freeipa (4.12.4-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2024-11029 (Closes: #1093383)
    - CVE-2025-4404 (Closes: #1108050)
  * control: Demote libnss-myhostname to Suggests. (ref. #1006829)
  * patches: Fix samba lock directory location. (Closes: #1012593)
  * patches: Map nobody group to nogroup on Debian. (Closes: #1012592)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 Jun 2025 12:40:45 +0300

freeipa (4.12.2-3) unstable; urgency=medium

  * control: Add libnss-myhostname to client depends. (Closes: #1006829)
  * control: Add python3-ifaddr to ipalib depends. (Closes: #1089716)
  * control: Add python3-sphinx to build-depends. (Closes: #1003179,
    #1044642, #1049799)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 04 Feb 2025 21:06:42 +0200

freeipa (4.12.2-2) unstable; urgency=medium

  * control: Migrate to bind9-dnsutils. (Closes: #1094939)

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 01 Feb 2025 20:09:51 +0200

freeipa (4.12.2-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2024-2698 (Closes: #1077682)
    - CVE-2024-3183 (Closes: #1077683)
  * control: Drop conflicts on systemd-timesyncd as upstream recognizes
    it now. (Closes: #1072168)
  * use-raw-strings.diff: Dropped, upstream.
  * rules: Fix installing bash-completions. (Closes: #1089329)
  * control: Drop python3-nose from build-depends, unused. (Closes:
    #1018359)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 09 Dec 2024 15:34:56 +0200

freeipa (4.11.1-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Replace systemd Build-Depends with systemd-dev for systemd.pc.
    (Closes: #1060469)

 -- Michael Biebl <biebl@debian.org>  Wed, 17 Jul 2024 19:35:06 +0200

freeipa (4.11.1-2) unstable; urgency=medium

  * use-raw-strings.diff: Import patch from upstream to fix noise when
    installing. (LP: #2060298)
  * map-ssh-service.diff: Map sshd service to use ssh.service. (LP:
    #2061055)

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 12 Apr 2024 14:31:35 +0300

freeipa (4.11.1-1) unstable; urgency=medium

  * New upstream release.
  * control: Add sssd-passkey to freeipa-client Recommends.
  * control.server: Drop python3-paste from python3-ipatests depends,
    obsolete.
  * control, rules: Replace hardcoded librpm9 depends. (Closes:
    #1067570)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 10 Apr 2024 15:59:30 +0300

freeipa (4.10.2-2) unstable; urgency=medium

  [ Timo Aaltonen ]
  * control: Bump certmonger dependency.

  [ Helmut Grohne ]
  * Fix FTBFS when systemd.pc changes systemdsystemunitdir. (Closes:
    #1052641)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 18 Oct 2023 12:46:48 +0300

freeipa (4.10.2-1) unstable; urgency=medium

  * New upstream release.
  * control: Bump sssd, bind9 depends.
  * source: Update extend-diff-ignore.
  * copyright, source: Fix some lintian issues/overrides.
  * server-trust-ad: Add a lintian override for the samba plugin rpath.
  * source: Add a lintian override for client-only build; empty-debian-
    tests-control.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 10 Aug 2023 11:16:37 +0300

freeipa (4.9.11-1) unstable; urgency=medium

  * New upstream release. (Closes: #1029070)
  * control: Add systemd-timesyncd to freeipa-client Conflicts. (Closes:
    #1008195)
  * patches: Drop upstreamed patches.
  * source: Extend diff-ignore.
  * server.install: Updated.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 18 Jan 2023 18:22:38 +0200

freeipa (4.9.8-1) unstable; urgency=medium

  * New upstream release.
  * patches: Drop upstreamed patch.
  * server.install: Updated.
  * Build only the client in order to be able to backport to bullseye.
    (Closes: #996946)
  * control: Depend on librpm9 instead of librpm8.
  * tests: Disabled for a client-only build.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 15 Dec 2021 16:41:25 +0200

freeipa (4.9.7-3) unstable; urgency=medium

  * tests: Set KRB5_TRACE to use stderr.
  * patches: Fix apache group properly.
  * client: Move .tmpfile -> .tmpfiles.
  * control: Bump debhelper to 13, gain dh_installtmpfiles being run.
  * control, rules: Add --without-ipa-join-xml and drop libxmlrpc from depends.
  * server.postinst: Drop creating old ccaches for mod_auth_gssapi, obsolete.
  * server.postinst: Drop old upgrade rules.
  * patches: Fix named keytab name.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 18 Nov 2021 21:20:16 +0200

freeipa (4.9.7-2) unstable; urgency=medium

  * lintian: Drop override on python-script-but-no-python-dep, which doesn't
    exist anymore.
  * rules: Add fortify flag to CFLAGS, as CPPFLAGS isn't used by the project.
  * ci: Drop allowed failure for blhc, it passes now.
  * control: Build-depend on libcurl4-openssl-dev.
  * fix-paths.diff: Fix some paths in ipaplatform/base.
  * fix-apache-group.diff: Fix apache group name in ipa.conf tmpfile.
  * control: Depend on gpg instead of gnupg.
  * control: Drop libwbclient-sssd from freeipa-client-samba Depends.
  * patches: Import a patch to fix ipa cert-find. (Closes: #997952)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Nov 2021 15:40:55 +0200

freeipa (4.9.7-1) unstable; urgency=medium

  * New upstream release.
  * control: Drop obsolete depends on python3-nss.
  * pkcs11-openssl-for-bind.diff,
    migrate-to-gpg.diff,
    use-bind9.16.diff,
    fix-chrony-service-name.diff:
    - Dropped, upstream.
  * watch: Fixed to find upstream rc's.
  * source: Update extend-diff-ignore.
  * control: Add libcurl-dev, libjansson-dev and libpwquality-dev to
    build-depends.
  * install: Added new files.
  * rules: Drop ipasphinx files for now.
  * control: Drop dependency on custodia, not needed.
  * control: Bump 389-ds-base depends.
  * control: Drop python3-coverage depends, it's not used.
  * control: Bump dogtag depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 13 Oct 2021 15:19:00 +0300

freeipa (4.8.10-2) unstable; urgency=medium

  * client: Drop obsolete nssdb migration, which is now causing an
    error. (Closes: #971363)
  * Move ipa-epn service to -client-epn package.
  * control: Rebuild against new krb5.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 23 Nov 2020 20:48:56 +0200

freeipa (4.8.10-1) unstable; urgency=medium

  * New upstream release.
  * control: Build freeipa-client-epn only where nodejs is available.
    (Closes: #970230)
  * install: ipa-print-pac belongs to the server instead of -client-epn.
  * control, pkcs11-openssl-for-bind.diff: Add support for bind 9.16.
    (LP: #1874568)
  * fix-chrony-service-name.diff: Map to correct chrony service name.
    (Closes: #968428)
  * freeipa-client-epn.install: Add epn.conf.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 28 Sep 2020 13:12:26 +0300

freeipa (4.8.8-2) unstable; urgency=medium

  * copyright: Fix duplicate-globbing-patterns lintian error.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 02 Sep 2020 11:05:55 +0300

freeipa (4.8.8-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2020-1722 (Closes: #966200)
  * use-bind9.16.diff: Fix some paths to what's in bind9 9.16.
  * write-out-only-one-cert-per-file.diff, tasks-fixes.diff: Dropped,
    upstream.
  * control: Replace node-uglify build-dependency with python3-rjsmin.
  * control: Add freeipa-client-epn package.
  * .install: Updated.
  * control: Drop libnss3-dev from build-depends, use libssl for util &
    libotp.
  * fix-sssd-socket-activation.diff: Don't add a 'services =' line on
    sssd.conf. (LP: #1879083)
  * sources: Fix some lintian errors.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 02 Sep 2020 08:05:51 +0300

freeipa (4.8.6-1) unstable; urgency=medium

  * New upstream release.
  * pki-proxy-Don-t-rely-on-running-apache-until-it-s-co.patch: Dropped,
    upstream.
  * migrate-to-gpg.diff: Use gpg instead of gpg2, update dependencies.
    (Closes: #919062)
  * control: Bump gssproxy depends.
  * control: Relax apache2 dependency so it works on ubuntu.
  * control: Bump policy to 4.5.0.
  * control: Fix some M-A issues.
  * control: Drop the dummy freeipa-admintools package.
  * source: Update diff-ignore.
  * rules: Don't remove po/ipa.pot on clean.
  * tasks-fixes.diff: Use enable/disable_ldap_automount from base,
    parse_ipa_version from redhat. Add librpm8 to python3-ipalib Depends.
  * dnssec-race-wa.diff: Work-around racy dnssec setup, the socket isn't
    necessarily ready when doing policy import.
  * control: Update bind9-utils dependency.
  * control: Bump depends on opendnssec.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 07 Apr 2020 06:28:03 +0300

freeipa (4.8.5-1) unstable; urgency=medium

  * New upstream release.
  * control: Drop client from freeipa-tests depends.
  * Fix-font-awesome-path.patch: Dropped, upstream.
  * fix-ods-conf-template.diff: Dropped, upstream.
  * Use debhelper-compat.
  * Add debian/gitlab-ci.yml.
    - allow blhc and piuparts to fail
  * write-out-only-one-cert-per-file.diff: Fix writing CA cert to file.
  * tests: Make failure an actual failure again, and dump only last 2000
    lines on failure, also from ipaclient log.
  * rules: Import architecture.mk.
  * source: Update extend-diff-ignore.
  * server.install: Updated.
  * pki-proxy-Don-t-rely-on-running-apache-until-it-s-co.patch: Fix
    httpd_proxy install.
  * control: Bump dependency on apache2 to where mod_proxy_ajp got fixed.
  * tests: Add sudo to dependencies for dogtag.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 Mar 2020 19:42:37 +0200

freeipa (4.8.3-1) unstable; urgency=medium

  * New upstream release.
    - CVE-2019-10195: Don't log passwords embedded in commands in calls
      using batch
    - CVE-2019-14867: Make sure to have storage space for tag
  * Fix-font-awesome-path.patch: Fix the path to font-awesome dir. (LP:
    #1853863)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 26 Nov 2019 20:14:47 +0200

freeipa (4.8.2-1) unstable; urgency=medium

  * New upstream release.
  * control: Server needs to depend on the py3 version of mod-wsgi.
  * server.install: Updated.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 20 Nov 2019 19:58:42 +0200

freeipa (4.8.1-2) unstable; urgency=medium

  * client.postinst: Migrate checks to python3. (Closes: #936555)
  * server.postinst: Let ipactl run the upgrader when needed, drop it from here.
  * control: Add python3-pki-base to python3-ipaserver depends.
  * control: Add ssl-cert to freeipa-server depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 12 Sep 2019 00:30:23 +0300

freeipa (4.8.1-1) experimental; urgency=medium

  * New upstream release.
  * Drop upstreamed patches.
  * install: Updated.
  * fix-ods-conf-template.diff: Drop an obsolete conf option.
  * rules: Rework gentarball target.
  * control: Bump policy to 4.4.0.
  * Bump debhelper compat to 12.
  * Migrate to python3.
  * d/s/local-options: Updated.
  * install: Updated.
  * control, install: Add freeipa-client-samba.
  * d/pydist-overrides: Updated.

 -- Timo Aaltonen <tjaalton@debian.org>  Sun, 08 Sep 2019 00:18:39 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog freeipa-client`.
