libpam-krb5 (4.11-1build1) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 13:14:17 +0100

libpam-krb5 (4.11-1) unstable; urgency=medium

  * Upload to unstable.
  * New upstream release.
    - Do not destroy the ticket cache if pam_end was called with the
      PAM_DATA_SILENT flag set.
  * Set Upstream-Name in debian/copyright.
  * Update standards version to 4.6.0 (no changes required).
  * Refresh upstream signing key.

 -- Russ Allbery <rra@debian.org>  Sun, 17 Oct 2021 15:49:06 -0700

libpam-krb5 (4.10-1) experimental; urgency=medium

  * New upstream release.
    - Incorporate patch to avoid double free if krb5_cc_get_principal
      fails on the new cache.
  * Change the default Debian package branch to debian/unstable.
  * Remove the now-unnecessary branch configuration in Vcs-Git.
  * Add debian/upstream/metadata.
  * Represent the weird license of this package with a new identifier,
    BSD-3-clause-or-GPL-1+, rather than trying to use a proper disjunction
    of Debian copyright-format identifiers, since Lintian (rightfully)
    complains about the abuse of "or" and the way the licenses are
    structured.
  * Update to debhelper compat level V13.
  * Update to standards version 4.5.1 (no changes required).
  * Refresh upstream signing key.

 -- Russ Allbery <rra@debian.org>  Sat, 20 Mar 2021 13:07:17 -0700

libpam-krb5 (4.9-2) unstable; urgency=medium

  * Apply upstream patch to avoid a double free if calling
    krb5_cc_get_principal on the new cache fails.

 -- Russ Allbery <rra@debian.org>  Sun, 14 Mar 2021 12:31:39 -0700

libpam-krb5 (4.9-1) unstable; urgency=high

  * New upstream release.
    - Fix potential one-byte buffer overflow when relaying prompts from
      the underlying Kerberos library.  (CVE-2020-10595)
    - Support use_pkinit with MIT Kerberos.  (Closes: #871699)
    - Reject passwords as long or longer than PAM_MAX_RESP_SIZE (512
      octets) to avoid denial of service attacks.
    - Use explicit_bzero to erase passwords before freeing.
    - Return more accurate errors from the Kerberos prompter function.
    - Fix an edge-case memory leak in pam_chauthtok.
  * Update to debhelper compatibility level V12.
    - Depend on debhelper-compat instead of debhelper.
  * Update standards version to 4.5.0 (no changes required).
  * Refresh upstream signing key.

 -- Russ Allbery <rra@debian.org>  Mon, 30 Mar 2020 19:46:43 -0700

libpam-krb5 (4.8-2) unstable; urgency=medium

  * Move canonical packaging repository to salsa.debian.org.
  * Update standards version to 4.2.1.
    - Enable verbose test output.
    - Install the upstream release notes as NEWS.gz, not changelog.gz.
    - Add Rules-Requires-Root: no.
  * Add upstream release tag pattern to debian/gbp.conf.
  * Bump watch file version to 4.
  * Refresh upstream signing key.

 -- Russ Allbery <rra@debian.org>  Fri, 31 Aug 2018 10:57:00 -0700

libpam-krb5 (4.8-1) unstable; urgency=medium

  * New upstream release.
    - Correctly set credential options when verifying that an expired
      password can be used to get kadmin/changepw credentials.
    - Report PKINIT failure reasons when built with new Heimdal versions.
    - Better document that the default Kerberos library ticket cache
      location is not used and why.  (Closes: #872943)
  * Update to debhelper compatibility level V11.
  * Update standards version to 4.1.3.
    - Change priority of libpam-heimdal to optional.
    - Use https URLs in debian/copyright.
  * Use https in the debian/watch URL.
  * Remove now-unnecessary configuration to force xz compression.
  * Refresh upstream signing key.
  * Remove trailing whitespace from debian/changelog.

 -- Russ Allbery <rra@debian.org>  Sat, 30 Dec 2017 21:21:08 -0800

libpam-krb5 (4.7-4) unstable; urgency=medium

  * Re-add libpam-heimdal now that Heimdal upstream has released a new
    stable version and seems to be active again.
  * Update to debhelper compatibility level V10.
    - Remove explicit build dependency on dh-autoreconf.
    - Remove explicit --parallel and autoreconf module flags.
  * Drop "v5" from package long descriptions.  Kerberos v5 is now the only
    meaningful version of Kerberos, and there's no reason to qualify it.
  * Remove libpam0g version qualification on dependency.  The required
    version is older than oldstable.

 -- Russ Allbery <rra@debian.org>  Sat, 31 Dec 2016 13:42:47 -0800

libpam-krb5 (4.7-3) unstable; urgency=medium

  * Drop libpam-heimdal since Heimdal is being removed from testing (and
    possibly unstable) as being too buggy and too unsupported upstream for
    Debian to support.  See #837728.  (Closes: #837716)
  * Document restrictions around minimum_uid and pam-auth-update in
    README.Debian (see #756880).
  * Switch to the DEP-14 branch layout and update debian/gbp.conf and
    Vcs-Git accordingly.
  * Switch to https for all package metadata URLs.
  * Run wrap-and-sort -ast on packaging files.
  * Refresh upstream signing key.
  * Update standards version to 3.9.8 (no changes required).

 -- Russ Allbery <rra@debian.org>  Wed, 19 Oct 2016 11:44:18 -0700

libpam-krb5 (4.7-2) unstable; urgency=medium

  * Upload to unstable.
  * Refresh upstream signing key.
  * Add debian/gbp.conf reflecting the branch layout of the default
    packaging repository.

 -- Russ Allbery <rra@debian.org>  Sun, 26 Apr 2015 20:23:59 -0700

# For older changelog entries, run 'apt-get changelog libpam-heimdal'
