opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu1.3) jammy-security; urgency=medium

  * d/p/lp-2163253-fix-ber-der-decoder-out-of-bounds-access.patch: Fix
    possible out-of-bounds access in BER decode functions. (LP: #2163253)
    (CVE-2026-40253)
  * d/p/lp-2163254-fix-symlink-following-vulnerabilities.patch: Fix
    symlink-following vulnerabilities (CWE-59). (LP: #2163254)
    (CVE-2026-23893)

 -- Frank Heimes <frank.heimes@canonical.com>  Tue, 18 Aug 2026 15:24:04 +0000

opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu1.2) jammy; urgency=medium

  * Add d/p/lp-2022088-fix-p11sak-failure-to-find-libopencryptoki.so.patch
    to fix the failure that p11sak is not able to find libopencryptoki as
    plugin, by adjusting 'default_pkcs11lib'. (LP: #2022088)
  * d/opencryptoki.install: install full set of etc/opencryptoki build
    folder to esp. catch all generated conf files and on top make the arch-
    specific file 'opencryptoki.install.s390x' obsolete. (LP: #2018911)
  * d/libopencryptoki0.links{.s390x} Merge files, since the content of the
    s390x version of this file applies in all cases,
    and remove leading slash in path for consistency reasons.
  * Assign pkcs11 group to p11sak_defined_attrs.conf and strength.conf
    in debian/opencryptoki.postinst rather than in Makefile.am and add
    d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
    to solve "invalid group ‘pkcs11’" issues during build.
  * d/opencryptoki.postinst: change strength.conf file permissions to 640
    which is checked/forced by the opencryptoki code. (LP: #2018908)

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 30 Jun 2023 10:11:32 +0200

opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu1.1) jammy; urgency=medium

  * d/p/6759faed-EP11-Fix-host-library-version-query.patch
    fix unavailability of Dilithium support in OpenCryptoki >= 3.13
    with upgraded EP11 host library
    Thanks to Ingo Franzki (LP: #1973296)

 -- Frank Heimes <frank.heimes@canonical.com>  Mon, 16 May 2022 13:24:15 +0200

opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu1) jammy; urgency=medium

  * New upstream release LP: #1959419
    based on 3.17 + master (b40982e) at date 20220202
    - Update d/p/01-disable-testcases.patch
    - Refresh d/p/03-dlopen-soname.patch
    - Update and Refresh d/p/04-pkcsslotd-cmdline-args.patch
    - Drop lp1928780-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch
    - Add libudev-dev to d/control Build-Depends
    - Remove 'BSD' entry for usr/lib/pkcs11/aep_stdll/* from d/copyright,
      since this (sub-)folder got removed
    - Update relevant IBM license years in d/copyright
    - Remove testcases/crypto/abfunc.c from Files-Excluded in d/copyright,
      since it's clearly under IBM copyright, that is listed further down
    - Upstream 'doc' folder is now required and cannot be excluded anymore,
      hence changed Files-Excluded from doc to more specific doc/README.*
    - New version expands key management tool p11sak functionality,
      hence solves LP: #1959577

 -- Frank Heimes <frank.heimes@canonical.com>  Tue, 15 Feb 2022 09:30:48 +0100

opencryptoki (3.16.0+dfsg-0ubuntu3) jammy; urgency=medium

  * No-change rebuild against libica4

 -- Simon Chopin <simon.chopin@canonical.com>  Mon, 07 Feb 2022 16:44:49 +0100

opencryptoki (3.16.0+dfsg-0ubuntu2) jammy; urgency=medium

  * No-change rebuild against openssl3

 -- Simon Chopin <simon.chopin@canonical.com>  Tue, 07 Dec 2021 15:44:43 +0100

opencryptoki (3.16.0+dfsg-0ubuntu1) impish; urgency=medium

  * New upstream release (LP: #1928767)
    + Refresh d/p/03-dlopen-soname.patch
    + Drop patches merged upstream:
      - d/p/d15736b3d586518bfa2359e7eb28b90837b5de22.patch
      - d/p/821bc7ab4635e189d31bc3c808c626b9fcda5d02.patch
      - d/p/2d16f003911ceee50967546f4b3c7cac2db9ba86.patch
      - d/p/f1f176cbb4183bcb8a0f7b4d7f649d84a731dd43.patch
      - d/p/1e98001ff63cd7e75d95b4ea0d3d2a69965d8890.patch
  * d/copyright: only remove actually unlicensed files
  * Cherry-pick a fix from master (LP: #1928780)

 -- Simon Chopin <simon.chopin@canonical.com>  Mon, 26 Jul 2021 18:55:27 +0200

opencryptoki (3.15.1+dfsg-0ubuntu2) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 17:54:27 -0400

opencryptoki (3.15.1+dfsg-0ubuntu1) hirsute; urgency=medium

  * New upstream release LP: #1906369.
  * Add patch f1f176cbb4183bcb8a0f7b4d7f649d84a731dd43 fixing migration of a
    master key from OLD register to CURRENT register (LP: #1915517).
  * Add patch 2d16f003911ceee50967546f4b3c7cac2db9ba86 fixing compiling with
    c++.
  * Add patch 821bc7ab4635e189d31bc3c808c626b9fcda5d02 with error message
    handling for p11sak remove-key command.
  * Add patch 1e98001ff63cd7e75d95b4ea0d3d2a69965d8890 fixing a problem with
    C_Get/SetOperationState and digest contexts.

 -- Brian Murray <brian@ubuntu.com>  Mon, 22 Feb 2021 16:48:12 -0800

opencryptoki (3.14.0+dfsg-0ubuntu3) groovy; urgency=medium

  * Fix token migration and conversion LP: #1893216

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 17 Sep 2020 15:14:34 +0100

# For older changelog entries, run 'apt-get changelog libopencryptoki0'
