request-tracker4 (4.4.7+dfsg-1) unstable; urgency=high

  * New upstream release (Closes: #986707, #1054516).
    - [CVE-2023-41259] Vulnerablility to unvalidated email headers in
      incoming email and the mail-gateway REST interface.
    - [CVE-2023-41260] Information leakage via response messages returned
      from requests sent via the mail-gateway REST interface.
  * Drop patches no longer needed:
    - Update-tests-for-EN-datetime-locale-change-to-space.diff
    - fix_expired_certs.dif
  * Drop patches merged upstream:
    - fcgi_client_sigpipe.diff
    - libdatetime-format-natural-perl-v0.14.diff
  * Set Multi-Arch: foreign for rt4-doc-html .
  * Drop patch no_testdeps.diff now that we skip the Mozilla::CA check. 
  * Add autopkgtests.
  * Include ::1 ACL for nginx config.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 29 Oct 2023 22:36:22 +1300

request-tracker4 (4.4.6+dfsg-2) unstable; urgency=medium

  [ Andrew Ruthven ]
  * Update Standards-Version to 4.6.2 (no changes).
  * Use java instead of jexec to build ckeditor (Raised against
    request-tracker5 in #1026669, but also applies to request-tracker4).
  * Remove dependency on lsb-base as it is an obsolete package.
  * Replace patches from 4.4.6+dfsg-1.1 with patches used in 5.0.3, as they
    work with git-dpm.
  * Update d/watch to only look for versions that match 4.x.y as version 5 is
    handled by request-tracker5.
  * Ensure we can build source after successful build.
  * Add disable_dirmngr_in_tests.diff which should make this package able
    to pass the reproducible build tests.
  * Depend on fonts-noto-core instead of the obsolete fonts-noto-hinted
    (Closes: #1050047).
  * Bump debhelper from old 10 to 13.
  * Build-Depend on tzdata-legacy as a number of the tests use timezone names
    that have been moved from tzdata to tzdata-legacy.

  [ Ángel Gonzále ]
  * Fetch timezone from /etc/localtime symlink (Closes: #1038846).

  [ Andrew Ruthven ]
  * Add upstream fix to remove legacy timezones in preference to depending on
    tzdata-legacy (Closes: #1052900).
  * Add upstream fix for expired certificates in test suite.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Thu, 05 Oct 2023 22:56:14 +1300

request-tracker4 (4.4.6+dfsg-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add upstream fixes for FTBFS with newer libdatetime-locale-perl
    and libtest-mocktime-perl and add a new required build dependency
    on libtest-mocktime-hires-perl. (Closes: #1026501)

 -- Adrian Bunk <bunk@debian.org>  Sat, 18 Feb 2023 23:36:39 +0200

request-tracker4 (4.4.6+dfsg-1) unstable; urgency=high

  * New upstream release.
  * Skip check for Mozilla::CA module to allow make testdeps to succeed.
  * Add third-party-source tarball to d/watch.
  * Update fix_test_ldap_ipv4.diff for new test
    t/externalauth/ldap_email_login.t
  * Add some missing dependencies (Closes: #1011845).
  * Fix multiple security issues:
    - [CVE-2022-25802] A cross-site scripting (XSS) issue when displaying
      attachment content with fraudulent content types. This vulnerability
      is assigned
    - Not performing full rights checks on access to file or image type
      custom fields, possibly allowing access to these custom fields by
      users without rights to access to the associated objects (like the
      ticket it is associated with).
  * Add missing dependencies on dbconfig-{mysql,postgresql,sqlite3}.
  * Refresh debian/copyright

 -- Andrew Ruthven <andrew@etc.gen.nz>  Fri, 15 Jul 2022 23:42:26 +1200

request-tracker4 (4.4.5+dfsg-1) unstable; urgency=medium

  * New upstream release.
    Drop patches in new release:
    - upstream_4.4-trunk_gpg:_fix_unitialised_warning.diff
    - upstream_4.4-trunk_gpg:_handle_FAILURE_keyword.diff
    - upstream_4.4-trunk_gpg:_dont_override_fingerprint.diff
    - upstream_4.4-trunk_gpg:_make_crypt-gnupg.t_happy.diff
    - upstream_4.4-trunk_gpg:_quit_gpg-agent.diff
    - upstream_4.4-trunk_gpg:_move_signed_style_with_attachment.eml.diff
    - upstream_4.4-trunk_gpg:_always_use_temp_gpg_homedir.diff
    - upstream_4.4-trunk_gpg:_add_extra_ignored_keywords.diff
    - upstream_4.4-trunk_gpg:_default_cert-digest_algo_SHA256.diff
    - upstream_4.4-trunk_gpg:_update_warning_message_tests.diff
    - upstream_4.4-trunk_gpg:_add_gpg.conf.diff
    - upstream_4.4-trunk_cve:_avoid_time_side_channel_attack.diff
  * Specify correct branch in d/upstream/metadata
  * Ensure a sane database admin user is specified (Closes: #985141)
  * Patch rt-server.fcgi to ignore SIGPIPE to stop processes exiting for
    no good reason.
  * Add d/upstream/signing-key.asc for verifying upstream tarball.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sat, 09 Apr 2022 16:54:32 +1200

request-tracker4 (4.4.4+dfsg-3) unstable; urgency=medium

  [ Andrew Ruthven ]
  * Apply upstream patch which fixes a security vulnerability that involves a
    login timing side-channel attack. This resolves CVE-2021-38562
    (Closes: #995175)

 -- Niko Tyni <ntyni@debian.org>  Fri, 01 Oct 2021 22:13:21 +0300

request-tracker4 (4.4.4+dfsg-2) unstable; urgency=medium

  * Downgrade Depends on rsyslog | system-log-daemon to Recommends
    to support installations which prefer to use only systemd for
    logging (Closes: #981942)
  * Remove obsolete alternative depends on dual-lived modules

 -- Dominic Hargreaves <dom@earth.li>  Sun, 07 Feb 2021 15:44:18 +0000

request-tracker4 (4.4.4+dfsg-1) unstable; urgency=medium

  [ Andrew Ruthven ]
  * Switch from gpg1 to gpg2 (Closes: #846029)
    Import the following patches from the upstream 4.4-trunk branch to support
    GnuPG v2.2. They have not yet been included in a 4.4.x release:
    - upstream_4.4-trunk_gpg:_add_extra_ignored_keywords.diff
    - upstream_4.4-trunk_gpg:_add_gpg.conf.diff
    - upstream_4.4-trunk_gpg:_always_use_temp_gpg_homedir.diff
    - upstream_4.4-trunk_gpg:_default_cert-digest_algo_SHA256.diff
    - upstream_4.4-trunk_gpg:_dont_override_fingerprint.diff
    - upstream_4.4-trunk_gpg:_fix_unitialised_warning.diff
    - upstream_4.4-trunk_gpg:_handle_FAILURE_keyword.diff
    - upstream_4.4-trunk_gpg:_make_crypt-gnupg.t_happy.diff
    - upstream_4.4-trunk_gpg:_move_signed_style_with_attachment.eml.diff
    - upstream_4.4-trunk_gpg:_quit_gpg-agent.diff
    - upstream_4.4-trunk_gpg:_update_warning_message_tests.diff
  * Add myself to debian/copyright and as an Uploader
  * Add fix_test_ldap_ipv4.diff to fix LDAP test.

  [ Dominic Hargreaves ]
  * Depend on perl-doc so that script usage is printed correctly
    (Closes: #666123)
  * Import new dfsg version of third-party sources (Closes: #981079)
  * Add scripts to add additional sources to third-party directory
  * Refresh debian/copyright

 -- Dominic Hargreaves <dom@earth.li>  Mon, 01 Feb 2021 23:16:08 +0000

request-tracker4 (4.4.4-2) unstable; urgency=medium

  [ Dominic Hargreaves ]
  * Add Build-Depends/Depends on libpod-parser-perl which will be
    removed from perl in 5.32 (Closes: #961327)

  [ Andrew Ruthven ]
  * Ensure that GnuPG::Interface instantiates with the gpg binary to use
    (Closes: #967017)

 -- Dominic Hargreaves <dom@earth.li>  Sun, 09 Aug 2020 21:06:36 +0100

request-tracker4 (4.4.4-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Trim trailing whitespace.
  * Use secure copyright file specification URI.
  * Use secure URI in Homepage field.
  * Move source package lintian overrides to debian/source.
  * Bump debhelper from old 9 to 10.
  * Replace /var/run with /run for the Service PIDFile.
  * Set upstream metadata fields: Repository, Repository-Browse.
  * Update standards version to 4.1.5, no changes needed.

  [ Dominic Hargreaves ]
  * New upstream release (Closes: #954994)
  * Lintian fixes
    - replace inline remote images with links
    - remove obsolete Build-Depends on dh-autoreconf
    - add symlink debian/missing-sources to third-party/...
    - updated overrides for new version of jquery
    - fix wrong distribution in debian/NEWS
    - fix wrong interpreter in etc/upgrade/upgrade-mysql-schema.pl

 -- Dominic Hargreaves <dom@earth.li>  Sun, 29 Mar 2020 19:39:39 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog rt4-db-postgresql`.
