shibboleth-sp (3.5.2+dfsg-1) unstable; urgency=medium

  * [02dd0fe] New upstream release: 3.5.2
  * [5663da2] Refresh our patches
  * [8f3c923] Update Standards-Version to 4.7.3 (no changes required)
  * [d81379f] Update copyright years

 -- Ferenc Wágner <wferi@debian.org>  Sun, 01 Feb 2026 22:30:21 +0100

shibboleth-sp (3.5.1+dfsg-1) unstable; urgency=high

  * Urgency set to high for security fix.
  * [d265d78] New upstream release: 3.5.1 (Closes: #1114506, CVE-2025-9943)
    Fix SQL injection vulnerability in Service Provider ODBC plugin:
    specially crafted inputs can exfiltrate information stored in the
    database used by the SP.  The vulnerability is moderate to high
    severity for anyone using the ODBC plugin, and of no impact for others.
  * [059241e] Refresh our patches
  * [5a80567] Update Standards-Version to 4.7.2 (no changes required)
  * [9a8761b] New patch: Disable Doxygen's SHORT_NAMES to gain reproducibility

 -- Ferenc Wágner <wferi@debian.org>  Sat, 06 Sep 2025 13:35:57 +0200

shibboleth-sp (3.5.0+dfsg-2) unstable; urgency=medium

  * Upload to unstable

 -- Ferenc Wágner <wferi@debian.org>  Sun, 12 Jan 2025 13:52:44 +0100

shibboleth-sp (3.5.0+dfsg-1) experimental; urgency=medium

  * [cfa853e] New upstream release: 3.5.0
  * [0f70cd8] Drop upstreamed patch
  * [b7eb952] Adjust library package name to the new SO version
  * [6cdd380] Require XMLTooling 3.3 and OpenSAML 3.3
  * [7508c54] pkgconf superseded pkg-config
  * [66abc38] Update Standards-Version to 4.7.0 (no changes required)
  * [bec7c0b] Update copyright years
  * [a77ab36] Remove Etienne Dysli Metref from Uploaders.
    Thanks for your work, Etienne, and best wishes for your future
    endeavors!

 -- Ferenc Wágner <wferi@debian.org>  Fri, 03 Jan 2025 23:10:59 +0100

shibboleth-sp (3.4.1+dfsg-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1062895

 -- Benjamin Drung <bdrung@debian.org>  Thu, 29 Feb 2024 15:49:16 +0000

shibboleth-sp (3.4.1+dfsg-2) unstable; urgency=medium

  * Upload to unstable

 -- Ferenc Wágner <wferi@debian.org>  Mon, 30 Jan 2023 08:04:53 +0100

shibboleth-sp (3.4.1+dfsg-1) experimental; urgency=medium

  [ Ferenc Wágner ]
  * [119a057] New patch: configure.ac: AC_MSG_ERROR can't be used as value-if-
    not-found
  * [59f87e2] Disable building Apache modules for shibsptest.
    They aren't needed and weren't built beforehand either because the
    Apache development tools aren't installed in the autopkgtest
    environment, but our latest patch fixed the configure script to fail
    in such cases as intended, so we have to be explicit from now on.
  * [8b58b70] Drop the obsolete lsb-base dependency
    sysvinit-utils_3.05-1 took over /lib/lsb/init-functions from lsb-base,
    which became an empty transitional package.  Sysvinit-utils is
    essential now, so we needn't depend on it explicitly, but if that ever
    changes (see #851747) the sysvinit-core package will still depend on
    it, providing the function library to our init script if it has a real
    chance to execute.  (The compatibility layer of systemd won't try to
    use the init script, because we provide a native systemd unit.)
    This change is unsuitable for bullseye backports.
  * [deee373] Update Standards-Version to 4.6.2 (no changes required)
  * [d8c04ea] Adapt Lintian overrides to new message format
  * [f992224] Update copyright of the packaging
  * [4fffee9] The repack number has always been 1, drop it
  * [22c7144] New upstream release: 3.4.1
  * [dc6bbc9] Refresh our patches
  * [c87bb46] Rename library package for upstream SONAME bump (libshibsp11)
  * [5a74ac0] Switch to Debhelper compat level 13.
    Change the name of our file in tmpfiles.d from shibd to
    shibboleth-sp-utils, because dh_installtmpfiles is not as flexible as
    dh_installsystemd was on level 12.
  * [25d661b] libapache2-mod-shib.NEWS was almost five years old, nothing new
  * [f862571] Add Forwarded: not-needed to some Debian-specific patches.
    To those which Lintian misidentifies as DEP3 and thus warns about.
    We use gbp pq, which does not produce DEP3 formatted patch files.
  * [e2173d1] Update upstream copyrights.
    Where the license permits via a special exception, change it to that
    of the main package (Apache-2.0) and collect the additional copyrights
    in the generic paragraph.
  * [37ff7c0] Add debian/upstream/metadata

  [ Debian Janitor ]
  * [0e325fc] Remove constraints unnecessary since buster
    * Build-Depends: Drop versioned constraint on liblog4shib-dev and
      libxml-security-c-dev.
    * Remove 3 maintscript entries from 1 files.
    Changes-By: deb-scrub-obsolete

 -- Ferenc Wágner <wferi@debian.org>  Sat, 21 Jan 2023 20:33:50 +0100

shibboleth-sp (3.3.0+dfsg1-1) unstable; urgency=medium

  * [0ce609d] New upstream release: 3.3.0
  * [57067e0] Drop upstreamed patches, refresh the rest

 -- Ferenc Wágner <wferi@debian.org>  Wed, 01 Dec 2021 21:44:29 +0100

shibboleth-sp (3.2.3+dfsg1-1) unstable; urgency=medium

  [ Ferenc Wágner ]
  * [147bb17] Remove stale comment from debian/copyright
    shibsp/paths.h has not been distributed since version 3.0.3.
  * [9488c47] Set field Upstream-Name in debian/copyright
  * [bbdedb6] New upstream release: 3.2.3
  * [15ea78b] Refresh our patches
  * [68f4827] Accommodate more context in the Lintian webapp warning
  * [9b29d1e] Update Standards-Version to 4.6.0 (no changes required)

  [ Debian Janitor ]
  * [b452f06] Use secure URI in Homepage field

 -- Ferenc Wágner <wferi@debian.org>  Sat, 02 Oct 2021 15:15:41 +0200

shibboleth-sp (3.2.2+dfsg1-1) unstable; urgency=high

  * [e44283d] New upstream release: 3.2.2
    High urgency because it fixes CVE-2021-31826:
    Session recovery feature contains a null pointer dereference
    The cookie-based session recovery feature added in V3.0 contains a
    flaw that is exploitable on systems *not* using the feature if a
    specially crafted cookie is supplied.
    This manifests as a crash in the shibd daemon.
    Because it is very simple to trigger this condition remotely, it
    results in a potential denial of service condition exploitable by
    a remote, unauthenticated attacker.
    Thanks to Scott Cantor (Closes: #987608)
  * [3a6ac33] Refresh our patches

 -- Ferenc Wágner <wferi@debian.org>  Tue, 27 Apr 2021 12:11:06 +0200

shibboleth-sp (3.2.1+dfsg1-1) unstable; urgency=high

  * [4ecfe4a] New upstream release: 3.2.1
    High urgency because it contains the fix for the phishing vulnerability
    https://shibboleth.net/community/advisories/secadv_20210317.txt.
  * [80b3470] Refresh our patches

 -- Ferenc Wágner <wferi@debian.org>  Wed, 17 Mar 2021 14:29:08 +0100

shibboleth-sp (3.2.0+dfsg1-2) unstable; urgency=medium

  * [84158eb] Revert "New patch: Require XMLTooling and OpenSAML 3.2 via pkg
    config as well"
    This reverts commit 431b176b3127bb0b0ebfb9621a798facec24cce3.
    According to upstream there's no real build requirement here.
  * Upload to unstable

 -- Ferenc Wágner <wferi@debian.org>  Wed, 06 Jan 2021 14:18:54 +0100

shibboleth-sp (3.2.0+dfsg1-1) experimental; urgency=medium

  * [6af8bd7] Bump watch file format version to 4
  * [ce7b33d] New upstream release: 3.2.0
  * [4a6d968] Delete upstream patch, refresh the rest
  * [431b176] New patch: Require XMLTooling and OpenSAML 3.2 via pkg config as
    well
  * [20a1f52] Depend on XMLTooling and OpenSAML 3.2
  * [3d4409a] Rename library package for upstream SONAME bump
  * [54cf316] Update Standards-Version to 4.5.1 (no changes required)

 -- Ferenc Wágner <wferi@debian.org>  Sun, 27 Dec 2020 22:13:32 +0100

shibboleth-sp (3.1.0+dfsg1-2) unstable; urgency=medium

  * [682128d] The transition to versionless package names is complete
  * [57c5b12] Enable unit tests
  * [e541bfc] New patch: Prefer the plain cxxtestgen program
  * [b1a7fbc] New patch: Turn shibsptest into an Automake test suite
  * [5ea553f] Autopkgtest for libshibsp
  * Upload to unstable

 -- Ferenc Wágner <wferi@debian.org>  Thu, 25 Jun 2020 22:28:20 +0200

shibboleth-sp (3.1.0+dfsg1-1) experimental; urgency=medium

  * [d507efb] Don't single out the amd64 architecture in the Lintian overrides
  * [1b21b7c] Fix POSIX incompatibility in maintainer script.
    Thanks to Ralf Treinen (Closes: #925006)
  * [badab37] New upstream release: 3.1.0
  * [5028ea6] Refresh our patches
  * [f96bc1f] New patch: Forgot to update xmltooling/opensaml check.
    Thanks to Scott Cantor
  * [4c2796c] Require XMLTooling and OpenSAML 3.1
  * [0d9d822] Rename library package for upstream SONAME bump
  * [2592aaf] Enroll to basic Salsa CI
  * [7955518] Upgrade Standards-Version to 4.5.0 (no changes required)
  * [5a0e440] Declare Debhelper compat level 12 the modern way
  * [27a7727] Enable rootless build
  * [dafcf4e] Strip extra signatures from the upstream tarball signing key
  * [d28a397] Update packaging list email address
  * [08a4f6d] NO_START functionality belongs to the init system

 -- Ferenc Wágner <wferi@debian.org>  Wed, 29 Apr 2020 16:37:32 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libshibsp12`.
