ensures that libvirtd is only ever restarted once per apt invocation

  [ Andrea Bolognani ]
  * [06d8044] daemon-driver-*: Restart daemon on install/remove
    - Makes newly-installed drivers usable right away
  * [12ebaf7] patches: Add backport/virsysinfo-fix-RISC-V-detection.patch
    - Closes: #1093823

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 30 Jan 2025 23:47:39 +0100

libvirt (11.0.0-1) unstable; urgency=medium

  * [e2a1251] New upstream version 11.0.0
    - Closes: #1089607
    - Closes: #1092220

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 17 Jan 2025 23:39:10 +0100

libvirt (10.10.0-4) unstable; urgency=medium

  [ Pino Toscano ]
  * [38ace20] Unconditionally enable LXC support on all Linux architectures
    - Previously we had to explicitly avoid enabling it on ia64, but now that
      the architecture has been dropped from Debian we can simplify things

  [ Maximilian Engelhardt ]
  * [c8f1b0f] Remove armhf from ARCHES_XEN
    - As of 4.19.1-1, Xen is no longer being built on armhf
    - Closes: #1090990

  [ Andrea Bolognani ]
  * [db8e6b7] patches: Add backport/lxc-remove-no-longer-working-netns-[...]
    - Closes: #1088929
  * [a0ba9b4] control: Once again prefer iptables for the network driver
    - Undoes the change introduced in 10.10.0-2
    - Unfortunately there are serious compatibility issues between the
      nftables backend and popular software such as Docker and ufw, so it's
      not a suitable default for Debian
    - It's still possible for users to manually switch to the nftables
      backend and uninstall iptables if they so desire
    - Closes: #1090355

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 27 Dec 2024 15:33:23 +0100

libvirt (10.10.0-3) unstable; urgency=medium

  [ Heinrich Schuchardt ]
  * [7e373ad] virt-aa-helper: allow riscv64 EDK II

  [ Andrea Bolognani ]
  * [117e0da] patches: Add backport/qemu-tpm-do-not-update-[...]
    - Fixes daemon crash when transient domains with TPM are defined
    - Closes: #1089616

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 13 Dec 2024 22:27:38 +0100

libvirt (10.10.0-2) experimental; urgency=medium

  [ Carles Pina i Estany ]
  * [571578c] debconf: Add Catalan translation

  [ Andrea Bolognani ]
  * [4a7c66d] control: Prefer nftables for the network driver
    - Closes: #938929
  * [065cbe9] control: Introduce ssh-proxy package

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 05 Dec 2024 23:39:07 +0100

libvirt (10.10.0-1) unstable; urgency=medium

  * [24c4515] New upstream version 10.10.0

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 02 Dec 2024 23:54:42 +0100

libvirt (10.9.0-2) experimental; urgency=medium

  * [49e8455] patches: Drop forward/Reduce-udevadm-settle-timeout-[...]
    - This workaround should no longer be needed
  * [c1978c6] control: daemon Depends on daemon-log
    - libvirtd.service can't start if virtlogd.socket is not present
  * [81015c2] control: daemon-driver-lxc Depends on daemon-driver-network
    - The LXC driver uses the network driver directly
  * [f73bb3c] control: daemon-driver-storage-* Depends on daemon-driver-storage
    - The drivers for the various storage technologies are completely
      useless if the main storage driver is not present
  * [8b727e3] control: Fix Depends between arch:any and arch:all packages
    - In a few cases, the relationship was declared incorrectly
    - Closes: #1056988
  * [f316a89] control: daemon-driver-storage only Suggests nfs-common
    - It was accidentally turned into a Recommends in 10.6.0-2
    - Closes: #1081981
  * [7d61238] control: Drop Recommends on init system
    - Daemons generally don't declare this kind of relationship towards
      init systems in Debian
  * [3785ee5] control: daemon-driver-qemu Depends on systemd-container
    - The QEMU driver talks to systemd-machined
    - The dependency already existed, but it was a Recommends until now
  * [96d3775] control: daemon-driver-lxc Depends on systemd-container
    - The LXC driver talks to systemd-machined
  * [527cf92] control: Drop Depends on firewalld
    - libvirt talks to firewalld if it's installed, but doesn't need it
      to implement any of its functionality
  * [d9fb1b0] control: daemon-driver-qemu Depends on QEMU itself
    - The QEMU driver can't do anything useful without it
  * [e994d4c] control: Introduce ARCHES_DMIDECODE
    - daemon-common now Depends on dmidecode on all architectures where
      the latter is getting built

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 14 Nov 2024 00:38:07 +0100

libvirt (10.9.0-1) unstable; urgency=medium

  * [d7c9487] New upstream version 10.9.0

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 01 Nov 2024 17:25:34 +0100

libvirt (10.8.0-1) unstable; urgency=medium

  * [d22a732] New upstream version 10.8.0
    - Update for qemu-bridge-helper's new location (Closes: #1082530)
  * [b9137d5] patches: Drop old backports
  * [a720c4e] patches: Add new backports
    - backport/Revert-network-un-set-the-firewalld-zone-while-[...]
    - backport/Revert-network-support-setting-firewalld-zone-[...]
    - backport/network-call-network-Add-Remove-FirewallRules-[...]
    - backport/network-a-different-way-of-supporting-firewalld-[...]
    - backport/network-a-different-implementation-of-un-setting-[...]
  * [1b48d33] control: Replace libyajl with libjson-c
    - The former is no longer maintained upstream
  * [84fda34] control: Add Build-Depends on libbsd-dev
    - readpassphrase() is now used instead of getpass()
  * [386ce9b] control: Drop Build-Depends on nfs-common
    - showmount's presence is now detected at runtime

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 13 Oct 2024 11:41:48 +0200

libvirt (10.7.0-3) unstable; urgency=medium

  * [70a5d8d] patches: Add backport/apparmor-Don-t-check-for[...]
    - Ensures that AppArmor doesn't get disabled for QEMU domains
      just because the LXC driver is not installed (Closes: #1081396)

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 16 Sep 2024 21:41:15 +0200

libvirt (10.7.0-2) unstable; urgency=medium

  * [6fb4103] control: Turn dmidecode back into a Recommends
    - It was accidentally made it into a Depends in 10.6.0-2,
      which has resulted in libvirt-daemon being uninstallable on
      architectures that don't have dmidecode (e.g. ppc64el)

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 08 Sep 2024 15:15:11 +0200

libvirt (10.7.0-1) unstable; urgency=medium

  * [a84ccbd] New upstream version 10.7.0
    - Update for qemu-bridge-helper's new location (Closes: #1077915)
    - Fixes CVE-2024-8235 (Closes: #1080218)

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 05 Sep 2024 20:59:27 +0200

libvirt (10.6.0-3) experimental; urgency=medium

  * [01e7456] control: Bump Standards-Version to 4.7.0
    - No changes needed.
  * [b172fde] control: Change some Breaks+Replaces to Conflicts
    - Prevents file loss scenarios during upgrade (DEP17 M7)
    - Thanks to Helmut Grohne
  * [4f20e64] snippets: Create protective diversions
    - Prevents file loss scenarios during upgrade (DEP17 M8)
    - Thanks to Helmut Grohne

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 01 Sep 2024 16:31:02 +0200

libvirt (10.6.0-2) experimental; urgency=medium

  * [9333950] control: Introduce daemon-common package
    + As well as a bunch more. In general, every single driver and
      storage backend comes with its own binary package now, which
      makes it possible to decide exactly what gets installed
  * [d776368] control: Mark daemon-system-* packages as dummy
    + Configuration for the daemon is now shipped in libvirt-daemon
  * [0ac1f2c] control: Mark sanlock package as dummy
    + Replaced by libvirt-daemon-plugin-sanlock
  * [cf64ba3] install: Perform usr-merge transition
    - Thanks to Michael Biebl, Helmut Grohne (Closes: #1064126)

 -- Andrea Bolognani <eof@kiyuko.org>  Sat, 24 Aug 2024 13:37:16 +0200

libvirt (10.6.0-1) unstable; urgency=medium

  * [65e5d2b] New upstream version 10.6.0
  * [cca0f9c] control: Drop Build-Depends on pm-utils
    - Support is explicitly disabled
  * [963bd56] control: Drop Build-Depends on systemd
    - It's not used
  * [7c418f9] control: Suggest daemon on Linux only
    - It doesn't get built elsewhere
  * [664a6db] control: Enable more features on loong64.
    - Start building the QEMU and LXC hypervisor drivers as
      well as the glusterfs and ceph storage drivers
    - Thanks to Dandan Zhang (Closes: #1075758)

 -- Andrea Bolognani <eof@kiyuko.org>  Wed, 07 Aug 2024 02:50:03 +0200

libvirt (10.5.0-1) unstable; urgency=medium

  * [a8c62f5] New upstream version 10.5.0
    - Fixes qemu:///session (Closes: #1072723, #1072769)

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 04 Jul 2024 00:44:29 +0200

libvirt (10.4.0-1) unstable; urgency=medium

  * [7ed6608] New upstream version 10.4.0
  * [d8acf23] patches: Drop backports

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 04 Jun 2024 00:19:48 +0200

libvirt (10.3.0-3) unstable; urgency=medium

  * [aa7ed20] patches: Add backport/tests-fix-hang-in-virshtest[...]
    - Fixes FTBFS

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 09 May 2024 00:03:19 +0200

libvirt (10.3.0-2) unstable; urgency=medium

  * [13f1f61] patches: Add backport/vsh-Don-t-init-history[...]
    - Fixes FTBFS (Closes: #1070498)

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 07 May 2024 00:04:24 +0200

libvirt (10.3.0-1) unstable; urgency=medium

  * [7845089] New upstream version 10.3.0
  * [be65bee] patches: Add backport/rpc-ensure-temporary-GSource[...]
    - Fixes CVE-2024-4418 (Closes: #1070330)

 -- Andrea Bolognani <eof@kiyuko.org>  Sat, 04 May 2024 00:16:21 +0200

libvirt (10.2.0-1) unstable; urgency=medium

  * [c1118d1] New upstream version 10.2.0
    - Fixes CVE-2024-2494 (Closes: #1067461)

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 02 Apr 2024 23:42:38 +0200

libvirt (10.1.0-1) unstable; urgency=medium

  * [517918e] New upstream version 10.1.0
    - Fixes CVE-2024-1441 (Closes: #1066058)
  * [84128fe] patches: Drop backports

 -- Andrea Bolognani <eof@kiyuko.org>  Wed, 20 Mar 2024 00:18:12 +0100

libvirt (10.0.0-3) experimental; urgency=medium

  * [e31fc9e] control: Recommend pkgconf instead of pkg-config
  * [fd2edf5] templates: Convert some files to templates
    - Some of the packaging files are now maintained as templates,
      where values are dynamically injected at build time. See
      debian/README.source for additional information
  * [ff0974e] control: Improve driver-specific package relationships
    - Ensure installability on architectures where the QEMU
      driver has been intentionally disabled

 -- Andrea Bolognani <eof@kiyuko.org>  Wed, 21 Feb 2024 23:04:34 +0100

libvirt (10.0.0-2) unstable; urgency=medium

  * [9a4ad47] patches: Add backport/scripts-Make-check-symfile[...]
    - Fixes compilation on alpha
  * [aa930a3] patches: Add backport/apparmor-Add-user-session-path[...]
    - Fixes use of passt with qemu:///session and AppArmor enabled
    - Closes: #1061678
  * [8810281] rules: Don't attempt to update git submodules
  * [bf4fab1] rules: Don't run syntax-check tests

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 04 Feb 2024 10:54:58 +0100

libvirt (10.0.0-1) unstable; urgency=medium

  * [c80339d] New upstream version 10.0.0

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 16 Jan 2024 23:11:05 +0100

libvirt (9.10.0-1) unstable; urgency=medium

  * [520e93f] New upstream version 9.10.0
  * [59b48a9] patches: Drop obsolete patches
    - forward/Pass-GPG_TTY-env-var-to-the-ssh-binary.patch
  * [1aa8420] control: Recommend passt with QEMU driver

 -- Andrea Bolognani <eof@kiyuko.org>  Sat, 02 Dec 2023 00:13:16 +0100

libvirt (9.9.0-1) unstable; urgency=medium

  * [df62dc1] New upstream version 9.9.0
  * [80870c1] patches: Drop obsolete patches
    - backport/meson-Improve-nbdkit-configurability.patch
    - forward/meson-Fix-XDR-check-for-GNU-Hurd.patch

 -- Andrea Bolognani <eof@kiyuko.org>  Sat, 04 Nov 2023 00:36:00 +0100

libvirt (9.8.0-2) unstable; urgency=medium

  [ Michal Maloszewski ]
  * [03d707d] libvirtd.default: Document TCP/TLS usage
    - Closes: #1050464
    - LP: #1960937

  [ Andrea Bolognani ]
  * [53f248b] control: Make more packages Linux-only
    - Among the packages that are currently arch:any only libvirt0,
      libvirt-dev and libvirt-clients make sense on non-Linux
  * [f1f8713] patches: Add forward/meson-Fix-XDR-check-for-GNU-Hurd.patch
    - Make it possible to build on hurd-i386

 -- Andrea Bolognani <eof@kiyuko.org>  Fri, 13 Oct 2023 13:55:07 +0200

libvirt (9.8.0-1) unstable; urgency=medium

  [ Pino Toscano ]
  * [a3a1f2e] Enable the rbd/ceph storage driver only on 64bit architectures
    - Closes: #1053168

  [ Andrea Bolognani ]
  * [c52c885] New upstream version 9.8.0
  * [9c190ce] patches: Add backports
    - backport/meson-Improve-nbdkit-configurability.patch
  * [c24237a] rules: Temporarily disable nbdkit support
    - AppArmor support is not ready yet

 -- Andrea Bolognani <eof@kiyuko.org>  Thu, 05 Oct 2023 23:27:45 +0200

libvirt (9.7.0-1) unstable; urgency=medium

  * [4864e4d] New upstream version 9.7.0
  * [c25e497] patches: Drop backports
  * [fa6ecf6] dirs: Don't ship channels directory
    - The sockets used to implement channels for QEMU domains are
      ephemeral runtime data, and are now correctly created
      under /run/libvirt instead of /var/lib/libvirt

 -- Andrea Bolognani <eof@kiyuko.org>  Wed, 13 Sep 2023 21:47:40 +0200

libvirt (9.6.0-3) experimental; urgency=medium

  * [e380ddb] rules: Fix handling of ARCHES_{QEMU,LXC}
    - Deal correctly with contents, such as configuration files,
      that are specific to some hypervisor driver

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 21 Aug 2023 21:49:04 +0200

libvirt (9.6.0-2) experimental; urgency=medium

  * [6456ab6] control: Drop Build-Depends on qemu-system-common
    - No longer needed
  * [cd2ed06] rules: Introduce ARCHES_QEMU
    - Only build the QEMU hypervisor driver on architectures where
      QEMU system emulator binaries are available

 -- Andrea Bolognani <eof@kiyuko.org>  Sun, 20 Aug 2023 21:00:40 +0200

libvirt (9.6.0-1) unstable; urgency=medium

  * [74213a2] New upstream version 9.6.0
    - Fixes CVE-2023-3750 (Closes: #1041811)
  * [cc3a788] control: Require AppArmor 3
  * [54d65bd] patches: Add backports
    - backport/src-fix-max-file-limits-in-systemd-services.patch

 -- Andrea Bolognani <eof@kiyuko.org>  Sat, 05 Aug 2023 19:01:56 +0200

libvirt (9.5.0-2) unstable; urgency=medium

  [ Pino Toscano ]
  * [2adb625] Enable the glusterfs storage driver only on 64bit architectures

 -- Andrea Bolognani <eof@kiyuko.org>  Tue, 25 Jul 2023 20:04:51 +0200

libvirt (9.5.0-1) unstable; urgency=medium

  * [cd75481] New upstream version 9.5.0

 -- Andrea Bolognani <eof@kiyuko.org>  Mon, 03 Jul 2023 20:58:18 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libvirt-doc`.
