opencryptoki (3.25.0+dfsg-0ubuntu1) questing; urgency=medium

  * New upstream release. (LP: #2116720)
    - Adjust d/p/01-disable-testcases.patch due to changed context
      and modernize the patch.
    - Extend d/p/03-dlopen-soname.patch to adjust so-name in p11kmip.h.
    - Refresh d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to\
      -postinst.patch to remove fuzz.
    - Add new doc to d/opencryptoki.docs.
    - Add d/p/dfsg_conform_build.patch to make build work on DFSG conform
      tar ball.

 -- Frank Heimes <frank.heimes@canonical.com>  Tue, 15 Jul 2025 12:23:44 +0200

opencryptoki (3.24.0+git20250128.0462717+dfsg-0ubuntu1) plucky; urgency=medium

  * New version, based on upstream snapshot, to incorporate support for:
    - CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens (LP: #2097110) and
    - cca token support cipher keys (LP: #2097111)
  * Remove the following patch, since it's now included:
    d/p/lp-2095337-COMMON-Fix-compile-error-due-to-incompatible-pointer.patch

 -- Frank Heimes <frank.heimes@canonical.com>  Mon, 03 Feb 2025 13:35:04 +0100

opencryptoki (3.24.0+dfsg-0ubuntu1) plucky; urgency=medium

  * New upstream release. (LP: #2095337)
  * Remove d/p/lp-2050018-* since these 9 patches are now included.
  * Update d/p/01-disable-testcases.patch due to new version number.
  * Modify d/p/03-dlopen-soname.patch due to more significant code changes.
  * Update
    d/plp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
    due to changes in context.
  * Remove d/opencryptoki.lintian-overrides and
    d/libopencryptoki0.lintian-overrides, since both are no longer needed,
    hence are reported by lintian as unused.
  * Adjust d/opencryptoki.install and d/rules for DEP-17 (/usr-merge)
    compliance (path to systemd).
  * Add
    d/p/lp-2095337-COMMON-Fix-compile-error-due-to-incompatible-pointer.patch
    to fix compile error on armhf.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 17 Jan 2025 14:31:09 +0100

opencryptoki (3.23.0+dfsg-0ubuntu4) oracular; urgency=medium

  * Add support for protected keys and extractable keys with EP11 token, with:
    - d/p/lp-2050018-EP11-pkey-option-add-new-PKEY_MODE-parms-to-ep11-con.patch
    - d/p/lp-2050018-EP11-pkey-option-handle-new-PKEY_MODE-parms-for-new-.patch
    - d/p/lp-2050018-EP11-pkey-option-handle-new-PKEY_MODE-parms-in-eligi.patch
    - d/p/lp-2050018-EP11-pkey-option-add-NO_PKEY-compile-option-for-EP11.patch
    - d/p/lp-2050018-EP11-pkey-option-consolidate-code-parts-no-logic-cha.patch
    - d/p/lp-2050018-EP11-add-check-if-protected-key-support-available-at.patch
    - d/p/lp-2050018-EP11-consider-combined-extract-for-XTS-pkey-check.patch
    - d/p/lp-2050018-EP11-Reject-combined-extract-attribute-settings-if-i.patch
    - d/p/lp-2050018-EP11-Fix-compile-error-with-NO_PKEY-defined.patch
    (LP: #2050018)

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 26 Jul 2024 13:04:25 +0200

opencryptoki (3.23.0+dfsg-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 20:23:07 +0000

opencryptoki (3.23.0+dfsg-0ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 20:29:43 +0000

opencryptoki (3.23.0+dfsg-0ubuntu1) noble; urgency=medium

  * New upstream release (LP: #2050014)
    - Solves 'EP11 token support for FIPS 2021-session bound EP11 keys'.
    - Adjust d/p/01-disable-testcases.patch due to changed context.
    - Add 'Pre-Depends: ${misc:Pre-Depends}' to d/control to fix
      lintian warning 'skip-systemd-native-flag-missing-pre-depends'.

 -- Frank Heimes <frank.heimes@canonical.com>  Thu, 15 Feb 2024 11:31:50 +0100

opencryptoki (3.22.0+dfsg-0ubuntu1) noble; urgency=medium

  * New upstream release (LP: #2050023), incl. support for:
    - CCA token: PKCS #11 3.0 supporting AES_XTS (LP: #2025924)
    - Adjust d/p/01-disable-testcases.patch due to slightly changed context.
    - Refresh d/p/03-dlopen-soname.patch due to fuzz.
    - Remove the following patches, since they are all incl. in upstream 3.22:
      - d/p/lp-2026732-common-Correctly-set-default-attributes-for-*.patch
      - d/p/lp-2026732-p11sak-Fix-user-confirmation-prompt-behavior-*.patch
      - d/p/lp-2026732-pkcsstats-Fix-handling-of-user-name.patch
      - d/p/lp-2026732-p11sak-fix-length-handling-when-importing-and-*.patch
      - d/p/lp-2026732-p11sak-Fix-listing-of-key-objects-when-other-*.patch
      - d/p/lp-2026732-p11sak-Fix-parsing-of-slot-number-0.patch
  * Update 'Standards-Version' in d/control from 4.6.1.0 to latest 4.6.2.
  * Change 'Forwarded' field from "no" or "not-needed" in
    d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 02 Feb 2024 16:15:29 +0100

opencryptoki (3.21.0+dfsg-0ubuntu2) noble; urgency=medium

  * Fix opencryptoki package install issue (LP: #2039783)
    - Remove d/opencryptoki.tmpfile since upstream opencryptoki.conf
      from build output should be used.
    - Leave the handling of non-persistent file and folders
      (like /run/opencryptoki/ and /var/lock/opencryptoki) entirely
      to systemd-tmpfiles and tmpfiles.d/opencryptoki.conf, means:
      - remove them from d/openstack.dirs
      - and instead call systemd-tmpfiles in d/openstack.postinst
      - this also allows to consolidate and remove commands from postinst
    - Ensure that pkcs11 is a supplementary group for root.
    - Modify d/opencryptoki.postrm and remove pkcsslotd user before
      removing pkcs11 group (otherwise it'll never be empty).
    - Remove obsolete Depends on lsb-base to avoid a lintian error report.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 01 Dec 2023 16:32:47 +0100

opencryptoki (3.21.0+dfsg-0ubuntu1) mantic; urgency=medium

  * New upstream release (LP: #2026732), incl. support for:
    - concurrent MK rotation for ep11 token (LP: #2025917)
    - concurrent MK rotation for cca token (LP: #2025926)
    - cca token: protected key support (LP: #2025923)
    - pkcsslotd hardening (LP: #2025922)
    Required modifications:
    - add libcap-dev to Build-Depends
    - adjust and refresh d/p/01-disable-testcases.patch due to changed context
    - adjust and refresh d/p/04-pkcsslotd-cmdline-args.patch due to changed
      context and fuzz
    - adjust, expand and refresh
      d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
      due to changed context and changes around pkcsslotd, which req. folders
      added to d/opencryptoki.dirs and modifications in d/opencryptoki.postinst
      and d/opencryptoki.postrm to work properly.
    Fix selected issues on top of v3.21 and add:
    - d/p/lp-2026732-common-Correctly-set-default-attributes-for-certific.patch
    - d/p/lp-2026732-p11sak-Fix-user-confirmation-prompt-behavior-when-st.patch
    - d/p/lp-2026732-pkcsstats-Fix-handling-of-user-name.patch
    - d/p/lp-2026732-p11sak-fix-length-handling-when-importing-and-export.patch
    - d/p/lp-2026732-p11sak-Fix-listing-of-key-objects-when-other-object-.patch
    - d/p/lp-2026732-p11sak-Fix-parsing-of-slot-number-0.patch
  * According to LP: #2022088 comment #4, revert d/rules, d/triggers
    d/libopencryptoki0.{install,links} back, but do not instead add 
    d/p/lp-2022088-fix-p11sak-failure-to-find-libopencryptoki.so.patch
    to fix 'failure that p11sak is not able to find libopencryptoki',
    since the p11sak code was refactored and changed significantly in v3.21.
    To fix this now expand d/p/03-dlopen-soname.patch with hunks for
    usr/sbin/p11sak/p11sak.h, usr/sbin/pkcshsm_mk_change/pkcshsm_mk_change.c,
    usr/sbin/pkcsstats/pkcsstats.c, testcases/common/common.c and
    testcases/policy/policytest.c
  * d/libopencryptoki0.links{.s390x} Merge files, since the content of the
    s390x version of this file applies to all platforms.
  * d/*: changes due to wrap-and-sort run

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 07 Jul 2023 12:15:35 +0200

opencryptoki (3.20.0+dfsg-0ubuntu2) mantic; urgency=medium

  * d/rules, d/triggers, d/libopencryptoki0.install: keep tmp/etc/ld.so.conf.d
    content, add opencryptoki conf file to /etc/ld.so.conf.d/
    and add trigger for ldconfig to allow tools like
    p11sak to find libopencryptoki shared object file. (LP: #2022088)
  * d/control, d/compat: Bump dh compat level to 13 to remove dh-exec
    dependency and remove executable flags from d/*.install*, d/*.links*.
  * d/rules: remove the explicit dh_missing call, and rely instead on dh
    to call it and erroring out on missing files.
  * d/opencryptoki.install: install entire content of etc/opencryptoki build
    folder to esp. catch all existing conf files and on top make the arch-
    specific file 'opencryptoki.install.s390x' obsolete. (LP: #2018911)
  * d/opencryptoki.postinst: change strength.conf file permissions to 640
    which is checked/forced by the code. (LP: #2018908)

 -- Frank Heimes <frank.heimes@canonical.com>  Wed, 31 May 2023 21:28:48 +0200

opencryptoki (3.20.0+dfsg-0ubuntu1) lunar; urgency=medium

  * New upstream release (LP: #2003847), includes support for:
    - ep11 token: master key consistency (LP: #2003629)
    - ica and soft tokens: PKCS #11 3.0 - support AES_XTS (LP: #2003630)
    - ep11 token: PKCS #11 3.0 - support AES_XTS (LP: #2003632)
    - Support of ep11 token for new IBM Z Hardware (IBM z16) (LP: #2003635)
    - ep11 token: vendor specific key derivation (LP: #2003638)
    - key gen. with expected MKVP only on CCA and EP11 tokens (LP: #2003639)
    - p11sak support Dilithium and Kyber keys (LP: #2003669)
  * Remove patch
    d/p/lp-1982842-EP11-Fix-C_GetMechanismList-returning-CKR_BUFFER_TOO.patch
    since it's included in 3.19 and newer.
  * Remove patch 
    d/p/lp-1989558-common-fix-memory-leak-in-save_private_token_object.patch
    since it's included in 3.19 and newer.
  * Adjust patch d/p/01-disable-testcases.patch due to minor change in context.
  * Refresh patch d/p/03-dlopen-soname.patch to fix 'fuzz'.
  * Modified patch
    d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
    due to change in context, refresh it to fix 'fuzz' and remove addgroup
    from Makefile.am, since this is handled in d/opencryptoki.postinst.
  * Add opencryptoki.pc to d/libopencryptoki-dev.install.
  * Add new config file ccatok.conf to d/opencryptoki.install.s390x.
  * Consolidate multiple /etc/opencryptoki/*.conf entries in
    d/opencryptoki.install to one line and make it more generic.
  * Migrate in d/rules from 'dh_install --fail-missing --sourcedir=debian/tmp'
    to 'dh_install --sourcedir=debian/tmp' and 'dh_missing --fail-missing'.
  * Update 'Standards-Version' field in d/control to latest version 4.6.1.0.
  * Expand the copyright year range in d/copyright relfecting the latest code.

 -- Frank Heimes <frank.heimes@canonical.com>  Mon, 13 Feb 2023 10:10:45 +0100

opencryptoki (3.18.0+dfsg-0ubuntu3) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 15 Dec 2022 19:52:07 +0000

opencryptoki (3.18.0+dfsg-0ubuntu2) kinetic; urgency=medium

  * Add quilt patch
    d/p/lp-1989558-common-fix-memory-leak-in-save_private_token_object.patch
    to fix a failure of opencryptoki C_GenerateKeyPair() that occurs after
    having generated more that 500 RSA keys with CEX7 and CEX8 crypto cards.
    (LP: #1989558)

 -- Frank Heimes <frank.heimes@canonical.com>  Wed, 14 Sep 2022 15:01:02 +0200

opencryptoki (3.18.0+dfsg-0ubuntu1) kinetic; urgency=medium

  * New upstream release, with:
    - minor adjustment in 01-disable-testcases.patch due to different context
    - remove of d/p/6759faed-EP11-Fix-host-library-version-query.patch 
      since it's now included in 3.18 upstream
    - remove file AUTHORS from debian/opencryptoki.docs
      since it got removed in 3.18 upstream
    This new version solves LP bugs (feature requests):
    - "openCryptoki: PKCS #11 3.1 - support CKA_DERIVE_TEMPLATE" (LP: #1982842)
    - "openCryptoki: support crypto profiles" (LP: #1959549)
    - "openCryptoki: add crypto counters" (LP: #1959551)
    - Assign pkcs11 group to p11sak_defined_attrs.conf and strength.conf
      in debian/opencryptoki.postinst rather than of Makefile.am
      to solve "invalid group ‘pkcs11’" issues during build.
      Also extend debian/opencryptoki.install and
      debian/opencryptoki.install.s390x to pick up
      /etc/opencryptoki/p11sak_defined_attrs.conf and
      /etc/opencryptoki/strength.conf.

 -- Frank Heimes <frank.heimes@canonical.com>  Mon, 15 Aug 2022 12:29:35 +0200

opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu2) kinetic; urgency=medium

  * d/p/6759faed-EP11-Fix-host-library-version-query.patch
    fixing fix inavailability of Dilithium support in OpenCryptoki >= 3.13
    with upgraded EP11 host library
    Thanks to Ingo Franzki (LP: #1973296)

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 13 May 2022 19:56:35 +0200

opencryptoki (3.17.0+dfsg+20220202.b40982e-0ubuntu1) jammy; urgency=medium

  * New upstream release LP: #1959419
    based on 3.17 + master (b40982e) at date 20220202
    - Update d/p/01-disable-testcases.patch
    - Refresh d/p/03-dlopen-soname.patch
    - Update and Refresh d/p/04-pkcsslotd-cmdline-args.patch
    - Drop lp1928780-SOFT-Check-the-EC-Key-on-C_CreateObject-and-C_Derive.patch
    - Add libudev-dev to d/control Build-Depends
    - Remove 'BSD' entry for usr/lib/pkcs11/aep_stdll/* from d/copyright,
      since this (sub-)folder got removed
    - Update relevant IBM license years in d/copyright
    - Remove testcases/crypto/abfunc.c from Files-Excluded in d/copyright,
      since it's clearly under IBM copyright, that is listed further down
    - Upstream 'doc' folder is now required and cannot be excluded anymore,
      hence changed Files-Excluded from doc to more specific doc/README.*
    - New version expands key management tool p11sak functionality,
      hence solves LP: #1959577

 -- Frank Heimes <frank.heimes@canonical.com>  Tue, 15 Feb 2022 09:30:48 +0100

opencryptoki (3.16.0+dfsg-0ubuntu3) jammy; urgency=medium

  * No-change rebuild against libica4

 -- Simon Chopin <simon.chopin@canonical.com>  Mon, 07 Feb 2022 16:44:49 +0100

opencryptoki (3.16.0+dfsg-0ubuntu2) jammy; urgency=medium

  * No-change rebuild against openssl3

 -- Simon Chopin <simon.chopin@canonical.com>  Tue, 07 Dec 2021 15:44:43 +0100

opencryptoki (3.16.0+dfsg-0ubuntu1) impish; urgency=medium

  * New upstream release (LP: #1928767)
    + Refresh d/p/03-dlopen-soname.patch
    + Drop patches merged upstream:
      - d/p/d15736b3d586518bfa2359e7eb28b90837b5de22.patch
      - d/p/821bc7ab4635e189d31bc3c808c626b9fcda5d02.patch
      - d/p/2d16f003911ceee50967546f4b3c7cac2db9ba86.patch
      - d/p/f1f176cbb4183bcb8a0f7b4d7f649d84a731dd43.patch
      - d/p/1e98001ff63cd7e75d95b4ea0d3d2a69965d8890.patch
  * d/copyright: only remove actually unlicensed files
  * Cherry-pick a fix from master (LP: #1928780)

 -- Simon Chopin <simon.chopin@canonical.com>  Mon, 26 Jul 2021 18:55:27 +0200

opencryptoki (3.15.1+dfsg-0ubuntu2) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 17:54:27 -0400

opencryptoki (3.15.1+dfsg-0ubuntu1) hirsute; urgency=medium

  * New upstream release LP: #1906369.
  * Add patch f1f176cbb4183bcb8a0f7b4d7f649d84a731dd43 fixing migration of a
    master key from OLD register to CURRENT register (LP: #1915517).
  * Add patch 2d16f003911ceee50967546f4b3c7cac2db9ba86 fixing compiling with
    c++.
  * Add patch 821bc7ab4635e189d31bc3c808c626b9fcda5d02 with error message
    handling for p11sak remove-key command.
  * Add patch 1e98001ff63cd7e75d95b4ea0d3d2a69965d8890 fixing a problem with
    C_Get/SetOperationState and digest contexts.

 -- Brian Murray <brian@ubuntu.com>  Mon, 22 Feb 2021 16:48:12 -0800

opencryptoki (3.14.0+dfsg-0ubuntu3) groovy; urgency=medium

  * Fix token migration and conversion LP: #1893216

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 17 Sep 2020 15:14:34 +0100

opencryptoki (3.14.0+dfsg-0ubuntu2) groovy; urgency=medium

  * Cherrypick fixes from master LP: #1854944

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 09 Jul 2020 15:36:36 +0100

opencryptoki (3.14.0+dfsg-0ubuntu1) groovy; urgency=medium

  * New upstream release LP: #1882808

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 18 Jun 2020 14:05:53 +0100

opencryptoki (3.13.0+dfsg-0ubuntu5) focal; urgency=medium

  * Enable locks by default, on all architectures, which is the new
    upstream default. Previously, only armhf used locks, and all other
    architectures used transactional memory (dispite --disable-locks
    option actually _enabling_ locks in the past)

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 03 Apr 2020 10:43:37 +0100

opencryptoki (3.13.0+dfsg-0ubuntu4) focal; urgency=medium

  * Fix build that disables locks.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 02 Apr 2020 16:13:35 +0100

opencryptoki (3.13.0+dfsg-0ubuntu1) focal; urgency=medium

  * New upstream release LP: #1858792, LP: #1853300

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 26 Feb 2020 17:26:37 +0000

opencryptoki (3.12.1+dfsg-0ubuntu1) focal; urgency=medium

  * New upstream release LP: #1854148, LP: #1852089, LP: #1850294

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 06 Feb 2020 14:59:50 +0000

opencryptoki (3.11.1+dfsg-0ubuntu3) focal; urgency=medium

  * Fix toleration of CEX7P and CEX6P cards, when both are present.
    (LP: #1847031)

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 22 Oct 2019 15:28:41 +0100

opencryptoki (3.11.1+dfsg-0ubuntu2) eoan; urgency=medium

  * Add TLS 1.3 mechanisms to the libica token.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 12 Aug 2019 13:03:54 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libopencryptoki0`.
