libreswan (5.2-2.2ubuntu2) resolute; urgency=medium

  * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)

 -- Sebastien Bacher <seb128@debian.org>  Fri, 06 Feb 2026 21:11:54 +0100

libreswan (5.2-2.2ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. (LP: #2119099). Remaining changes:
    - d/tests/control: make opportunistic skippable if builder
      doesn't have access to internet.
    - d/tests/opportunistic: if ping or wget fails then exit 77 to skip
      the test.
  * Dropped Changes:
    - d/tests/control: make cavp skippable if builder
      doesn't have access to internet.
    - d/tests/cavp: if wget fails then exit 77 to skip the test.
  * New Changes:
    - d/p/fix-build-curl-8.14.patch: Fix build of libreswan-5.2 with curl
      8.14.x
    - d/rules: Force ppc64el to build with -O2 to fix FTBFS

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Wed, 30 Jul 2025 15:43:47 +0200

libreswan (5.2-2.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Build with INITSYSTEM=systemd on linux.
    Make sure binary package content does not change depending on the
    existence of /run/systemd, which is not guaranteed. (Closes: #1073665)

 -- Chris Hofstaedtler <zeha@debian.org>  Sun, 04 May 2025 22:47:23 +0200

libreswan (5.2-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add Build-Depends on systemd-dev.
    The package has a Build-Depends on systemd so INITSYSTEM is correctly set
    to systemd during build. But it also needs the systemd.pc pkg-config file
    (provided by systemd-dev) to determine the install paths for the service
    files. So add a corresponding Build-Depends on systemd-dev.
    (Closes: #1073665)

 -- Michael Biebl <biebl@debian.org>  Wed, 19 Mar 2025 11:53:56 +0100

libreswan (5.2-2) unstable; urgency=medium

  * Release to unstable

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 04 Mar 2025 17:28:53 -0500

libreswan (5.2-1) experimental; urgency=medium

  * New upstream release
  * Drop build-dep on libsystemd-dev
  * d/copyright: update
  * Standards-Version: bump to 4.7.1 (no changes needed)
  * Fail building on platforms where AVA is not supported by NSS

  [ Michael Biebl ]
  * Move aliased files from / to /usr (Closes: #1073665)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 26 Feb 2025 19:06:06 -0500

libreswan (5.0~rc2-2) experimental; urgency=medium

  * avoid build failure on 32-bit arches

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 14 Mar 2024 14:40:01 -0400

libreswan (5.0~rc2-1) experimental; urgency=medium

  * Import upstream release candidate into experimental
  * fix up patches, dropping several no longer needed
  * improve upstream orthography
  * d/copyright: track file renames
  * lintian-overrides: drop override for _secretcensor, no longer shipped
    upstream

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 11 Mar 2024 18:59:12 -0400

libreswan (4.15-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2024-3652
  * Standards-Version: bump to 4.7.1 (no changes needed)
  * drop patch already applied upstream
  * drop libsystemd-dev from build-deps

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 26 Feb 2025 19:22:24 -0500

libreswan (4.14-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Move aliased files from / to /usr (DEP17). (Closes: #1073665)

 -- Michael Biebl <biebl@debian.org>  Sun, 15 Sep 2024 23:08:41 +0200

libreswan (4.14-1ubuntu2) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 19:34:08 +0000

libreswan (4.14-1ubuntu1) noble; urgency=medium

  * Merge with Debian; remaining changes:
    - d/tests/control: make opportunistic and cavp skippable if builder
      doesn't have access to internet.
    - d/tests/opportunistic: if ping or wget fails then exit 77 to skip
      the test.
    - d/tests/cavp: if wget fails then exit 77 to skip the test.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 22 Mar 2024 00:55:36 +0100

libreswan (4.14-1) unstable; urgency=medium

  * New upstream release (Closes: #1066059)
    - fixes CVE-2024-2357

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 11 Mar 2024 22:01:21 -0400

libreswan (4.12-3) unstable; urgency=medium

  * build-depend on systemd-dev, not systemd (Closes: #1060534)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 11 Mar 2024 19:22:08 -0400

libreswan (4.12-2) unstable; urgency=medium

  * check libcap-ng failures (Closes: #1060981)
  * build against pkgconf, not pkg-config
  * fix trivial orthography

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 11 Mar 2024 17:19:53 -0400

libreswan (4.12-1ubuntu1) noble; urgency=medium

  * Merge from Debian unstable, remaining changes:
    - d/tests/control: make opportunistic and cavp skippable if builder
      doesn't have access to internet.
    - d/tests/opportunistic: if ping or wget fails then exit 77 to skip
      the test.
    - d/tests/cavp: if wget fails then exit 77 to skip the test.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 19 Nov 2023 21:17:27 -0800

libreswan (4.12-1) unstable; urgency=medium

  * New upstream version
   - fixes CVE-2023-38710
   - fixes CVE-2023-38711
   - fixes CVE-2023-38712
  * Move from libcurl4-nss to libcurl4-gnutls (Closes: #1038912)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 10 Aug 2023 11:15:45 -0400

libreswan (4.11-1ubuntu1) mantic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/tests/control: make opportunistic and cavp skippable if builder
      doesn't have access to internet.
    - d/tests/opportunistic: if ping or wget fails then exit 77 to skip
      the test.
    - d/tests/cavp: if wget fails then exit 77 to skip the test.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 16 Jun 2023 00:02:12 -0700

libreswan (4.11-1) unstable; urgency=medium

  * New upstream version
    - fixes CVE-2023-30570 (Closes: #1035542)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 02 Jun 2023 17:53:00 -0400

libreswan (4.10-2ubuntu1) mantic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/tests/control: make opportunistic and cavp skippable if builder
      doesn't have access to internet.
    - d/tests/opportunistic: if ping or wget fails then exit 77 to skip
      the test.
    - d/tests/cavp: if wget fails then exit 77 to skip the test.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 May 2023 12:42:03 +0200

libreswan (4.10-2) unstable; urgency=medium

  * Reach NSPR mipsel workaround for #854472

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 10 Mar 2023 16:34:25 -0500

libreswan (4.10-1) unstable; urgency=medium

  * new upstream version
    - fixes CVE-2023-23009 (Closes: #1031821)
    - fixes some IKEv1 overdeletion

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 03 Mar 2023 10:04:35 -0500

libreswan (4.9-2) unstable; urgency=medium

  * Fix CVE-2023-23009
    (this is an attempted fix, upstream has not confirmed it yet
    at https://github.com/libreswan/libreswan/issues/954)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 22 Feb 2023 15:13:07 -0500

libreswan (4.9-1ubuntu1) lunar; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/tests/control: make opportunistic and cavp skippable if builder
      doesn't have access to internet.
    - d/tests/opportunistic: if ping or wget fails then exit 77 to skip
      the test.
    - d/tests/cavp: if wget fails then exit 77 to skip the test.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 24 Jan 2023 21:33:45 -0800

libreswan (4.9-1) unstable; urgency=medium

  [ Daniel Kahn Gillmor ]
  * New upstream release
    - upstream fixed LTO (Closes: #1015517)
  * d/upstream/signing-key.asc: update with better bindings
  * Standards-Version: bump to 4.6.2 (no changes needed)

  [ Vagrant Cascadian ]
  * debian/rules: Pass OBJDIR to avoid embedding hostname. (Closes: #1020736)

  [ Daniel Kahn Gillmor ]
  * refresh patches
  * d/copyright: remove reference to upstream-deleted BSDKAME code
  * update lintian overrides
  * d/copyright: update years to relevant years

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 19 Jan 2023 17:41:25 -0500

libreswan (4.7-1ubuntu2) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 15 Dec 2022 19:50:52 +0000

libreswan (4.7-1ubuntu1) kinetic; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - d/tests/control: make opportunistic and cavp skippable if builder
      doesn't have access to internet.
    - d/tests/opportunistic: if ping or wget fails then exit 77 to skip
      the test.
    - d/tests/cavp: if wget fails then exit 77 to skip the test.
  * Dropped changes, superseded upstream:
    - d/patches/fix-libselinux3.1-deprecated.patch: this fixes current
      ftbfs with libselinux3.1.
    - d/patches/fix-ftbfs-s390x.patch: fix maybe-uninitialized
      warning/error.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 07 Oct 2022 22:28:57 -0700

libreswan (4.7-1) unstable; urgency=medium

  * New upstream release
  * move to DEP-14 branch naming
  * refresh patches
  * Standards-Version: bump to 4.6.1 (no changes needed)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 25 May 2022 13:58:23 -0400

libreswan (4.6-1) unstable; urgency=medium

  * New upstream version
    - Fixes CVE-2022-23094
  * Drop patch already upstream
  * Refresh patches
  * Clean up lintian-overrides

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 12 Jan 2022 22:51:04 -0500

libreswan (4.5-2) unstable; urgency=medium

  * Make ikev1-policy default to "drop"

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 07 Jan 2022 18:45:21 -0500

libreswan (4.5-1) unstable; urgency=medium

  * New upstream release
  * override lintian about long lines in tests
  * USE_FIPSCHECK=false is no longer needed
  * d/copyright: track file movement
  * add debian/* stanza to d/copyright
  * standards-version: bump to 4.6.0 (no changes needed)
  * override spurious lintian warnings
  * drop bashisms from letsencrypt

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 28 Dec 2021 11:07:42 +0200

libreswan (4.3-1) unstable; urgency=medium

  * New upstream release
  * drop patches already upstream
  * refresh patches
  * d/copyright: drop unreferenced lib/libswan/initsubnet.c

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Sun, 28 Feb 2021 12:01:15 -0500

libreswan (4.2-1) unstable; urgency=medium

  * New upstream release 4.2
  * drop spelling patch already merged upstream
  * fix more spelling
  * move from USE_XAUTHPAM to USE_AUTHPAM, as recommended by upstream

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 03 Feb 2021 19:37:09 -0500

libreswan (4.1-4) unstable; urgency=medium

  * supply the same flags during install as during build
  * embed a copy of AVA on platforms where NSS is missing it

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 14 Jan 2021 17:21:32 -0500

libreswan (4.1-3) unstable; urgency=medium

  * Use proper toolchain feature tests (and include IPSEC_PROFILE)
  * make cryptocheck tests more verbose

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 13 Jan 2021 15:28:30 -0500

libreswan (4.1-2) unstable; urgency=medium

  * change default development branch to debian/main
  * handle platforms without a stack-protector
  * Autodetect whether to use pure NSS for KDF
  * drop unnecessary rejection of KLIPS
  * make algparse test more verbose
  * Drop bsdmainutils as a dependency (Closes: #964535)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 12 Jan 2021 21:50:15 -0500

libreswan (4.1-1) unstable; urgency=medium

  * New upstream version (Closes: #957473, #966017)
  * Standards-Version: bumped to 4.5.1 (no changes needed)
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.
  * refresh patches
  * clean up debian/copyright, following upstream cleanup
  * indicate that neither of these patches need to be forwarded upstream
  * d/rules: track new compilation configuration from upstream
  * drop unneeded lintian overrides
  * clean up spelling
  * avoid shipping accidental backup files

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 12 Jan 2021 09:24:42 -0500

libreswan (3.32-3ubuntu3) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 17:53:28 -0400

libreswan (3.32-3ubuntu2) groovy; urgency=medium

  * d/tests/opportunistic and d/tests/cavp: fix how it exit 77 to skip
    the test in case of ping, wget, dig failures.

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 24 Aug 2020 16:37:54 -0300

libreswan (3.32-3ubuntu1) groovy; urgency=medium

  * d/tests/control: make opportunistic and cavp skippable if builder
    doesn't have access to internet.
  * d/tests/opportunistic: if ping or wget fails then exit 77 to skip
    the test.
  * d/tests/cavp: if wget fails then exit 77 to skip the test.
  * d/patches/fix-libselinux3.1-deprecated.patch: this fixes current
    ftbfs with libselinux3.1.
  * d/patches/fix-ftbfs-s390x.patch: fix maybe-uninitialized
    warning/error.

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Fri, 21 Aug 2020 12:00:11 -0300

libreswan (3.32-3build1) groovy; urgency=medium

  * No-change rebuild against libldns3.

 -- Logan Rosen <logan@ubuntu.com>  Tue, 30 Jun 2020 19:40:37 -0400

libreswan (3.32-3) unstable; urgency=medium

  * allow stderr on CAVP tests

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 28 May 2020 08:13:57 -0400

libreswan (3.32-2) unstable; urgency=medium

  * streamline autopkgtests

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 26 May 2020 16:55:21 -0400

libreswan (3.32-1) unstable; urgency=medium

  [ Stephen Kitt ]
  * Remove the systemd dependency (Closes: #931858)

  [ Daniel Kahn Gillmor ]
  * New upstream version, fixing CVE-2020-1763 (Closes: #960458)
  * refresh patches, dropping those already applied upstream
  * Standards-Version: bump to 4.5.0 (no changes needed)
  * move to dh 13
  * drop unneeded lintian-override
  * d/copyright: drop annotations for removed source
  * move subcommand executables from /usr/lib/ipsec to /usr/libexec/ipsec
  * fix upstream spelling errors
  * added buildtime and runtime checks that the crypto works as expected
  * include upstream patch to address subtle NSS API variance
  * autopkgtest: add CAVP/ACVP tests
  * use dh_auto_build instead of $(MAKE) when building
  * enable cross-building (Closes: #958355)
  * d/tests/opportunistic: avoid dropping into a pager if run from a
    terminal

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 22 May 2020 18:33:46 -0400

libreswan (3.29-2) unstable; urgency=medium

  * Release to unstable
  * fix up more upstream orthography
  * standards-version: bump to 4.4.0 (no changes needed
  * change lintian override of spelling-error-in-copyright to match new
    reporting

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 19 Aug 2019 18:57:33 -0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libreswan`.
