opencryptoki (3.27.0+dfsg-0ubuntu2) stonking; urgency=medium

  * No-change rebuild against libssl4

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Fri, 24 Jul 2026 11:03:42 +0000

opencryptoki (3.27.0+dfsg-0ubuntu1) stonking; urgency=medium

  * New upstream release (LP: #2160204, LP: #2160205, LP: #2160146).
  * d/p/01-disable-testcases.patch: Rebase/refresh for the 3.27.0 upstream.
  * d/p/03-dlopen-soname.patch: Refresh to solve patch fuzz.
  * d/watch: Update to watch file format to latest version 5.
  * d/control: Update Standards-Version field to latest 4.7.4.
  * d/p/fix-incompatible-pointer-types-on-32bit.patch: Fix armhf FTBFS from
    passing CK_ULONG* where size_t* is expected (upstream issue).

 -- Frank Heimes <frank.heimes@canonical.com>  Thu, 16 Jul 2026 16:56:35 +0000

opencryptoki (3.26.0+dfsg-0ubuntu1) resolute; urgency=medium

  * New upstream release. (LP: #2135123)
    - Update d/01-disable-testcases.patch due to slightly changed context.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 12 Dec 2025 14:11:10 +0100

opencryptoki (3.25.0+dfsg-0ubuntu1) questing; urgency=medium

  * New upstream release. (LP: #2116720)
    - Adjust d/p/01-disable-testcases.patch due to changed context
      and modernize the patch.
    - Extend d/p/03-dlopen-soname.patch to adjust so-name in p11kmip.h.
    - Refresh d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to\
      -postinst.patch to remove fuzz.
    - Add new doc to d/opencryptoki.docs.
    - Add d/p/dfsg_conform_build.patch to make build work on DFSG conform
      tar ball.

 -- Frank Heimes <frank.heimes@canonical.com>  Tue, 15 Jul 2025 12:23:44 +0200

opencryptoki (3.24.0+git20250128.0462717+dfsg-0ubuntu1) plucky; urgency=medium

  * New version, based on upstream snapshot, to incorporate support for:
    - CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens (LP: #2097110) and
    - cca token support cipher keys (LP: #2097111)
  * Remove the following patch, since it's now included:
    d/p/lp-2095337-COMMON-Fix-compile-error-due-to-incompatible-pointer.patch

 -- Frank Heimes <frank.heimes@canonical.com>  Mon, 03 Feb 2025 13:35:04 +0100

opencryptoki (3.24.0+dfsg-0ubuntu1) plucky; urgency=medium

  * New upstream release. (LP: #2095337)
  * Remove d/p/lp-2050018-* since these 9 patches are now included.
  * Update d/p/01-disable-testcases.patch due to new version number.
  * Modify d/p/03-dlopen-soname.patch due to more significant code changes.
  * Update
    d/plp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
    due to changes in context.
  * Remove d/opencryptoki.lintian-overrides and
    d/libopencryptoki0.lintian-overrides, since both are no longer needed,
    hence are reported by lintian as unused.
  * Adjust d/opencryptoki.install and d/rules for DEP-17 (/usr-merge)
    compliance (path to systemd).
  * Add
    d/p/lp-2095337-COMMON-Fix-compile-error-due-to-incompatible-pointer.patch
    to fix compile error on armhf.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 17 Jan 2025 14:31:09 +0100

opencryptoki (3.23.0+dfsg-0ubuntu4) oracular; urgency=medium

  * Add support for protected keys and extractable keys with EP11 token, with:
    - d/p/lp-2050018-EP11-pkey-option-add-new-PKEY_MODE-parms-to-ep11-con.patch
    - d/p/lp-2050018-EP11-pkey-option-handle-new-PKEY_MODE-parms-for-new-.patch
    - d/p/lp-2050018-EP11-pkey-option-handle-new-PKEY_MODE-parms-in-eligi.patch
    - d/p/lp-2050018-EP11-pkey-option-add-NO_PKEY-compile-option-for-EP11.patch
    - d/p/lp-2050018-EP11-pkey-option-consolidate-code-parts-no-logic-cha.patch
    - d/p/lp-2050018-EP11-add-check-if-protected-key-support-available-at.patch
    - d/p/lp-2050018-EP11-consider-combined-extract-for-XTS-pkey-check.patch
    - d/p/lp-2050018-EP11-Reject-combined-extract-attribute-settings-if-i.patch
    - d/p/lp-2050018-EP11-Fix-compile-error-with-NO_PKEY-defined.patch
    (LP: #2050018)

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 26 Jul 2024 13:04:25 +0200

opencryptoki (3.23.0+dfsg-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 20:23:07 +0000

opencryptoki (3.23.0+dfsg-0ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 20:29:43 +0000

opencryptoki (3.23.0+dfsg-0ubuntu1) noble; urgency=medium

  * New upstream release (LP: #2050014)
    - Solves 'EP11 token support for FIPS 2021-session bound EP11 keys'.
    - Adjust d/p/01-disable-testcases.patch due to changed context.
    - Add 'Pre-Depends: ${misc:Pre-Depends}' to d/control to fix
      lintian warning 'skip-systemd-native-flag-missing-pre-depends'.

 -- Frank Heimes <frank.heimes@canonical.com>  Thu, 15 Feb 2024 11:31:50 +0100

opencryptoki (3.22.0+dfsg-0ubuntu1) noble; urgency=medium

  * New upstream release (LP: #2050023), incl. support for:
    - CCA token: PKCS #11 3.0 supporting AES_XTS (LP: #2025924)
    - Adjust d/p/01-disable-testcases.patch due to slightly changed context.
    - Refresh d/p/03-dlopen-soname.patch due to fuzz.
    - Remove the following patches, since they are all incl. in upstream 3.22:
      - d/p/lp-2026732-common-Correctly-set-default-attributes-for-*.patch
      - d/p/lp-2026732-p11sak-Fix-user-confirmation-prompt-behavior-*.patch
      - d/p/lp-2026732-pkcsstats-Fix-handling-of-user-name.patch
      - d/p/lp-2026732-p11sak-fix-length-handling-when-importing-and-*.patch
      - d/p/lp-2026732-p11sak-Fix-listing-of-key-objects-when-other-*.patch
      - d/p/lp-2026732-p11sak-Fix-parsing-of-slot-number-0.patch
  * Update 'Standards-Version' in d/control from 4.6.1.0 to latest 4.6.2.
  * Change 'Forwarded' field from "no" or "not-needed" in
    d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 02 Feb 2024 16:15:29 +0100

opencryptoki (3.21.0+dfsg-0ubuntu2) noble; urgency=medium

  * Fix opencryptoki package install issue (LP: #2039783)
    - Remove d/opencryptoki.tmpfile since upstream opencryptoki.conf
      from build output should be used.
    - Leave the handling of non-persistent file and folders
      (like /run/opencryptoki/ and /var/lock/opencryptoki) entirely
      to systemd-tmpfiles and tmpfiles.d/opencryptoki.conf, means:
      - remove them from d/openstack.dirs
      - and instead call systemd-tmpfiles in d/openstack.postinst
      - this also allows to consolidate and remove commands from postinst
    - Ensure that pkcs11 is a supplementary group for root.
    - Modify d/opencryptoki.postrm and remove pkcsslotd user before
      removing pkcs11 group (otherwise it'll never be empty).
    - Remove obsolete Depends on lsb-base to avoid a lintian error report.

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 01 Dec 2023 16:32:47 +0100

opencryptoki (3.21.0+dfsg-0ubuntu1) mantic; urgency=medium

  * New upstream release (LP: #2026732), incl. support for:
    - concurrent MK rotation for ep11 token (LP: #2025917)
    - concurrent MK rotation for cca token (LP: #2025926)
    - cca token: protected key support (LP: #2025923)
    - pkcsslotd hardening (LP: #2025922)
    Required modifications:
    - add libcap-dev to Build-Depends
    - adjust and refresh d/p/01-disable-testcases.patch due to changed context
    - adjust and refresh d/p/04-pkcsslotd-cmdline-args.patch due to changed
      context and fuzz
    - adjust, expand and refresh
      d/p/lp-1982842-move-pkcs11-group-assigment-from-makefile-to-postinst.patch
      due to changed context and changes around pkcsslotd, which req. folders
      added to d/opencryptoki.dirs and modifications in d/opencryptoki.postinst
      and d/opencryptoki.postrm to work properly.
    Fix selected issues on top of v3.21 and add:
    - d/p/lp-2026732-common-Correctly-set-default-attributes-for-certific.patch
    - d/p/lp-2026732-p11sak-Fix-user-confirmation-prompt-behavior-when-st.patch
    - d/p/lp-2026732-pkcsstats-Fix-handling-of-user-name.patch
    - d/p/lp-2026732-p11sak-fix-length-handling-when-importing-and-export.patch
    - d/p/lp-2026732-p11sak-Fix-listing-of-key-objects-when-other-object-.patch
    - d/p/lp-2026732-p11sak-Fix-parsing-of-slot-number-0.patch
  * According to LP: #2022088 comment #4, revert d/rules, d/triggers
    d/libopencryptoki0.{install,links} back, but do not instead add 
    d/p/lp-2022088-fix-p11sak-failure-to-find-libopencryptoki.so.patch
    to fix 'failure that p11sak is not able to find libopencryptoki',
    since the p11sak code was refactored and changed significantly in v3.21.
    To fix this now expand d/p/03-dlopen-soname.patch with hunks for
    usr/sbin/p11sak/p11sak.h, usr/sbin/pkcshsm_mk_change/pkcshsm_mk_change.c,
    usr/sbin/pkcsstats/pkcsstats.c, testcases/common/common.c and
    testcases/policy/policytest.c
  * d/libopencryptoki0.links{.s390x} Merge files, since the content of the
    s390x version of this file applies to all platforms.
  * d/*: changes due to wrap-and-sort run

 -- Frank Heimes <frank.heimes@canonical.com>  Fri, 07 Jul 2023 12:15:35 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libopencryptoki0`.
