rssh (2.3.4-7) unstable; urgency=medium

  * Change the specified mode of conf_convert in the Debian patch to be
    0644, since dpkg doesn't support modes the way that Git does and will
    ignore the mode anyway.  This mismatch was breaking use of dgit for
    this package.

 -- Russ Allbery <rra@debian.org>  Sat, 23 Dec 2017 20:13:24 -0800

rssh (2.3.4-6) unstable; urgency=medium

  * Add Rules-Requires-Root: no.
  * Update to debhelper compatibility level V11.
    - Remove now-useless build dependency on dh-autoreconf.
  * Clean up trailing whitespace in debian/changelog.
  * Update standards version to 4.1.2 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sun, 17 Dec 2017 16:21:18 -0800

rssh (2.3.4-5) unstable; urgency=medium

  * Enable all hardening flags.
  * Fix another spelling error in the rssh man page, caught by Lintian.
  * Translation updates:
    - Indonesian, thanks Izharul Haq.  (Closes: #835621)
  * Switch to the DEP-14 branch layout and update debian/gbp.conf and
    Vcs-Git accordingly.
  * Run wrap-and-sort -ast on packaging files.
  * Switch to https for Vcs-Git and Vcs-Browser URLs.
  * Fix duplicate license clause in debian/copyright.
  * Update standards version to 3.9.8 (no changes required).

 -- Russ Allbery <rra@debian.org>  Mon, 05 Sep 2016 15:39:58 -0700

rssh (2.3.4-4) unstable; urgency=low

  * Fix typo in the example mkchroot script that causes it to fail to
    copy the libnss compat modules.  Patch from Jeremy Jongepier.
    (Closes: #729294)
  * This package is now maintained using gbp pq from git-buildpackage.
    Remove the TopGit glue and the obsolete README.source package and
    rename the patches based on the export convention of gbp pq.
  * Drop override to use xz compression for the binary package.  This is
    now the default in dpkg-buildpackage.
  * Update standards version to 3.9.5 (no changes required).
  * Translation updates:
    - Portuguese (Brazilian), thanks Fernando Ike de Oliveira.
      (Closes: #723148)
  * Reformat translations with debconf-updatepo.  Add some missing
    Language fields and update the Report-Msgid-Bugs-To address.

 -- Russ Allbery <rra@debian.org>  Sat, 07 Dec 2013 19:18:35 -0800

rssh (2.3.4-3) unstable; urgency=low

  * Patch the upstream build system to honor CFLAGS and CPPFLAGS as passed
    to configure.  This fixes use of hardening flags during the build.
    Thanks to Simon Ruderich for the patch.  (Closes: #709941)

 -- Russ Allbery <rra@debian.org>  Tue, 28 May 2013 14:37:10 -0700

rssh (2.3.4-2) unstable; urgency=low

  * Upload to unstable.
  * Fix implicit function declaration compiler warning from the svnserve
    patch.
  * Use xz compression for the Debian source and binary package.
  * Canonicalize the Vcs-Git and Vcs-Browser control fields.
  * Update standards version to 3.9.4 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sat, 11 May 2013 17:09:30 -0700

rssh (2.3.4-1) experimental; urgency=low

  * New upstream release.
    - Merges fixes/command-line-checking.
    - Fix a (probably not exploitable) flaw in determining the command
      to run from the provided command line.
  * Adjust the installation process for the new upstream behavior of
    installing rssh.conf as rssh.conf.default.  The Debian package
    continues to install it as /etc/rssh.conf.
  * Add new logcheck ignore line for a new upstream log message.
  * Fix the log level for a notice of global svnserve access to use debug,
    matching the (patched) behavior for the other program types.
  * Fix the regular expression in the previous change to correctly match a
    literal period instead of any character.  (This fix is not critical,
    but adds further defense in depth.)  Remove an unused variable to
    silence compiler warnings.  Patch from Tomas Hoger.
  * Change debian/watch to use the sf.net redirector.

 -- Russ Allbery <rra@debian.org>  Fri, 07 Dec 2012 16:14:37 -0800

rssh (2.3.3-6) unstable; urgency=high

  * Fix several flaws in validation of rsync options.  Ensure --server
    cannot be hidden from the server by putting it after -- or as the
    argument to another option.  Verify that the -e option's value matches
    expectations rather than trying to look for invalid -e option values.
    (CVE-2012-2251)
  * Reject the rsync --rsh option even if it does not contain a trailing
    equal sign.  (CVE-2012-2252)

 -- Russ Allbery <rra@debian.org>  Thu, 22 Nov 2012 12:01:41 -0800

rssh (2.3.3-5) unstable; urgency=medium

  * Apply upstream patch to close security vulnerability that permitted
    clever manipulation of environment variables on the ssh command line
    to bypass rssh checking.  (CVE-2012-3478)

 -- Russ Allbery <rra@debian.org>  Fri, 10 Aug 2012 22:14:34 -0700

rssh (2.3.3-4) unstable; urgency=low

  * Force libexecdir to /usr/lib/rssh.  This is not a library package and
    has no reason to be using the multiarch paths, but picked up the
    modification to libexecdir as a side effect of the debhelper
    compatibility level change.  (Closes: #663011)

 -- Russ Allbery <rra@debian.org>  Wed, 07 Mar 2012 16:07:37 -0800

# For older changelog entries, run 'apt-get changelog rssh'
