cyborg (16.0.0+git+2026.04.26.b8edfa06f1-1) unstable; urgency=medium

  * New upstream release based on top of stable branch. Includes CVE fixes:
    CVE-2026-40213: Cyborg uses rule:allow (check_str='@') as the default
    policy for multiple API endpoints. This unconditionally authorizes any
    request carrying a valid Keystone token regardless of roles, project
    membership, or scope. An authenticated user with zero role assignments can
    complete various actions such as reprogramming FPGA bitstreams on arbitrary
    compute nodes via agent RPC.
    CVE-2026-40214: The Accelerator Request (ARQ) API does not enforce project
    ownership at any layer. The project_id column in the database is never
    populated (NULL for every ARQ), database queries have no project filtering,
    and policy checks are self-referential (the authorize_wsgi decorator
    compares the caller's project_id with itself rather than the target
    resource). Any authenticated non-admin user can complete various actions
    such as deleting ARQs bound to other projects' instances, aka cross-tenant
    denial of service.

 -- Thomas Goirand <zigo@debian.org>  Mon, 11 May 2026 10:36:13 +0200

cyborg (16.0.0-2) unstable; urgency=medium

  * Fix "su" parameters order.

 -- Thomas Goirand <zigo@debian.org>  Mon, 13 Apr 2026 12:25:58 +0200

cyborg (16.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 01 Apr 2026 14:03:44 +0200

cyborg (16.0.0~rc2-1) unstable; urgency=medium

  * New upstream release.
  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 27 Mar 2026 09:37:09 +0100

cyborg (16.0.0~rc1-2) experimental; urgency=medium

  * Set OS_OSLO_MESSAGING_RABBIT__PROCESSNAME in api init script.

 -- Thomas Goirand <zigo@debian.org>  Wed, 18 Mar 2026 10:26:47 +0100

cyborg (16.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Removed --format when building the policy yaml file.
  * Fixed (build-)depends for this release.

 -- Thomas Goirand <zigo@debian.org>  Tue, 17 Mar 2026 22:12:33 +0100

cyborg (15.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 01 Oct 2025 21:47:52 +0200

cyborg (15.0.0~rc1-3) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Mon, 29 Sep 2025 00:25:20 +0200

cyborg (15.0.0~rc1-2) experimental; urgency=medium

  * Fixed UWSGI_INI_APP= in api init script.

 -- Thomas Goirand <zigo@debian.org>  Thu, 18 Sep 2025 22:04:28 +0200

cyborg (15.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Switch API to use module=cyborg.wsgi.api:application instead of wsgi-file.

 -- Thomas Goirand <zigo@debian.org>  Fri, 12 Sep 2025 08:28:24 +0200

# For older changelog entries, run 'apt-get changelog python3-cyborg'
