ruby1.9.1 (1.9.3.484-2ubuntu1) trusty; urgency=medium

  * Merge from Debian unstable.  Remaining changes:
    - debian/control: Add ca-certificates to libruby1.9.1 depends so that
      rubygems can perform certificate verification
    - debian/rules: Don't install SSL certificates from upstream sources
    - debian/patches/20120927-rubygems_disable_upstream_certs.patch: Use
      /etc/ssl/certs/ca-certificates.crt for the trusted CA certificates.
    - debian/patches/20131218-stack-size.patch: Increase thread stack
      size on 64-bit platforms to prevent testsuite failure on ppc64el.
    - Build-depend on Tcl/Tk 8.5, ruby is not yet ready for Tcl/Tk 8.6.

 -- Adam Conrad <adconrad@ubuntu.com>  Fri, 14 Feb 2014 19:48:22 -0700

ruby1.9.1 (1.9.3.484-2) unstable; urgency=medium

  * new strategy for Ruby version transitions:
    - ruby1.9.1 depends on ruby
    - libruby1.9.1 depends on ruby1.9.1
  * Drop alternatives entries.

 -- Antonio Terceiro <terceiro@debian.org>  Sat, 01 Feb 2014 20:40:01 -0300

ruby1.9.1 (1.9.3.484-1ubuntu2) trusty; urgency=medium

  * Build-depend on tcl8.5-dev and tk8.5-dev, ruby is not yet ready
    for Tcl/Tk 8.6.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 04 Jan 2014 18:00:42 +0100

ruby1.9.1 (1.9.3.484-1ubuntu1) trusty; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/control: Add ca-certificates to libruby1.9.1 depends so that
      rubygems can perform certificate verification
    - debian/rules: Don't install SSL certificates from upstream sources
    - debian/patches/20120927-rubygems_disable_upstream_certs.patch: Use
      /etc/ssl/certs/ca-certificates.crt for the trusted CA certificates.
  * Drop debian/patches/CVE-2013-4164.patch; applied upstream.
  * debian/patches/20131218-stack-size.patch: Increase thread stack
    size on 64-bit platforms to prevent testsuite failure on ppc64el.

 -- Adam Conrad <adconrad@ubuntu.com>  Wed, 18 Dec 2013 03:16:39 -0700

ruby1.9.1 (1.9.3.484-1) unstable; urgency=low

  * New upstream release
    + Includes fix for Heap Overflow in Floating Point Parsing (CVE-2013-4164)
      Closes: #730178
    + drop debian/patches/2013-09-08-restore-rb_f_lambda-declaration.patch,
      already applied upstream.

 -- Antonio Terceiro <terceiro@debian.org>  Mon, 25 Nov 2013 22:31:23 -0300

ruby1.9.1 (1.9.3.448-1ubuntu2) trusty; urgency=low

  * SECURITY UPDATE: denial of service and possible code execution via
    heap overflow in floating point parsing.
    - debian/patches/CVE-2013-4164.patch: check lengths in util.c, added
      test to test/ruby/test_float.rb.
    - CVE-2013-4164

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 25 Nov 2013 15:12:24 -0500

ruby1.9.1 (1.9.3.448-1ubuntu1) trusty; urgency=low

  * Merge from Debian. Remaining changes:
    - debian/control: Add ca-certificates to libruby1.9.1 depends so that
      rubygems can perform certificate verification
    - debian/rules: Don't install SSL certificates from upstream sources
    - debian/patches/20120927-rubygems_disable_upstream_certs.patch: Use
      /etc/ssl/certs/ca-certificates.crt for the trusted CA certificates.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 25 Nov 2013 09:59:41 -0500

ruby1.9.1 (1.9.3.448-1) unstable; urgency=low

  * New upstream release
    + Includes fix for potential thread deadlock after fork()
      Closes: #698208
    + Includes fix for test error originally introduced by patch for
      CVE-2012-4522
      Closes: #701142
    + Includes fix for CVE-2012-4466 and CVE-2012-4464
      Closes: #701144
    + Includes fix for incorrect setting of FD_CLOEXEC with F_SETFL instead of
      F_SETFD
      Closes: #696281
    + debian/patches/2013-09-08-restore-rb_f_lambda-declaration.patch:
      backport upstream patch to reintroduce the declaration of rb_f_lamdba
      for backwards compatibility.
    + Dropped patches already applied upstream; refreshed all others.
  * Review of remaining patches in debian/patches/series:
    + 909_update_lib_README.diff: obsolete and ultimately wrong. Removed
    + 903_skip_base_ruby_check.diff: can't see a reason why this would be
      needed. Removed.
  * move logic to skip DRB tests inside debian/run-test-suites.bash
  * Acknowledge security-related NMU's by Salvatore Bonaccorso.
    + Both CVE-2013-1821.patch and CVE-2013-4073.patch already applied in this
      upstream version, not included anymore
  * debian/rules: acknowledge reality, put myself as maintainer.
  * debian/rules: dropped --with-baseruby=/usr/bin/ruby1.8. This way the build
    will just use `ruby` for bootstrapping. Also, build-depend on ruby |
    ruby-interpreter instead of ruby1.8; this way ruby1.9.1 can be
    bootstrapped with any Ruby interpreter, and we can leave ruby1.8 Rest In
    Peace.
  * debian/rules: applied patch from Timothy Pearson to install pkg-config
    file.
    Closes: #688002
  * debian/libruby1.9.1.symbols: removed debian revision from version numbers
    for symbols introduced in 1.9.3.194
  * debian/control: bump Standards-Version to 3.9.4. No changes needed.
  * debian/control: remove -1 from build dependency on coreutils

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 08 Sep 2013 22:57:14 -0300

ruby1.9.1 (1.9.3.194-8.2) unstable; urgency=high

  * Non-maintainer upload.
  * Add CVE-2013-4073.patch patch.
    CVE-2013-4073: Fix hostname check bypassing vulnerability in SSL client.
    (Closes: #714543)

 -- Salvatore Bonaccorso <carnil@debian.org>  Sun, 07 Jul 2013 10:37:03 +0200

ruby1.9.1 (1.9.3.194-8.1ubuntu2) saucy; urgency=low

  * SECURITY UPDATE: incorrect ssl hostname verification
    - debian/patches/CVE-2013-4073.patch: fix hostname check and regression
      in ext/openssl/lib/openssl/ssl-internal.rb, added test to
      test/openssl/test_ssl.rb.
    - CVE-2013-4073

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 08 Jul 2013 13:00:47 -0400

# For older changelog entries, run 'apt-get changelog ruby1.9.3'
