netatalk (4.2.3~ds-2.1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read
    - d/p/CVE-2026-44057,CVE-2026-44066.patch: afpd: fix spotlight
      unmarshalling depth and dead check in etc/afpd/spotlight_marshalling.c
    - CVE-2026-44057
    - CVE-2026-44066
  * SECURITY UPDATE: path traversal
    - debian/patches/CVE-2026-44068.patch: libatalk/vfs: reject slash in EA
      names
    - CVE-2026-44068

 -- Shishir Subedi <shishir.subedi@canonical.com>  Thu, 18 Jun 2026 09:22:32 +0545

netatalk (4.2.3~ds-2.1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: sql injection
    - debian/patches/CVE-2026-44047.patch: cnid: protect against MySQL CNID
      filename SQL injection in cnid_mysql.c.
    - CVE-2026-44047
  * SECURITY UPDATE: buffer out-of-bounds write
    - debian/patches/CVE-2026-44048.patch: fix UCS-2 terminator bounds in
      charset conversion in libatalk/unicode/charcnv.c
    - debian/patches/CVE-2026-44049.patch: reserve charset terminator space
      in conversion in etc/afpd/desktop.c, etc/afpd/mangle.c,
      libatalk/unicode/charcnv.c.
    - CVE-2026-44048
    - CVE-2026-44049
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-44050.patch: cnid_dbd: validate CNID request
      name length in etc/cnid_dbd/comm.c.
    - CVE-2026-44050
  * SECURITY UPDATE: improper link resolution before access
    - debian/patches/CVE-2026-44051.patch: afpd: validate symlink targets
      from FinderInfo in etc/afpd/file.c.
    - CVE-2026-44051
  * SECURITY UPDATE: logging of sensitive information
    - debian/patches/CVE-2026-44052.patch: libatalk: avoid logging LDAP
      bind passwords in libatalk/acl/ldap.c.
    - CVE-2026-44052
  * SECURITY UPDATE: command injection
    - debian/patches/CVE-2026-44055.patch: afpd: correct bitwise check and
      escape user in FCE notify script in etc/afpd/fce_api.c.
    - CVE-2026-44055
  * SECURITY UPDATE: integer underflow
    - debian/patches/CVE-2026-44060.patch: libatalk/dsi: fix write
      underflow in dsi_writeinit in libatalk/dsi/dsi_write.c.
    - CVE-2026-44060
  * SECURITY UPDATE: out-of-bounds write
    - debian/patches/CVE-2026-44062.patch: libatalk/unicode: guard UCS2
      slash and colon writes in libatalk/unicode/charcnv.c.
    - CVE-2026-44062
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-44064.patch: libatalk/asp: bounds-check ASP
      session ID in libatalk/asp/asp_getsess.c.
    - CVE-2026-44064

 -- Shishir Subedi <shishir.subedi@canonical.com>  Thu, 04 Jun 2026 13:35:41 +0545

netatalk (4.2.3~ds-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Build-Depends: libcrypt-dev. (Closes: #1107046)

 -- Adrian Bunk <bunk@debian.org>  Tue, 02 Dec 2025 22:50:42 +0200

netatalk (4.2.3~ds-2) unstable; urgency=medium

  [ Daniel Markstedt ]
  * add patch that fixes critical bug in uam module;
    closes: bug#1111652,
    thanks to Stefan van Lieshout and Hector Rulot

  [ Jonas Smedegaard ]
  * fix indent and wrap DEP-3 patch header

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 05 Oct 2025 14:31:35 +0200

netatalk (4.2.3~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release
    highlights:
    + fix bug with optarg indexing in afpd
      closes: bug#1104925

  [ Daniel Markstedt ]
  * update copyright coverage

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 13 May 2025 16:40:25 +0200

netatalk (4.2.1~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * revert testsuite forcing of filesystem EA on test volumes
  * update copyright and copyright_hints
  * update not-installed to reflect new default build system behavior
  * defuzz 202_privacy.patch
  * drop patches obsoleted by upstream changes

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 16 Apr 2025 06:30:29 +0200

netatalk (4.2.0~ds-3) unstable; urgency=medium

  [ Daniel Markstedt ]
  * adjust the testsuite afp.conf to use the latest options
  * temporarily enable max test log verbosity in testsuite
  * create baseline salsa-ci.yml file to run tests in the Salsa pipeline
  * add patch for standardizing error code validation in testsuite
  * use stronger test user password in testsuite
  * drop two patches added in the previous release
    that were ineffectual for addressing the testsuite test failure

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 12 Apr 2025 12:39:32 +0200

netatalk (4.2.0~ds-2) unstable; urgency=medium

  [ Daniel Markstedt ]
  * remove superfluous label on an author in copyright
  * add patch for FPGetExtAttr return value in testsuite
  * add patch for error logging in EXPECT_FAIL macro in testsuite

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 07 Apr 2025 21:56:11 +0200

netatalk (4.2.0~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * update copyright hints
  * update copyright
  * netatalk test binaries now depend on libatalk
  * new test binary fce_listen
  * docs are now built with cmark-gfm, removing docbook and xslt dependencies
  * iniparser is now a mandatory build and runtime dependency
  * new meson syntax for building docs
  * need to tell meson to explicitly build unicode lookup tables
  * refresh README privacy patch
  * temporary patch for sequence of generating unicode lookup tables
  * CONTRIBUTORS is now markdown converted to txt
  * update ignore list with new readme names
  * ignore CUPS pap backend configuration file

  [ Jonas Smedegaard ]
  * update copyright info: update coverage

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 06 Apr 2025 12:58:54 +0200

netatalk (4.1.2~ds-4) unstable; urgency=medium

  [ Daniel Markstedt ]
  * restore dependency on libtracker-sparql-3.0-dev
    (see bug#1098577)
  * declare compliance with Debian Policy 4.7.2

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 08 Mar 2025 12:28:21 +0100

netatalk (4.1.2~ds-3) unstable; urgency=medium

  [ Daniel Markstedt ]
  * update smoke test to accommodate localsearch daemon

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 25 Feb 2025 07:23:56 +0100

netatalk (4.1.2~ds-2) unstable; urgency=medium

  * build-depend on libtinysparql-dev localsearch
    (not libtracker-sparql-3.0-dev tracker);
    depend on localsearch (not tracker tracker-miner-fs);
    closes: bug#1098776, thanks to Santiago Vila
  * declare compliance with Debian Policy 4.7.1

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 24 Feb 2025 22:38:03 +0100

netatalk (4.1.2~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Jonas Smedegaard ]
  * update copyright info: update coverage

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 13 Feb 2025 07:10:44 +0100

netatalk (4.1.1~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * fix copyright path after upstream changes
  * update copyright year
  * remove patch obsoleted by upstream changes

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 24 Jan 2025 19:38:37 +0100

netatalk (4.1.0~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Jonas Smedegaard ]
  * adapt packaging for upstream renamed executable
    apple_dump -> addump
  * update copyright info: update coverage

  [ Daniel Markstedt ]
  * update description of netatalk-tools package
  * run testsuite in big-endian compatible mode on s390x
  * remove patch obsoleted by upstream changes
  * install new macipgw config and man page
  * patch 001 that disables all default settings for macipgw

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 13 Jan 2025 22:54:41 +0100

netatalk (4.0.8~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * remove patch 001 obsoleted by upstream changes
  * add patch 001 to skip test358 which is flaky on s390x
  * unfuzz patch 202

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 18 Dec 2024 11:14:34 +0100

netatalk (4.0.7~ds-2) unstable; urgency=medium

  [ Daniel Markstedt ]
  * add patch 001: retry logic for flaky testsuite test

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 06 Dec 2024 09:04:14 +0100

netatalk (4.0.7~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Jonas Smedegaard ]
  * update patch 202

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 30 Nov 2024 21:08:04 +0100

netatalk (4.0.6~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 16 Nov 2024 18:57:50 +0100

netatalk (4.0.5~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * drop TODO note about using libev (considered infeasable upstream)
  * drop obsolete man page for gone executable afp_encodingtest

  [ Jonas Smedegaard ]
  * update copyright info:
    + exclude generated files from repackaged source

  [ Daniel Markstedt ]

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 10 Nov 2024 13:45:32 +0100

netatalk (4.0.4~ds-2) unstable; urgency=medium

  [ Daniel Markstedt ]
  * enable extension mapping tests in the testsuite

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 08 Nov 2024 09:40:06 +0100

netatalk (4.0.4~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * afp_ls has been merged into afparg,
    and encodingtest into spectest
  * afptest man page has been introduced,
    covering all netatalk-tests apps
  * don't install afp_encodingtest.1 man page
    which has been deprecated upstream
  * spectest test suites were collapsed into a single suite upstream
  * use correct path to test volumes in testsuite configuration
  * for netatalk-tests,
    install binary test data file used by afp_spectest

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 08 Nov 2024 00:26:48 +0100

netatalk (4.0.3~ds-2) unstable; urgency=medium

  * no-changes source-only upload to enable testing migration

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 30 Oct 2024 21:10:21 +0100

netatalk (4.0.3~ds-1) experimental; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * some testsuite tests need setgid on the volume dir
  * use systemctl to control the netatalk process for testing
  * specify with-tracker-prefix for meson 1.6.0 compatibility
  * remove patches obsoleted by upstream changes
  * update testsuite execution command with upstream changes
  * create a netatalk-tests package
  * store testsuite test log to debci artifacts
  * install README.txt for netatalk-tests

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 28 Oct 2024 07:42:17 +0100

netatalk (4.0.2~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release
    + end-to-end testsuite module added
    + new afp.conf option legacy icon

  [ Daniel Markstedt ]
  * build testsuite and run the suite with autopkgtest
  * add patches 201 & 203 to make testsuite work in autopkgtest
  * update smoketest to conform to upstream changes
  * update copyright info with newly added source code
  * use with-statedir-path override instead of Meson localstatedir

  [ Jonas Smedegaard ]
  * update copyright info:
    + use Reference field (not abuse License-Grant)
    + sort copyright holders by name

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 20 Oct 2024 22:47:34 +0200

netatalk (4.0.1~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release

  [ Daniel Markstedt ]
  * flag netatalk-tools as Replaces the netatalk 3.x package;
    closes: bug#1084819, thanks to Helmut Grohne
  * add myself as copyright holder for debian/*

  [ Jonas Smedegaard ]
  * update copyright info: update coverage
  * drop patches cherry-picked upstream, now obsolete

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 12 Oct 2024 19:55:44 +0200

netatalk (4.0.0~ds-4) unstable; urgency=medium

  [ Daniel Markstedt ]
  * add patch 005, create manpage aliases for nbp tools
  * add patch 006, remove Also directive in systemd units
  * generate the README.txt via the netatalk build system
  * install README.txt with all packages

  [ Jonas Smedegaard ]
  * omit generating documentation
    and build-depending on docbook-xsl and xsltproc
    if DEB_BUILD_OPTIONS=nodoc
  * omit tests if DEB_BUILD_OPTIONS=nocheck
  * add note in rules file about statedir setting

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 05 Oct 2024 10:27:11 +0200

netatalk (4.0.0~ds-3) unstable; urgency=medium

  [ Daniel Markstedt ]
  * move XSL tooling back to Build-Depends to unblock -arch builds
  * create debian/not-installed to ignore netatalk-config files

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 03 Oct 2024 07:14:34 +0200

netatalk (4.0.0~ds-2) experimental; urgency=medium

  [ Daniel Markstedt ]
  * add patch 004, allow building arch when XSL tools are unavailable
  * papd: change `cups' package to recommended
  * netatalk-tools: add Breaks conflict with pre-4.0 netatalk;
    closes: bug#1083125

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 02 Oct 2024 09:14:40 +0200

netatalk (4.0.0~ds-1) experimental; urgency=medium

  [ upstream ]
  * new release
    highlights:
    + reintroduce AFP-over-AppleTalk transport layer
    + reintroduce daemons: atalkd, papd, timelord, a2boot
    + reintroduce utils: aecho, getzones, nbplkup, nbprgstr, nbpunrgstr,
      pap, papstatus
    + add `macipgw' MacIP gateway daemon
    + remove incorrect libgcrypt version check
      closes: bug#568601
    + rewrite afpstats from dbus-glib to GDBus
      closes: bug#955927
    + all UAMs use libgcrypt; remove dependency on OpenSSL and wolfSSL
    + remove obsoleted PGP UAM

  [ Daniel Markstedt ]
  * split deb packaging into multiple atomic units
  * drop repackaging of wolfSSL code, since it was removed upstream
  * repackage by removing the webmin_module code
  * remove debian rules override for Unicode character lookup table
    code generation, now handled by the netatalk build system
  * add dependency on cups, to enable the papd print server
  * add patch 001, 002, 003 for minor upstream bugs
  * remove obsoleted `default' init script
  * remove obsoleted README.Debian

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 01 Oct 2024 15:37:16 +0200

netatalk (3.2.10~ds-1) unstable; urgency=medium

  [ upstream ]
  * new release
    highlights:
    + fix broken ClearTxt UAM (shadow)
    + fix TCP Wrapper detection in Meson
    + fix afpd help text output when built with Meson
    + avoid enabling Debugging by default in Meson
      (fixes server tickles)
    + change default D-Bus config path to <share/dbus-1/system.d>

  [ Daniel Markstedt ]
  * drop patches 001 and 002, obsoleted by upstream changes
  * remove D-Bus config path override, obsoleted by upstream changes

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 26 Sep 2024 12:53:34 +0200

netatalk (3.2.9~ds-3) unstable; urgency=medium

  [ Daniel Markstedt ]
  * add patch cherry-picked from upstream:
    002: meson: Format afpd help text output to match autotools
  * update afpd smoketest:
    + remove the check for the tdb CNID backend
    + sort tests in the same order as actual output
  * stop build-depend on libtdb-dev: obsoleted by upstream changes
  * build-depend on libltdl-dev (not libltdl3-dev)

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 21 Sep 2024 03:06:55 +0200

netatalk (3.2.9~ds-2) unstable; urgency=medium

  [ Daniel Markstedt ]
  * Add patch cherry-picked from upstream:
    001: Correct libwrap capability check in Meson build system
  * Make cracklib-runtime a build dependency
    in order to build netatalk with cracklib support

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 19 Sep 2024 02:46:12 +0200

netatalk (3.2.9~ds-1) unstable; urgency=high

  [ upstream ]
  * new release(s)
    + fix CVE-2024-38439 CVE-2024-38440 CVE-2024-38441
      closes: bug#1074473, #1074474, #1074475

  [ Daniel Markstedt ]
  * drop patches obsoleted by upstream changes
  * refresh patch 202
  * stop build-depend on libgcrypt-config;
    closes: bug#1074503
  * build-depend on libio-socket-ip-perl libnet-dbus-perl perl;
    stop build-depend on python3 python3-dbus
  * update build rules to use Meson (not autotools)
  * Install PAM config in /usr/lib/pam.d to conform to FHS
  * update TODOs

  * update copyright info:
    + exclude embedded libwolfssl from repackaged upstream tarball
    + removing blurbs for files dropped upstream
  * generate documentation, and register with doc-base
  * build-depend on libmariadb-dev (not libmariadb-dev-compat)

  [ Jonas Smedegaard ]
  * Set urgency=high due to security-related bugfixes
  * set buildsystem in overridden configure rule,
    and stop set implied configure option

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 18 Sep 2024 06:42:57 +0200

netatalk (3.1.18~ds-2) unstable; urgency=high

  * update git-buildpackage: adjust debian-branch
  * add patches cherry-picked upstream:
    + use pkg-config to find libgcrypt;
      closes: bug#1071945, thanks to Andreas Metzler
    + harden user login;
      CVE-2024-38439 CVE-2024-38440 CVE-2024-38441;
      closes: bug#1074473,#1074474,#1074475
  * stop pass now superfluous configure option --with-libgcrypt-dir
  * set urgency=high due to security bugfixes

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 01 Jul 2024 11:09:54 +0200

netatalk (3.1.18~ds-1) unstable; urgency=high

  [ upstream ]
  * new release
    + CVE-2022-22995: Harden create_appledesktop_folder()
      closes: bug#1053545

  [ Jonas Smedegaard ]
  * drop patch 001, obsoleted by upstream changes
  * set urgency=high due to security-related bugfix

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 06 Oct 2023 06:40:15 +0200

netatalk (3.1.17~ds-2) unstable; urgency=medium

  [ Daniel Markstedt ]
  * Cherry-pick upstream patch for restoring
    tcp wrapper autoconf check.
  * Update lintian sonames override after removal of
    ABI versioning upstream.

  [ Jonas Smedegaard ]
  * set urgency=high due to previous security-related bugfixes

 -- Jonas Smedegaard <dr@jones.dk>  Thu, 21 Sep 2023 21:59:44 +0200

netatalk (3.1.17~ds-1) unstable; urgency=high

  [ upstream ]
  * new release(s)
    + Use non-interactive PAM session when available
      closes: bug#1040065, thanks to Richard van den Berg
    + Renames asip-status.pl to asip-status
    + Removes uniconv and cnid2_create from distribution
    + FIX CVE-2023-42464:
      Validate data type in dalloc_value_for_key()
    + FIX: Declare a variable before using it in a loop,
      which was throwing off the default compiler on RHEL7
    closes: bug#1052087

  [ Daniel Markstedt ]
  * Drop patches obsoleted by upstream changes:
    001, 101, 105, 106, 107, 204
  * Generate man pages from XML sources with docbook-xsl
  * Improve configure parameters:
    + Explicitly define sysconfdir
    + Sort parameters alphabetically
  * Add lintian overrides for:
    + package-name-doesnt-match-sonames
    + package-contains-documentation-outside-usr-share-doc

  [ Jonas Smedegaard ]
  * set urgency=high due to security-related bugfixes

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 17 Sep 2023 21:58:16 +0200

netatalk (3.1.15~ds-3) unstable; urgency=medium

  [ Daniel Markstedt ]
  * Cherry-pick upstream patch for:
    + Fix CVE-2022-23121, CVE-2022-23123 regression
  * Install netatalk dbus config file into /usr/share prefix
    instead of /etc - to appease lintian
  * Don't distribute libatalk.so shared lib symlink:
    The upstream project is moving towards turning it into a
    private library
  * Remove copyright info for generated source files
    no longer in VCS
  * Remove overlapping copyright files covered by wildcards
  * Add notes in TODO:
    + to figure out why lintian-overrides are ignored
    + to link with WolfSSL instead of OpenSSL
      (OpenSSL 3.0 broke compatibility with DHX)

  [ Jonas Smedegaard ]
  * update DEP-3 patch headers

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 29 Aug 2023 17:23:37 +0200

netatalk (3.1.15~ds-2) unstable; urgency=medium

  [ Daniel Markstedt ]
  * Fix failing smoke test caused by an upstream change
  * Replace deprecated dependency `lsb-base'
    which is now superseded by Essential package `sysvinit-utils'
  * Remove debian.pam override, since upstream now generates
    logically identical pam configurations
  * Fix duplicate globbing of copyright sources
  * Flag all patches as either forwarded or not-needed
  * Restore distribution of the afppasswd.1 man page
  * Fix typo in previous changelog entry (wrong CVE number)
  * Remove obsoleted NEWS file
  * Update own email address
  * Add item to TODO on cleaning up copyright for generated sources
  * Upstream repo renamed from `Netatalk' to `netatalk'

  [ Jonas Smedegaard ]
  * update DEP-3 patch headers
  * renumber patches to match micro naming policy:
    203 -> 101, 102 -> 205

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 26 Aug 2023 10:43:23 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog netatalk-doc`.
