libpam-krb5 (4.8-2ubuntu1) focal; urgency=medium

  * SECURITY UPDATE: One-byte buffer overflow
    - debian/patches/CVE-2020-10595.patch: checks prompts[i].reply->length
      boundaries in prompting.c.
    - CVE-2020-10595

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Wed, 25 Mar 2020 10:26:35 -0300

libpam-krb5 (4.8-2) unstable; urgency=medium

  * Move canonical packaging repository to salsa.debian.org.
  * Update standards version to 4.2.1.
    - Enable verbose test output.
    - Install the upstream release notes as NEWS.gz, not changelog.gz.
    - Add Rules-Requires-Root: no.
  * Add upstream release tag pattern to debian/gbp.conf.
  * Bump watch file version to 4.
  * Refresh upstream signing key.

 -- Russ Allbery <rra@debian.org>  Fri, 31 Aug 2018 10:57:00 -0700

libpam-krb5 (4.8-1) unstable; urgency=medium

  * New upstream release.
    - Correctly set credential options when verifying that an expired
      password can be used to get kadmin/changepw credentials.
    - Report PKINIT failure reasons when built with new Heimdal versions.
    - Better document that the default Kerberos library ticket cache
      location is not used and why.  (Closes: #872943)
  * Update to debhelper compatibility level V11.
  * Update standards version to 4.1.3.
    - Change priority of libpam-heimdal to optional.
    - Use https URLs in debian/copyright.
  * Use https in the debian/watch URL.
  * Remove now-unnecessary configuration to force xz compression.
  * Refresh upstream signing key.
  * Remove trailing whitespace from debian/changelog.

 -- Russ Allbery <rra@debian.org>  Sat, 30 Dec 2017 21:21:08 -0800

libpam-krb5 (4.7-4) unstable; urgency=medium

  * Re-add libpam-heimdal now that Heimdal upstream has released a new
    stable version and seems to be active again.
  * Update to debhelper compatibility level V10.
    - Remove explicit build dependency on dh-autoreconf.
    - Remove explicit --parallel and autoreconf module flags.
  * Drop "v5" from package long descriptions.  Kerberos v5 is now the only
    meaningful version of Kerberos, and there's no reason to qualify it.
  * Remove libpam0g version qualification on dependency.  The required
    version is older than oldstable.

 -- Russ Allbery <rra@debian.org>  Sat, 31 Dec 2016 13:42:47 -0800

libpam-krb5 (4.7-3) unstable; urgency=medium

  * Drop libpam-heimdal since Heimdal is being removed from testing (and
    possibly unstable) as being too buggy and too unsupported upstream for
    Debian to support.  See #837728.  (Closes: #837716)
  * Document restrictions around minimum_uid and pam-auth-update in
    README.Debian (see #756880).
  * Switch to the DEP-14 branch layout and update debian/gbp.conf and
    Vcs-Git accordingly.
  * Switch to https for all package metadata URLs.
  * Run wrap-and-sort -ast on packaging files.
  * Refresh upstream signing key.
  * Update standards version to 3.9.8 (no changes required).

 -- Russ Allbery <rra@debian.org>  Wed, 19 Oct 2016 11:44:18 -0700

libpam-krb5 (4.7-2) unstable; urgency=medium

  * Upload to unstable.
  * Refresh upstream signing key.
  * Add debian/gbp.conf reflecting the branch layout of the default
    packaging repository.

 -- Russ Allbery <rra@debian.org>  Sun, 26 Apr 2015 20:23:59 -0700

libpam-krb5 (4.7-1) experimental; urgency=medium

  * Upload to experimental due to release freeze.
  * New upstream release.
    - Add no_update_user option to disable the normal update of PAM_USER
      after user canonicalization.
    - Suppress spurious Heimdal password prompt when using PKINIT.
    - Map unknown realm errors to PAM_AUTHINFO_UNAVAIL.
    - Treat more error codes as incorrect passwords for better
      compatibility between MIT client libraries and Heimdal KDCs.
    - Add version number when module options were added to the man page.
  * Remove erroneous branch information from Vcs-Git.
  * Fix debian/copyright to match the correct upstream licensing.
  * Update standards version to 3.9.6 (no changes required).

 -- Russ Allbery <rra@debian.org>  Thu, 25 Dec 2014 19:36:00 -0800

libpam-krb5 (4.6-3) unstable; urgency=medium

  * Drop version qualifications on Build-Depends that are satisfied by
    stable.  Drop version qualifications on Depends that are satisfied by
    oldstable.
  * Add the upstream release signing key and verify it in debian/watch.
  * Prefer *.tar.xz in debian/watch to match packaging.
  * Convert debian/copyright to copyright-format 1.0.
  * Specify the Debian packaging branch in the Vcs-Git control field.
  * Update standards version to 3.9.5 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sun, 13 Apr 2014 13:13:38 -0700

libpam-krb5 (4.6-2) unstable; urgency=low

  * Apply upstream patch to add AM_PROG_AR to configure.ac, now apparently
    required by Automake for the binutils in unstable.  (Closes: #713296)
  * Apply upstream patch to build with largefile support.  This is
    probably pointless for this module, but consistency is good.
  * Canonicalize the Vcs-Git and Vcs-Browser URLs.
  * Update standards version to 3.9.4 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sun, 23 Jun 2013 12:33:04 -0700

libpam-krb5 (4.6-1) unstable; urgency=low

  * New upstream release.
    - New anon_fast option to attempt anonymous authentication and use
      those credentials to provide FAST armor.  (Closes: #626509)
    - New user_realm option to set the realm for unqualified user
      principals without changing the default realm for all other
      operations.
    - New no_prompt option to suppress PAM prompting in favor of letting
      the Kerberos library handle it.  (Closes: #626506)
    - New silent option that duplicates the behavior of PAM_SILENT.
    - New trace option for preliminary support of Kerberos trace logging.
    - Fix the doubled colon in password prompts from Heimdal.
    - Preserve the realm of the authentication identity when forming an
      alt_auth_map identity.
    - Allow the alt_auth_map format to contain a realm to force all mapped
      principals to be in that realm.
    - Avoid a NULL pointer dereference if krb5_init_context fails.
      (LP: #998525)
    - Close memory leaks in search_k5login and alt_auth_map.
    - Suppress bogus error messages about the realm option.
    - Retry authentication under try_first_pass for several other error
      conditions.
  * Regenerate the Autotools build system with dh-autoreconf.
  * Add krb5-config to Build-Depends so that the test programs don't abort
    with errors about not having a Kerberos configuration.
  * Switch to xz compression for the upstream and Debian tarballs.
  * Enable parallel builds.
  * Update standards version to 3.9.3 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sat, 02 Jun 2012 19:20:27 -0700

# For older changelog entries, run 'apt-get changelog libpam-heimdal'
