radicale (1.1.6-1) unstable; urgency=medium

  [ upstream ]
  * New release(s).
    + Improve logging for --export-storage.

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 26 Jul 2017 00:24:08 +0000

radicale (1.1.4-1) unstable; urgency=medium

  [ upstream ]
  * New release(s).
    + Security fix: Add random timer to avoid timing oracles and simple
      bruteforce attacks when using the htpasswd authentication method.
    + Various minor fixes.
    + Add --export-storage=FOLDER command-line argument.

  [ Jonas Smedegaard ]
  * Set upstream-stretch as upstream branch for git-buildpackage.
  * Update watch file: Tighten to track only 1.x.x.
  * Drop patches cherry-picked upstream and since applied.
  * Unfuzz patch 2001.
  * Update package relations: Relax to build-depend unversioned on cdbs.

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 27 Jun 2017 18:34:06 +0200

radicale (1.1.1+20160115-4) unstable; urgency=high

  * Add patch cherry-picked upstream to fix Python3 compatibility of
    ssha part of htpasswd.
  * Add patch cherry-picked upstream to fix security bug: Add delay in
    htpasswd authentication.
    Closes: Bug#861514.

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 30 Apr 2017 09:14:16 +0200

radicale (1.1.1+20160115-3) unstable; urgency=medium

  * Set master-stretch as debian branch for big-buildpackage.
  * Add patch to not bogusly quote (commented out) strings for
    .well-known paths in configfile (and while at it, use relative paths
    suitable for more use cases).
    Closes: Bug#845508. Thanks to Martín Ferrari.
  * Add symlink below /usr/share/doc/radicale to sql.schema, to ease
    locating it.
    Closes: Bug#843309. Thanks to Joey Schulze.
  * Shorten commands in README.source (strip gbp options set in config).
  * Modernize CDBS use: Build-depend on licensecheck (not devscripts).

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 29 Nov 2016 21:37:38 +0100

radicale (1.1.1+20160115-2) unstable; urgency=medium

  * Add patch cherry-picked upstream, to clean tests.
  * Check upstream testsuite during build and in autopkgtest.
    Build-depend on python-pytest.
  * Fix generate manpage:
    + Have help2man rule emit output on failure.
    + Fix declare prerequisites for help2man rule.
    + Fix resolve PYTHONPATH more flexibly.
    Closes: Bug#824129. Thanks to Chris Lamb.

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 21 May 2016 14:47:20 +0200

radicale (1.1.1+20160115-1) unstable; urgency=medium

  [ upstream ]
  * Snapshot from 1.1.x git branch.
    + Repair "head" request: Correct function name.
    + Fix the Collection._parse docstring.
    + Quick fix for multifilesystem:
      - Use component names to filter duplicates.
      - Also remove items from the collections itself.

  [ Jonas Smedegaard ]
  * Update watch file:
    + Modernize to use format 4.
    + Mention gbp in usage hint comment.
  * Update git-buildpackage config: Filter any .git* file.
  * Add section on getting upstream source to README.source.
  * Update autopkgtest:
    + Fix FAIL_OK handling.
    + Print server log on failure.
  * Update copyright info:
    + Fix alternate Github https URL.
    + Extend coverage of packaging.

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 11 Apr 2016 17:31:58 +0200

radicale (1.1.1-3) unstable; urgency=medium

  * Improve autopkgtest:
    + Enable CalDAV/implicitacls.xml.
    + Fix allow output to stderr.
    + Fix avoid Validation-CalDAV (causes timeout).

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 10 Apr 2016 12:44:37 +0200

radicale (1.1.1-2) unstable; urgency=medium

  * Add patch 1001 to fix return 404 when trying to delete a non
    existing item.
    Thanks to Guido Günther.
  * Add pkgautotest.
    Thanks to Guido Günther.
  * Declare compliance with Debian Policy 3.9.8.
  * Modernize Vcs-Git field URL: Use https protocol.

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 10 Apr 2016 02:54:13 +0200

radicale (1.1.1-1) unstable; urgency=medium

  [ upstream ]
  * New release(s).
    Changed functionality:
    + Use the first matching section for rights.
    Security fixes:
    + Improve the regex used for well-known URIs.
    + Prevent regex injection in rights management.
    + Prevent crafted HTTP request from calling arbitrary functions.
    + Improve URI sanitation and conversion to filesystem path.
    + Decouple the daemon from its parent environment.
    Closes: bug#809920 (CVE-2015-8747 CVE-2015-8748). Thanks to Felix
    Knecht.
    Bugfixes and minor enhancements:
    + Assign new items to correct key.
    + Avoid race condition in PID file creation.
    + Improve the docker version.
    + Encode message and committer for git commits.
    + Test with Python 3.5.

  [ Jonas Smedegaard ]
  * Update TODOs.
  * Add NEWS entry about changed access rights parsing logic.
  * Drop patches now included upstream.

 -- Jonas Smedegaard <dr@jones.dk>  Tue, 12 Jan 2016 09:17:35 +0530

radicale (1.0.1-3) experimental; urgency=medium

  * Provide python3-radicale package.
  * Update package relations:
    Tighten build-dependencies on cdbs.
    Build-depend on python3 and python3-setuptools.

 -- Jonas Smedegaard <dr@jones.dk>  Wed, 28 Oct 2015 15:59:56 +0100

# For older changelog entries, run 'apt-get changelog python3-radicale'
