pwdsphinx (2.0.3-1) unstable; urgency=low

  * New upstream, released 2025-03-20: "minor bugfix release": this upstream
    release fixes:
     - a more friendly error message if no configuration is found, yet
        allows one to continue with defaults, so that eventual tests and
        programmatic use is possible.
     - client actually uses the configured timeouts for network connections
     - unittests have 3s sleep between to accommodate for overloaded CI/CD
        infra failing tests because of resource starvation
     - github codeql action is now enabled

  * d/tests/control: add "flaky" to Restrictions: we're still seeing tests
    fail.

 -- Joost van Baal-Ilić <joostvb@debian.org>  Fri, 21 Mar 2025 09:10:02 +0100

pwdsphinx (2.0.2-1) unstable; urgency=low

  * New upstream, released 2025-03-15:
     [fix] healthcheck was not adapted to the new ratelimit1 fn sig
    Missed 2.0.1, released 2025-03-15:
     [fix] added debug cfg setting, disabled dev debug exceptions & fixed
      actually working despite missing oracles, if enough respond
     [doc] changed radicle rid in readme
  * d/control: add link to https://sphinx.pm/ in description.
  * d/NEWS: added: document liboprf version requirements.

 -- Joost van Baal-Ilić <joostvb@debian.org>  Thu, 20 Mar 2025 06:37:08 +0100

pwdsphinx (2.0.0-1) unstable; urgency=low

  * New upstream, released 2025-03-10:
    [fix] change ops do the same enforcement of rules and handling of
     converters as create ops
  * d/tests/control: get rid of "Architecture: !armel !armhf !i386 !ppc64el
    !riscv64": we now run tests on all Debian architectures.

   On salsa, for python 3.13: 288 tests PASS, 1 FAILS: ERROR:
   test_recreate_user (tests.test.TestEndToEndNoRWD_Keys.test_recreate_user).
   On my own computer, python 3.13: Ran 289 tests in 307.848s OK.

 -- Joost van Baal-Ilić <joostvb@debian.org>  Wed, 12 Mar 2025 14:37:50 +0100

pwdsphinx (2.0.0~rc7-1) unstable; urgency=low

  * New upstream, released 2025-02-18:
    [enh] create/challenge ops return pubkeys for age/minisign/ssh-ed25519
     converters
    [doc] reformatted age/minisign examples in manpage
    [fix] not all manpages are html files
    [doc] also generate html from manpages
    [doc] provided examples of how to use the various converters in the
     sphinx(1) manpage
    [enh] added experimental ssh-ed25519 converter
    [fix] bug where converted output was infinite looping in the enforcing of
     all char classes being used during creation, based on convertedBy()
    [enh] converters now has a convertedBy function, which returns the
     converter based on a username, also convert supplies username and host to
     converters
    [mod] converters.convert() fn also gets username and host as params
    [fix] don't crash the server with non-ssl connections, thx a

  * d/tests/control: no longer mark tests as flaky, since we pass all of them
    now on buildd.d.o.  (We still have "Architecture: !armel !armhf !i386
    !ppc64el !riscv64".)

 -- Joost van Baal-Ilić <joostvb@debian.org>  Sat, 22 Feb 2025 14:49:25 +0100

pwdsphinx (2.0.0~rc6-1) unstable; urgency=low

  * New upstream, released 2025-02-06:
    [enh] added experimental minisign converter
    [enh] added pipe2tmpfile contrib tool
    [mod] removed obsolete contrib/sphage
    [mod] replaced contrib/sphage with converters/sphage installed via setup.py
    [fix] failing unittests in pristine clone of gitrepo

  * d/pwdsphinx-tools.{install,manpages}: install pipe2tmpfile script and
    manpage.

  On salsa, for Python 3.12: Ran 289 tests in 326.837s FAILED (errors=2):
  test_recreate_user (tests.test.TestEndToEndNoRWD_Keys.test_recreate_user),
  test_recreate_user (tests.test.TestEndToEnd.test_recreate_user).

  On my own computer: python3.12: Ran 289 tests in 311.283s OK;
  python3.13: Ran 289 tests in 314.982s OK

 -- Joost van Baal-Ilić <joostvb@debian.org>  Fri, 07 Feb 2025 05:50:19 +0100

pwdsphinx (2.0.0~rc5-1) unstable; urgency=low

  * New upstream, released 2025-01-24
    [ changes by Stefan Marsiske ]
    [doc] documented signing of original request with nonce together in
     whitepaper
    [fix] make all auth nonce sigs also contain the full request - thx mossmans
     for this
    [enh] added healthcheck operation
    [doc] removed reference to oathtool in sphinx-x11(1) man-page
    [fix] otp verb in sphinx-x11 dsl doesn't need to call oathtool anymore, the
     pin is calculated by sphinx internally
    [fix] upgrading TOTP records to v2 didn't work

  * d/copyright: add myself as copyright holder on debian/*.

  BTW: on salsa.d.o: provisioning succeeds, all 3 builds succeed, and all 7
  tests succeed. See
  https://salsa.debian.org/debian/pwdsphinx/-/pipelines/810439 .

 -- Joost van Baal-Ilić <joostvb@debian.org>  Wed, 05 Feb 2025 13:49:03 +0100

pwdsphinx (2.0.0~rc2-1) unstable; urgency=low

  * New upstream, released 2025-01-17
    [ changes by Stefan Marsiske ]
    [fix] otp:// converter and test case
    [fix] test/sphinx.cfg so it works with ltsigkey_path and test.py generated
     keys
    [fix] test.py so it works with b64 ltsigkeys
    [doc] documented webauthn_data_dir in man and sample cfg
    [doc] updated docs/example cfg with ltsigkey_path
    [mod] more robust and informative deletion of v1 records
    [enh] ltsigkey_path points at a file, while ltsigkey contains a b64 encoded
     pubkey in sphinx config section
    [doc] reviewed and updated whitepaper

  * d/control: make build-depends python3-pyoprf versioned: >= 0.6.0, cf
    upstream.  Fixes FTBFS, thanks Santiago Vila.  Closes: #1092041.

  BTW: on salsa.d.o: we pass all 11 pipeline jobs.  however we fail 2 tests:
  see https://salsa.debian.org/debian/pwdsphinx/-/jobs/6943011/raw: python 3.12:
  Ran 14 tests in 0.174s FAILED (errors=2); 3.13: Ran 14 tests in 0.194s FAILED
  (errors=2)

 -- Joost van Baal-Ilić <joostvb@debian.org>  Sat, 18 Jan 2025 09:44:33 +0100

pwdsphinx (2.0.0~rc1-1) unstable; urgency=low

  * This release was never uploaded to the Debian archive.

  * New upstream, released 2025-01-13
    [ changes by Stefan Marsiske ]
    [fix] v1users fails during ratelimit if record non-existant
    [doc] update to man and readme
    [mod] notify user of v1-v2 upgrade and delete of v1 rec, also export
     delete_upgraded in qr code
    [enh] delete empty userblobs automatically
    [fix] infoleak for existing records based on delete auth failures
    [enh] implement automatic deletion of upgraded v1 records
    [enh] added support to retrieve v1 user blobs transparently
    [fix] we need pyoprf v0.6.0 or better with this version
    [enh] more refinements to v1get backward compat, also works now with
     zphinx-zerver
    [mod] guard v1get test
    [fix] don't run init after main finishes in oracle
    [enh] added backward compatibility support for getting records made with
     v1 sphinx
    [enh] added test for getting non-existing record
    [fix] changed ruleblob means different version for blobs

 -- Joost van Baal-Ilić <joostvb@debian.org>  Wed, 15 Jan 2025 06:54:26 +0100

pwdsphinx (1.99.3-beta-1) unstable; urgency=low

  * This release was never uploaded to the Debian archive.

  * New upstream, released 2025-01-07.
    [ changes by Stefan Marsiske and Adam Tauber ]
    [mod] bumped to v1.99.3-beta
    [enh] changed rwd size from 32 to 64 bytes, allowing longer secrets to be
     stored with SPHINX
    [mod] disabled test_get_inv_mpwd test which can fail with a 1/32 chance
    [mod] documented argon2i hardening step in SPHINX protocol, and size of rwd
     changing from 32 to 64 bytes
    [fix] adds missing argon2i hashing of rwd which got lost when going from
     libsphinx to liboprf (thx stsch9 for noticing)
    [fix] should fix https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1092041
     and all other debian build related test failures
    [mod] adapt to the state-struct removal from pyoprf tpdkg
    [fix] remove debug messages
    [fix] parse opaque store config only if it is available
    [enh] finalize webauthn get
    [fix] add clientdata fields at the right place
    [enh] update attestation object generation
    [enh] enhance webauthn
    [enh] finalize webauthn create response
    [fix] use correct data formats
    [enh] add webauthn GET
    [fix] remove unnecessary user creation/deletion
    [enh] store webauthn.create sk under pk "username"
    [enh] create client data for webauthn.get
    [fix] remove dbg messages
    [enh] finalize messaging between webauthn methods & websphinx
    [fix] adjust message processing ++ error handling finetune
    [doc] added opaquestore integration section to manpage
    [doc] added opaque-store integration to readme
    [enh] added extensive end2end tests for opaque-store integration
    [mod] changed test key/cert to p256 from rsa
    [fix] import of ostore in sphinx.py
    [fix] test for singlemode cannot run corrupted dkg test
    [mod] added integration of opaque-store to sphinx client
    [mod] reenabled mocking of print in test.py
    [enh] added tests for predefined pwd and raw outputs
    [fix] raw converted was buggy, due to clearmem overwriting the result of
     the raw "conversion "...
    [enh] allow predefined outputs for raw:// users
    [mod] updated manpages and sphinx example cfg
    [mod] also output the ltsig pubkey as b64 string when running init
    [fix] also in sphinx-x11 handle inputs starting with -
    [mod] switched to select() in oracle before accepting, in hope it fixes the
     problem with debian autopkgtest in their build ci/cd step
    [fix] make ws-test and webauth-create work
    [fix] json needs doublequotes in ws-test
    [enh] ws-test takes now ready made json inputs
    [enh] implement messaging between content script & background.js

  * d/rules: enhance override_dh_auto_install: remove possibly leftover files
    from our tests.
  * d/rules: explicitly set SHELL: allow bashisms in commandlines.

  * d/control: remove libsphinx0 (>= 1.1.1) from pwdsphinx Depends: no longer
    needed.

  BTW: on salsa.d.o: we pass all 11 pipeline jobs.  however we fail lots of
  tests: see https://salsa.debian.org/debian/pwdsphinx/-/jobs/6900750/raw:
  python 3.12: Ran 271 tests in 91.685s FAILED (errors=162); python 3.13: Ran
  271 tests in 104.941s FAILED (errors=162).

 -- Joost van Baal-Ilić <joostvb@debian.org>  Sat, 11 Jan 2025 09:23:30 +0100

pwdsphinx (1.99.2-beta-6) unstable; urgency=low

  * This release was never uploaded to the Debian archive.

  * d/changelog: fix line length in entry 1.99.2-beta-4.  Thanks lintian.

  * d/patches/series: disable 0006-disable-some-tests.patch.  we now run all
    upstream supplied tests.
  * d/rules: make all errors in tests non-fatal.

  BTW: on salsa.d.o: we pass provisioning, we fail build, we pass test:
  pipelines/788365.  We pass 2 builds; we fail the "build i386" with "Ran 193
  tests FAILED (errors=121)" and "dh_missing: error: missing files, aborting".
  We pass 5 tests including the autopkgtest.

 -- Joost van Baal-Ilić <joostvb@debian.org>  Sun, 29 Dec 2024 11:03:34 +0100

# For older changelog entries, run 'apt-get changelog pwdsphinx'
