postfix (3.8.6-1ubuntu0.1) noble-security; urgency=medium

  * SECURITY UPDATE: crash via an enhanced status code that lacks text after the
    third number
    - debian/patches/CVE-2026-43964.patch: fix buffer over-read when an enhanced
      status code is not followed by other text in src/global/dsn_util.c.
    - CVE-2026-43964

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 05 May 2026 11:47:29 -0400

postfix (3.8.6-1build2) noble; urgency=high

  * No change rebuild against libssl3t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:48:02 +0200

postfix (3.8.6-1build1) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 17:02:05 +0000

postfix (3.8.6-1) unstable; urgency=medium

  [Scott Kitterman]

  * Remove lib/systemd/system-generators from d/postfix.dirs.  Closes: #1059760
  * Update with wrap-and-sort
  * Refactor d/p/Sort-list-of-AUXLIBS-for-reproducible-builds.patch based on
    upstream feedback
  * Mark d/p/Sort-list-of-AUXLIBS-for-reproducible-builds.patch as forwarded
  * Add libnsl-dev to build-depends, split from libc6-dev.  Closes: #1065158
  * Build-depend on pkgconf instead of obsolete pkg-config

  [localization folks]

  * l10n: Updated Swedish debconf translations. (Martin Bagge, Anders
    Jonsson).  Closes: #1061564

  [Wietse Venema]

  * 3.8.6

 -- Scott Kitterman <scott@kitterman.com>  Tue, 05 Mar 2024 10:24:36 -0500

postfix (3.8.5-1) unstable; urgency=medium

  [Wietse Venema]

  * 3.8.5

  [Christian Göttsche]

  * Drop unnecessary manual hardening CFLAGS, drop unused variables,
    drop obsolete suidunregister handling, and use generic destination
    variable in more places
  * Install systemd generator into canonical directory (Closes: #1059760)
  * Rely on dh_lintian to install Lintian overrides
  * Sort list of AUXLIBS for reproducible builds
  * Add Documentation key to resolvconf service

 -- Scott Kitterman <scott@kitterman.com>  Mon, 22 Jan 2024 09:47:09 -0500

postfix (3.8.4-1) unstable; urgency=medium

  [Wietse Venema]

  * 3.8.4 Closes: #1059230

 -- Scott Kitterman <scott@kitterman.com>  Fri, 22 Dec 2023 13:02:36 -0500

postfix (3.8.3-1) unstable; urgency=medium

  [Helmut Grohne]

  * Install units using dh_installsystemd only.  Closes: #1054485

  [Wietse Venema]

  * 3.8.3

 -- Scott Kitterman <scott@kitterman.com>  Thu, 21 Dec 2023 13:43:33 -0500

postfix (3.8.2-1) unstable; urgency=medium

  [Scott Kitterman]

  * Correct 3.8.1-2 debian/changelog entry

  [Wietse Venema]

  * 3.8.2

  [localization folks]

  * l10n: Update Romanian debconf translations. (Remus-Gabriel Chelu)

 -- Scott Kitterman <scott@kitterman.com>  Thu, 14 Sep 2023 14:08:10 -0400

postfix (3.8.1-2) unstable; urgency=medium

  [Scott Kitterman]

  * Delete debian/patches/02_kfreebsd_support.diff, no longer needed
  * Drop debian/patches/04_remove_gdbm_support.diff, obsolete
  * Add/update patch headers, particularly Forwarded status
  * Rename collate.pl patch to 71_debianize_collate.pl.diff
  * Fix spelling error in d/changelog
  * Do not use full path for ypcat and update-inetd in postinst and
    suidunregister in preinst
  * Update debconf templates
  * Correct regression that caused postfix set-permissions to fail (Closes:
    #1040329)
    - Restore and update debian/patches/05_debian_manpage_differences.diff
    - Restore and update debian/patches/05_debian_readme_differences.diff
  * Update autopkgtest to test postfix set-permissions

  [localization folks]

  * l10n: Add Romanian debconf translations.  Closes: #1039560 (Remus-Gabriel
    Chelu)

 -- Scott Kitterman <scott@kitterman.com>  Thu, 06 Jul 2023 00:18:21 -0400

postfix (3.8.1-1) unstable; urgency=medium

  [Christian Göttsche]

  * Bump _FORTIFY_SOURCE to level 3
  * Enable stack clash protection

  [Scott Kitterman]

  * Refresh and update patches for 3.8.1
  * Update default master.cf for new installs to comment out maildrop and
    external delivery methods to match upstream, these all require additional
    configuration.  Closes: #1033346
  * Delete unconditional call to fix_master and clarify wording of main.cf
    status message in postfix.postinst.  Closes: #1035350
  * Minor wording improvements in d/po/templates.pot.  Closes: #1028095

  [Wietse Venema]

  * 3.8.0 (Closes: #1036161)
  * 3.8.1

 -- Scott Kitterman <scott@kitterman.com>  Sat, 10 Jun 2023 09:31:37 -0400

postfix (3.7.5-2) unstable; urgency=medium

  [Sergio Durigan Junior]

  * Update autopkgtest to work with new sasl2-bin service file.
    Closes: #1032306

 -- Scott Kitterman <scott@kitterman.com>  Wed, 03 May 2023 10:27:40 -0400

postfix (3.7.5-1) unstable; urgency=medium

  [Scott Kitterman]

  * Fix typo in d/changelog
  * Update d/watch to only look for 3.7.x updates for bookworm

  [localization folks]

  * l10n: Updated Turkish debconf translations. (Atila KOÇ).  Closes: #1032459

  [Wietse Venema]

  * 3.7.5
    - Bugfix (introduced: Postfix 3.4): the posttls-finger command
      failed to detect that a connection was resumed in the case
      that a server did not return a certificate. Viktor Dukhovni.
      File: posttls-finger/posttls-finger.c.

    - Workaround: OpenSSL 3.x EVP_get_cipherbyname() can return
      lazily-bound handles. Postfix now checks that the expected
      functionality will be available instead of failing later.
      Fix by Viktor Dukhovni. File: tls/tls_server.c.

    - Bugfix (introduced: Postfix 3.5): check_ccert_access did
      not parse inline map specifications. Report and fix by Sean
      Gallagher. File: global/map_search.c.

    - Safety: the long form "{ name = value }" in import_environment
      or export_environment is not documented, but accepted, and
      it was stored in the process environment as the invalid
      form "name = value", thus not setting or overriding an entry
      for "name". This form is now stored as the expected
      "name=value". Found during code maintenance. Also refined
      the "missing attribute name" detection. Files: clean_env.c,
      split_nameval.c.

    - Bugfix (introduced: Postfix 3.2): the MySQL client could
      return "not found" instead of "error" during the time that
      all MySQL server connections were turned down after error.
      Found during code maintenance. File: global/dict_mysql.c.

 -- Scott Kitterman <scott@kitterman.com>  Sun, 30 Apr 2023 13:53:55 -0400

postfix (3.7.4-2) unstable; urgency=medium

  [Christian Göttsche]

  * Add patch to disable LD_LIBRARY_PATH check
  * Update postfix homepage supporting https
  * Merge restorecon calls
  * d/postinst: fix mixed indentation
  * Quote variables and command output in scripts
  * Drop upgrade handling against ancient versions
  * Drop unnecessary script include
  * Do not manually stop and restart postfix.service
  * Switch to PCRE2 (Closes: #999988)

  [Scott Kitterman]

  * Build depend on libldap-dev instead of transitional libldap2-dev
  * Update lintian overrides
  * Drop ancient Breaks/Replaces on postfix 3.1.3-7~

 -- Scott Kitterman <scott@kitterman.com>  Tue, 24 Jan 2023 09:33:52 -0500

postfix (3.7.4-1) unstable; urgency=medium

  [Scott Kitterman]

  * Drop d/p/support_linux6, addressed upstream
  * Drop depends on obsolete package lsb-base

  [Wietse Venema]

  * 3.7.4 (Closes: #1011040) (LP: #1995312)

  [Sven Joachim]

  * Replace deprecated c_rehash with openssl rehash (Closes: #895089)

  [localization folks]
  * l10n: Updated German debconf translations. (Markus Hiereth)
    Closes: #1029113

 -- Scott Kitterman <scott@kitterman.com>  Sat, 21 Jan 2023 20:03:33 -0500

postfix (3.7.3-4) unstable; urgency=medium

  * Also add LINUX6 to sys_defs.h (thanks to Bo YU for the fix).
    Closes: #1028600

 -- Scott Kitterman <scott@kitterman.com>  Fri, 13 Jan 2023 18:42:01 -0500

postfix (3.7.3-3) unstable; urgency=medium

  [Scott Kitterman]

  * Add support for Linux 6 as a Linux major version in makedefs
  * Remove obsolete debian/postfix.NEWS
  * Update debian/copyright
  * Bump standards-version to 4.6.2 without further change

  [Gioele Barabucci]

  * d/postfix.postinst: Use sed instead of perl

  [Daniel Shahaf]

  * Fix generic maps terminology in README.Debian.  Closes: #1006345

  [localization folks]

  * l10n: Updated Dutch debconf translations. (Frans Spiesschaert)
    Closes: #1004316, #1025842
  * l10n: Updated Brazilian Portuguese debconf translations. (Paulo Henrique
    de Lima Santana)  Closes: #1024200
  * l10n: Updated German debconf translations. (Markus Hiereth)
    Closes: #1004011

 -- Scott Kitterman <scott@kitterman.com>  Wed, 11 Jan 2023 11:02:33 -0500

postfix (3.7.3-2) unstable; urgency=medium

  * Update autopkgtest expected return code for 3.7 changes

 -- Scott Kitterman <scott@kitterman.com>  Sun, 09 Oct 2022 01:33:38 -0400

postfix (3.7.3-1) unstable; urgency=medium

  [Scott Kitterman]

  * Add postfix-resolvconf.path/service to watch for resolv.conf changes and
    restart postfix using the existing hook if it is updated.  Closes: #1003152
  * Document in README.Debian that new postfix-resolvconf.path/service files
    need to be manually enabled if needed and override dh_installsystemd to
    that effect
  * Delete unused postfix lintian overrides
  * Fix spelling error in debian/postfix.postinst
  * Refresh patches, delete 05_debian_manpage_differences.diff and
    05_debian_readme_differences.diff, no longer needed

  [Wietse Venema]

  * 3.7.3 Closes: #1017313

 -- Scott Kitterman <scott@kitterman.com>  Sat, 08 Oct 2022 19:36:05 -0400

postfix (3.6.4-1) unstable; urgency=medium

  [Scott Kitterman]

  * Ignore changes to html files in debian/source/options
  * Delete d/p/postfix-dup-postconf.patch, included in upstream release
  * Add lintian-override for insecure URI - releases are signed
  * Make signing-key.asc minimal

  [Wietse Venema]

  * 3.6.4

  [Christian Göttsche]

  * Rework rules to use dh sequencer
  * Call subcommand via shell
  * Update cleaning to build package twice
  * Bump to debhelper compat level 13
  * Drop default include path and split CCARGS
  * Use mkdir -Z instead of subsequent running restorecon
  * Drop custom function pathfind in favor of command -v
  * Quote path in update-libc.d
  * Update postfix.config
  * Quote directory path in postfix-instance-generator
  * Drop check on postinst.functions in postfix-sqlite.prerm
  * Update postfix-add-policy script
  * Update postfix-add-filter script
  * Drop versioned symlinks to plugin libraries
  * Drop ldconfig calls in maintscripts
  * Support parallel build, except do not build man pages parallel

 -- Scott Kitterman <scott@kitterman.com>  Sat, 15 Jan 2022 18:41:26 -0500

postfix (3.6.3-5) unstable; urgency=medium

  [Wietse Venema]

  * Fix duplicate bounce_notice_recipient entries in postconf output.
    Closes: #999694

  [Scott Kitterman]

  * Remove left-over ca-certificates.crt file from postfix chroot.
    Closes: #991609
  * Align sysv init script start/stop/reload more to default init and drop
    d/p/09_quiet_startup.diff, no longer needed.
  * Add support for chroot_extra_files and chroot_extra_CAdir variables
    sourced from /etc/default/postfix to enable users to specify additional
    files needed in the chroot.  Closes: #948321
  * Add information about keeping resolv.conf up to date in the chroot with
    the resolvconf package.  Closes: #964762
  * Add collate.pl script as postfix-collate.  Closes: #941457

  [Christian Göttsche]

  * Drop unreproducible build paths from makedefs.out.
  * Enable Link Time Optimiation (LTO).

  [Sergio Gelato]

  * Correct if-up.d to not error out if postfix can't send mail yet.
    Closes: #959864

 -- Scott Kitterman <scott@kitterman.com>  Tue, 04 Jan 2022 15:20:02 -0500

postfix (3.6.3-4) unstable; urgency=medium

  [Scott Kitterman]

  * Update d/p/70_postfix-check.diff to exclude makedefs.out from symlink
    check.  Closes: #926331
  * Test that nothing is reported by postfix check in autopkgtest
  * Delete debian/patches/30_shared_libs.diff, no longer needed after linking
    corrections in debian/rules
  * Do not override user set default_transport in postinst.  Closes: #988538
  * Add overrides for incorrect unused-debconf-template results
  * Update debconf templates

  [Christian Göttsche]

  * Overhaul compiler flags
  * Ignore blhc false positives on for loop
  * Drop linking against local build libraries

 -- Scott Kitterman <scott@kitterman.com>  Tue, 28 Dec 2021 17:00:40 -0500

postfix (3.6.3-3) unstable; urgency=medium

  [Scott Kitterman]

  * Force rm of html/Makefile.in in install-indep to avoid potential FTBFS.
    Closes: #1002497
  * Make all debian/rules rm calls -f to support building when not root

  [Christian Göttsche]

  * Enable building with multiple jobs
  * Drop unnecessary linking libraries

 -- Scott Kitterman <scott@kitterman.com>  Sat, 25 Dec 2021 16:47:41 -0500

postfix (3.6.3-2) unstable; urgency=medium

  [Scott Kitterman]

  * Add postfix-mta-sts-resolver to suggests.  Closes: #968516
  * Include compatibility_level in addition to postifx version when
    determining default value for chroot in master.cf.  Closes: #995129
  * Fixup errors in postifx-add-* man pages.  Closes: #995031
  * Set compatibility level to 3.6 for fresh installs
  * Update main/master.cf.proto on upgrade if not modified.  Closes: #991513
  * Decruft debconf template:
    - Remove ancient (postfix 2.3) mydomain_warning
    - Delete old (Postfix 2.10) relay_restrictions_warning
    - Delete unused lmtp_retired_warning template
    - Delete unused kernel_version_warning template
    - Delete unused retry_upgrade_warning template
    - Delete unused tlsmgr_upgrade_warning template
  * Debconf template cleanup, thanks to Markus Hiereth for the suggestions.
    Closes: #905653

  [Miriam España Acebal]

  * Removed LDFLAG -Bsymbolic-functions to fix issue where TLS is disabled
    when private/tlmsgr socket is not found.  lp: #1885403

  [Christian Göttsche]

  * Update debian/patches/07_sasl_config.diff:
    - Fix conversion warnings by adding explicit cast
    - Drop unused function xsasl_getpath
  * Fix lintian detected typos in Debian packaging.
  * Do not require postfix to be build by root.
  * Set -e shell option explicitly.
  * Bump watch file standard to version 4.
  * Add misc:Pre-Depends to postfix.
  * Remove trailing spaces in changelog.
  * Add Documentation key to postfix service.
  * Drop alternative dependency on obsolete libmysqlclient-dev.
  * Add standard salsa ci configuration.
  * Drop unused debconf template sqlite_warning.

  [Paride Legovini]

  * d/postfix.postinst: tolerate search domain with a leading dot.
    Closes: #991950

  [Sergio Durigan Junior]

  * Support networkd-dispatcher.  Closes: #999867  lp: #1718227

 -- Scott Kitterman <scott@kitterman.com>  Thu, 23 Dec 2021 00:18:30 -0500

postfix (3.6.3-1) unstable; urgency=medium

  [Scott Kitterman]

  * Add license information from TLS_LICENSE.  Closes: #991610
  * Additional debian/copyright updates
  * Refresh patches
  * Add Pre-Depends on init-system-helpers (>= 1.54~) due to use of
    --skip-systemd-native flag
  * Update lintian overrides
  * Bump standards-version to 4.6.0 without further change

  [Wietse Venema]

  * 3.6.3

 -- Scott Kitterman <scott@kitterman.com>  Tue, 21 Dec 2021 00:13:25 -0500

postfix (3.5.13-1) unstable; urgency=medium

  [Wietse Venema]

  * 3.5.13

  [Aaron Thompson]

  * Support non-default instance config directories.

  [Scott Kitterman]

  * Refresh patches

 -- Scott Kitterman <scott@kitterman.com>  Sat, 13 Nov 2021 16:05:59 -0500

postfix (3.5.6-1) unstable; urgency=medium

  [Dominic Raferd]

  * Fix configure-instance.sh for postfix 3.0+ chroot default.  Closes: #959517

  [Scott Kitterman]

  * Refresh patches
  * Delete debian/patches/tls_version.diff - incorporated upstream

  [Wietse Venema]

  * 3.5.5
  * 3.5.6

 -- Scott Kitterman <scott@kitterman.com>  Sun, 02 Aug 2020 17:11:04 -0400

postfix (3.5.4-1) unstable; urgency=medium

    [Wietse Venema]

  * 3.5.4

 -- Scott Kitterman <scott@kitterman.com>  Mon, 29 Jun 2020 21:16:04 -0400

postfix (3.5.3-1) unstable; urgency=medium

  [Wietse Venema]

  * 3.5.3 LP: #1881196

  [Debian Janitor]

  * Trim trailing whitespace.
  * Fix day-of-week for changelog entries 0.0.20001030.SNAPSHOT-4,
    0.0.20001030.SNAPSHOT-3, 0.0.19991231pl02-1, 0.0.19990122-1.

 -- Scott Kitterman <scott@kitterman.com>  Mon, 15 Jun 2020 16:23:34 -0400

postfix (3.5.2-1) unstable; urgency=medium

  [Scott Kitterman]

  * Update README.Debian to mention postfix-doc.  Closes: #234009
  * Spelling fixes in README.Debian

  [Wietse Venema]

  * 3.5.2

  [Cody Brownstein]

  * Fix README.Debian instructions for SMTP generic mapping and related
    example

 -- Scott Kitterman <scott@kitterman.com>  Mon, 18 May 2020 15:25:47 -0400

postfix (3.5.1-1) unstable; urgency=medium

  [Scott Kitterman]

  * Delete d/p/gcc_10_glibc_2_31.patch, incorporated in 3.5.1

  [Wietse Venema]

  * 3.5.1

 -- Scott Kitterman <scott@kitterman.com>  Mon, 20 Apr 2020 17:21:21 -0400

postfix (3.5.0-2) unstable; urgency=medium

  [Scott Kitterman]

  * Add patch from upstream for GCC-10 and Glibc 2.31 support.  Closes: #957697

  [Aaron Thompson]

  * Fix bug in tls_CApath copying.  LP: #1872288

 -- Scott Kitterman <scott@kitterman.com>  Fri, 17 Apr 2020 11:51:01 -0400

postfix (3.5.0-1) unstable; urgency=medium

  [Scott Kitterman]

  * Drop debian/patches/80_glibc2.30-ftbfs.diff, incorporated upstream
  * Refresh patches

  [Wietse Venema]

  * 3.5.0

 -- Scott Kitterman <scott@kitterman.com>  Mon, 16 Mar 2020 16:32:19 -0400

postfix (3.4.10-1) unstable; urgency=medium

  [Scott Kitterman]

  * Update postfix.postinst text to refer to systemctl vice service

  [Wietse Venema]

  * 3.4.10

 -- Scott Kitterman <scott@kitterman.com>  Fri, 13 Mar 2020 01:11:35 -0400

postfix (3.4.9-1) unstable; urgency=medium

  [Scott Kitterman]

  * Correct Debian's smtp (8) man page name in d/p/debian-man-name.diff for
    lmtp.  Closes: #920356
  * Fix d/init.d running change so it works with multi-instance again
    - Thanks to jaroslav@thinline.cz for the fix.  Closes: #944922
  * Bump standards-version to 4.5.0 without further change
  * Switch from debian/compat to debhelper-compat and bump compat to 12
      - Update debian/rules to use dh_installsystemd instead of
        dh_systemd_enable and dh_systemd_start
      - Update debian/rules for new example install path

  [Wietse Venema]

  * 3.4.9

 -- Scott Kitterman <scott@kitterman.com>  Sat, 15 Feb 2020 22:34:22 -0500

postfix (3.4.8-1) unstable; urgency=medium

  [Scott Kitterman]

  * Stop generating obsolete Upstream substvar
  * Bump standards-version to 4.4.1 without further change
  * Use -l instead of LD_LIBRARY_PATH for dh_shlibdeps
  * Check GPG signature when downloading new versions via uscan

  [Wietse Venema]

  * 3.4.8

 -- Scott Kitterman <scott@kitterman.com>  Sun, 12 Jan 2020 02:26:14 -0500

postfix (3.4.7-2) unstable; urgency=medium

  [Andreas Hasenack]

  * Update autopkgtest to use python3.  Closes: #943212  LP: #1845334

  [Scott Kitterman]

  * Update smtp_tls_CApath to /etc/ssl/certs so it actually works.
    Closes: #923083
  * Refactor running status detection in sysv init based on upstream
    postfix-script so it works in docker.  Closes: #941293

 -- Scott Kitterman <scott@kitterman.com>  Sun, 03 Nov 2019 13:09:50 -0500

postfix (3.4.7-1) unstable; urgency=medium

  [Andreas Hasenack]

  * d/p/80_glibc2.30-ftbfs.diff: fix build with glibc 2.30 (LP: #1842923)

  [Scott Kitterman]

  * Refresh patches
  * Modernize default TLS setup:
    - Drop addition of smtpd_tls_session_cache_database to TLS parameters (no
      longer needed since TLS session tickets are used now).  Closes: #934803
    - Replace use of obsolescent smtpd_use_tls=yes with
      smtpd_tls_security_level=may in default TLS setting.  Closes: #520936
    - Add smtp_tls_security_level=may to default TLS settings so that both
      client and server TLS are now enabled be default for new installations.
      Closes: #163144
    - Stop copying smtp_tls_CAfile into chroot, not needed per postfix docs
    - Also copy smtpd_tls_CApath files into chroot.  Closes: #579248
    - Add smtp_tls_CApath using /usr/share/ca-certificates/ to default TLS
      configuration so postfix smtp client can use the system certificate
      store to verify smtp server certificates, add ca-certificates to postfix
      Recommends.  Closes: #923083
  * Bump standards version to 4.4.0 without further change
  * Fix spelling errors in Debian provided man pages

  [Christian Göttsche]

  * Fix debian/rules so build flags are applied Closes: #879668

  [Wietse Venema]

  * 3.4.6
  * 3.4.7

 -- Scott Kitterman <scott@kitterman.com>  Sun, 22 Sep 2019 16:21:17 -0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog postfix-doc`.
