sssd (2.10.1-2ubuntu5.3) questing; urgency=medium

  * Fix two memory leaks in sssd-kcm. (LP: #2150664)
    - d/p/lp2150664-1-KCM-fix-memory-leak.patch: free hanging `secret_val.data`
    - d/p/lp2150664-2-KCM-another-memory-leak-fixed.patch: ensure tmp_ctx is freed on
      all control paths.

 -- Jacob Hanks <jacob.hanks@canonical.com>  Wed, 27 May 2026 11:58:56 -0400

sssd (2.10.1-2ubuntu5.2) questing-security; urgency=medium

  * SECURITY UPDATE: PAM passkey responder denial of service
    - debian/patches/CVE-2026-6245.patch: pam: fix out-of-bounds read in
      pam_passkey_child_read_data in src/responder/pam/pamsrv_passkey.c.
    - CVE-2026-6245

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 23 May 2026 14:25:26 -0400

sssd (2.10.1-2ubuntu5.1) questing; urgency=medium

  * Continue searching other PKCS#11 tokens if certificates are not found
    (LP: #2110521)
    - d/p/lp2110521-1-P11_CHILD-Extract-slot-processing-into-separate-func.patch
    - d/p/lp2110521-2-P11_CHILD-Make-p11_child-iterate-over-all-slots.patch 

 -- Jorge Merlino <jorge.merlino@canonical.com>  Sat, 06 Dec 2025 18:58:49 -0300

sssd (2.10.1-2ubuntu5) questing; urgency=medium

  * d/apparmor-profile: update apparmor profile for smartcard authentication
    (LP: #2109673)

 -- Seyeong Kim <seyeong.kim@canonical.com>  Tue, 24 Jun 2025 00:06:47 +0000

sssd (2.10.1-2ubuntu4) plucky; urgency=medium

  * Another no-change rebuild with samba 4.21.4: the previous riscv64 build of
    sssd still picked up libndr4 instead of libndr5 from new samba
    (LP: #2104009)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 24 Mar 2025 09:38:10 -0300

sssd (2.10.1-2ubuntu3) plucky; urgency=medium

  * No-change rebuild with new samba 4.21.4

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 20 Feb 2025 14:49:03 -0300

sssd (2.10.1-2ubuntu2) plucky; urgency=medium

  * Reintroduce faketime on armhf, it might be fixed now
    (LP: #2059078)

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Thu, 23 Jan 2025 14:16:44 +0100

sssd (2.10.1-2ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2094862). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
    - d/control: faketime is used for tests, and is currently not
      working on armhf with a 64bit time_t (see LP #2059078)
  * Drop changes:
    - Don't build-depend on valgrind, not available on riscv64.
      [ Not needed anymore. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 14 Jan 2025 16:44:56 -0500

sssd (2.10.1-2) unstable; urgency=medium

  [ Timo Aaltonen ]
  * control: Drop valgrind from build-depends again.
  * drop-valgrind.diff: Drop a check for if a test is running on
    valgrind, avoids the build-dep and ftbfs on where valgrind is not
    available.
  * control: Add systemd to build-depends since build-tests require
    systemctl.
  * tests: Use a 2048bit private key. (Closes: #1092722)

  [ Michal Maloszewski  ]
  * d/apparmor-profile: Update profile to silence extraneous ALLOWED
    messages.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Jan 2025 08:45:10 +0200

sssd (2.10.1-1ubuntu2) plucky; urgency=medium

  * Don't build-depend on valgrind, not available on riscv64.

 -- Matthias Klose <doko@p1>  Tue, 14 Jan 2025 06:22:11 +0100

sssd (2.10.1-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085296). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
    - d/apparmor-profile: Add some entries to apparmor-profile file
      to get rid of the extraneous ALLOWED messages visible in the
      /var/log/syslog. (LP #1999190)
    - d/control: faketime is used for tests, and is currently not
      working on armhf with a 64bit time_t (see LP #2059078)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Thu, 09 Jan 2025 13:37:39 -0500

sssd (2.10.1-1) unstable; urgency=medium

  [ Timo Aaltonen ]
  * New upstream release.
  * watch: Updated.
  * patches: Refreshed.
  * control: Add valgrind and libcap-dev to build-depends.
  * install: Updated.

  [ Andreas Hasenack ]
  * autopkgtests: also gather sssd logs in case of failure
  * postinst: add filesystem capabilities to several helpers
  * control: add libcap2-bin dependency
  * rules: don't change permissions of proxy_child and sssd_pam

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 08 Jan 2025 12:34:49 +0200

sssd (2.9.5-5) unstable; urgency=medium

  * Team upload.

  [ Andreas Hasenack ]
  * autopkgtests: switch to ssh for the login test (Closes: #1081027)
  * autopkgtests: display logs in the case of a failure

 -- Simon Josefsson <simon@josefsson.org>  Fri, 20 Dec 2024 16:15:34 +0100

sssd (2.9.5-4) unstable; urgency=medium

  * Team upload.

  [ Michael Prokop ]
  * autopkgtests: increase expect timeout to address flaky ldap-user-group-ldap-auth under control
    (Closes: #1081027)

 -- Simon Josefsson <simon@josefsson.org>  Tue, 26 Nov 2024 11:06:09 +0100

sssd (2.9.5-3ubuntu3) plucky; urgency=medium

  * No-change rebuild for Python 3.13 as the default.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 04 Jan 2025 06:05:28 +0100

sssd (2.9.5-3ubuntu2) oracular; urgency=medium

  * No-change rebuild with new samba-libs, to pick up libndr4

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 03 Jul 2024 20:53:11 -0300

sssd (2.9.5-3ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064469). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
    - d/apparmor-profile: Add some entries to apparmor-profile file
      to get rid of the extraneous ALLOWED messages visible in the
      /var/log/syslog. (LP #1999190)
    - d/control: faketime is used for tests, and is currently not
      working on armhf with a 64bit time_t (see LP #2059078)
  * Drop changes:
    - Fix build-time tests (LP #2058576):
      + d/p/fix-format-string-time64.patch: fix format string used for a
        timestamp filter string. Thanks to Sergio Durigan Junior
        <sergio.durigan@canonical.com> for the troubleshooting session.
      [ Incorporated upstream. ]
    - SECURITY UPDATE: race when GPO policy is being applied
      + debian/patches/CVE-2023-3758.patch: use hash to store intermediate
        results in src/providers/ad/ad_gpo.c.
      + CVE-2023-3758
      [ Incorporated upstream. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 24 Jun 2024 16:22:21 -0400

sssd (2.9.5-3) unstable; urgency=medium

  * rules: Flip the test logic to fix ftbfs on armel/armhf.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 04 Jun 2024 18:22:29 +0300

sssd (2.9.5-2) unstable; urgency=medium

  * rules: Don't fail tests on armel, armhf for now.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 04 Jun 2024 15:00:53 +0300

sssd (2.9.5-1) unstable; urgency=medium

  * New upstream release. (Closes: #1068063)
    - CVE-2023-3758 (Closes: #1070369)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 20 May 2024 16:36:50 +0300

sssd (2.9.4-2) unstable; urgency=medium

  [ Michael Biebl ]
  * Install PAM and NSS modules into /usr. (Closes: #1061350)

  [ Timo Aaltonen ]
  * tests: Drop -extensions from openssl command if there is no -x509.
    Thanks, Sebastian Andrzej Siewior! (Closes: #1061869)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 10 Apr 2024 15:56:46 +0300

sssd (2.9.4-1.1ubuntu7) oracular; urgency=medium

  * SECURITY UPDATE: race when GPO policy is being applied
    - debian/patches/CVE-2023-3758.patch: use hash to store intermediate
      results in src/providers/ad/ad_gpo.c.
    - CVE-2023-3758

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 07 Jun 2024 10:50:41 -0400

sssd (2.9.4-1.1ubuntu6) noble; urgency=medium

  * No-change rebuild for c-ares t64.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 16 Apr 2024 11:55:56 +0200

sssd (2.9.4-1.1ubuntu5) noble; urgency=medium

  * Fix build-time tests (LP: #2058576):
    - d/p/fix-format-string-time64.patch: fix format string used for a
      timestamp filter string. Thanks to Sergio Durigan Junior
      <sergio.durigan@canonical.com> for the troubleshooting session.
    - d/control: faketime is used for tests, and is currently not
      working on armhf with a 64bit time_t (see LP #2059078)

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 05 Apr 2024 10:23:52 -0300

sssd (2.9.4-1.1ubuntu4) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:25:06 +0000

sssd (2.9.4-1.1ubuntu3) noble; urgency=medium

  * No-change rebuild against libcurl4t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 16 Mar 2024 07:03:24 +0000

sssd (2.9.4-1.1ubuntu2) noble; urgency=medium

  * No-change rebuild against libcom-err2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 Mar 2024 20:34:29 +0000

sssd (2.9.4-1.1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
    - d/apparmor-profile: Add some entries to apparmor-profile file
      to get rid of the extraneous ALLOWED messages visible in the
      /var/log/syslog. (LP #1999190)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Fri, 08 Mar 2024 11:22:58 -0500

sssd (2.9.4-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.  Closes: #1063074

 -- Benjamin Drung <bdrung@debian.org>  Thu, 29 Feb 2024 17:27:43 +0000

sssd (2.9.4-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 21:27:15 +0000

sssd (2.9.4-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2055074). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
    - d/apparmor-profile: Add some entries to apparmor-profile file
      to get rid of the extraneous ALLOWED messages visible in the
      /var/log/syslog. (LP #1999190)
  * Drop changes:
    - d/t/control: Remove "needs-sudo" restriction from smartcard tests,
      replace with "needs-root".  This is needed because Ubuntu's
      autopkgtest infrastructure doesn't support "needs-sudo".
    - d/t/sssd-smart-card-pam-auth-configs-tester.sh,
      d/t/sssd-softhism2-certificates-tests.sh: Add code to handle
      ${AUTOPKGTEST_NORMAL_USER}.
      [ Incorporated by Debian. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 26 Feb 2024 14:08:42 -0500

sssd (2.9.4-1) unstable; urgency=medium

  [ Sergio Durigan Junior ]
  * Improve certificate/smartcard dep8 tests.
    - d/t/control: Don't depend on "needs-sudo" restriction, since the
      tests don't really use "sudo" selectively but rather rely on a normal
      user being setup as a side effect of "needs-sudo".  Instead, we can
      use "needs-root".
    - d/t/sssd-smart-card-pam-auth-configs-tester.sh,
      d/t/sssd-softhism2-certificates-tests.sh: Use
      "${AUTOPKGTEST_NORMAL_USER}" instead of "$SUDO_USER".

  [ Timo Aaltonen ]
  * New upstream release.
  * control: Migrate to systemd-dev. (Closes: #1060512)
  * rules, install: Use systemdsystemunitdir.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 18 Jan 2024 12:04:33 +0200

sssd (2.9.2-1ubuntu2) noble; urgency=medium

  * No-change rebuild with Python 3.12 as default

 -- Graham Inggs <ginggs@ubuntu.com>  Sun, 21 Jan 2024 07:50:43 +0000

sssd (2.9.2-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040429). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
    - d/apparmor-profile: Add some entries to apparmor-profile file
      to get rid of the extraneous ALLOWED messages visible in the
      /var/log/syslog. (LP #1999190)
  * Add changes:
    - d/t/control: Remove "needs-sudo" restriction from smartcard tests,
      replace with "needs-root".  This is needed because Ubuntu's
      autopkgtest infrastructure doesn't support "needs-sudo".
    - d/t/sssd-smart-card-pam-auth-configs-tester.sh,
      d/t/sssd-softhism2-certificates-tests.sh: Add code to handle
      ${AUTOPKGTEST_NORMAL_USER}.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 03 Jan 2024 11:20:10 -0500

sssd (2.9.2-1) unstable; urgency=medium

  [ Timo Aaltonen ]
  * New upstream release.
  * control, rules: Add bc to build-depends, enable tests again.

  [ Marco Trevisan (Treviño) ]
  * debian: Add pam-auth-update SSSD Smart card configurations
  * debian/tests: Add tests for smart card verification

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 15 Sep 2023 11:18:38 +0300

sssd (2.9.1-2ubuntu3) noble; urgency=medium

  * Rebuild against latest libunistring

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 27 Oct 2023 11:05:49 -0400

sssd (2.9.1-2ubuntu2) mantic; urgency=medium

  * d/apparmor-profile: Add some entries to apparmor-profile file
    to get rid of the extraneous ALLOWED messages visible in the
    /var/log/syslog. (LP: #1999190)

 -- Michal Maloszewski <michal.maloszewski@canonical.com>  Wed, 04 Oct 2023 16:58:26 +0200

sssd (2.9.1-2ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2028722). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 26 Jul 2023 16:04:29 -0400

sssd (2.9.1-2) unstable; urgency=medium

  [ Sergio Durigan Junior ]
  * Enable files provider.
    SSSD 2.9.0 has deprecated "id_provider = files", but that's still
    needed for smartcard authentication of local users.
    - d/rules: Build with "--with-files-provider".
    - d/sssd-common.install: Install libsss_files.so and sssd-files.5.
    (Closes: #1041438) (LP: #2028084)
  * d/rules: Remove deprecated options "--disable-files-domain".

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 25 Jul 2023 15:01:14 +0300

sssd (2.9.1-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018112). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
  * Drop change:
    - d/rules: Fix 'find' syntax to remove '*.egg-info'
      files/directories.
      [ Incorporated by Debian. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 11 Jul 2023 14:48:14 -0400

sssd (2.9.1-1) unstable; urgency=medium

  * New upstream release.
  * libnss-sss.postinst: Migrate to use 'case' like the other postinsts.
  * patches: Drop an upstreamed patch.
  * Drop deprecated simple-ifp library and files provider.
  * control, rules: Add sssd-passkey, and libfido2-dev to build-depends.
  * ci: Allow piuparts to fail, because handling of nsswitch.conf ownership
    is broken.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 04 Jul 2023 08:48:49 +0300

sssd (2.8.2-4) unstable; urgency=medium

  [ Sam Morris ]
  * Don't add subid to /etc/nsswitch.conf (Closes: #1032990)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 11 Apr 2023 15:19:36 +0300

sssd (2.8.2-3) unstable; urgency=medium

  [ Gioele Barabucci ]
  * d/libnss-sss.nss: Update to `database-add`
  * d/libsss-sudo.nss: Install `sss` service for sudoers via dh-nss (Closes: #783889)
  * d/libsss-sudo.post{inst,rm}: Remove now that the services are installed via dh-nss
  * d/sssd-common.nss: Use new directive name `database-add`
  * Install dbus policy in /usr instead of /etc (Closes: #1031547)

  [ Sam Morris ]
  * sssd-common: add lintian overrides for libsubid_sss.so

 -- Timo Aaltonen <tjaalton@debian.org>  Sun, 26 Feb 2023 16:35:48 +0200

sssd (2.8.2-2) unstable; urgency=medium

  [ Sam Morris ]
  * Ship libsubid_sss.so in sssd-common package

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Feb 2023 17:48:19 +0200

sssd (2.8.2-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Feb 2023 17:40:37 +0200

sssd (2.8.1-2) unstable; urgency=medium

  * d/rules: Fix 'find' syntax to remove '*.egg-info' files/directories.
    (Closes: #1026490)

 -- Sergio Durigan Junior <sergiodj@debian.org>  Tue, 03 Jan 2023 16:36:00 -0500

sssd (2.8.1-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993448). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
  * Drop changes:
    - Revert dh_nss usage; the feature is still being polished.
      + d/control: Don't Build-Depend on dh-sequence-installnss.
      + d/libnss-sss.nss: Remove file.
      + d/libnss-sss.postinst: Revert changes to use dh-nss.
      + d/libnss-sss.postrm: Likewise.
      [ Fixed in Debian. ]
    - d/p/initialize-uid-gid-main-functions.patch: Initialize UID/GID
      variables in "main" functions, preventing inadvertent changes in
      p11_child.log file permissions. (LP #1989356)
      [ Incorporated by upstream. ]
  * Add changes:
    - d/rules: Fix 'find' syntax to remove '*.egg-info'
      files/directories.
      [ Submitted to Debian. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 03 Jan 2023 16:42:10 -0500

sssd (2.8.1-1) unstable; urgency=medium

  * New upstream release.
  * watch: Updated for current github behaviour.
  * support-krb5-1.20.diff: Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 23 Nov 2022 10:10:41 +0200

sssd (2.7.4-1) unstable; urgency=medium

  [ Timo Aaltonen ]
  * New upstream release.
  * control: Add bind9-dnsutils to sssd-common Recommends, and rename
    dnsutils build-dep. (Closes: #1018144)

  [ Sergio Durigan Junior ]
  * Simplify logic to add "automount" database into nsswitch.
    - d/libnss-sss.nss: Add "automount database" directive.
    - d/libnss-sss.postinst: Remove logic to insert "automount" database
      into nsswitch; not necessary anymore now that the package uses dh-nss.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 22 Sep 2022 15:34:06 +0300

sssd (2.7.3-2ubuntu4) lunar; urgency=medium

  * No-change rebuild with Python 3.11 as default

 -- Graham Inggs <ginggs@ubuntu.com>  Tue, 27 Dec 2022 03:42:49 +0000

sssd (2.7.3-2ubuntu3) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 15 Dec 2022 19:56:34 +0000

sssd (2.7.3-2ubuntu2) kinetic; urgency=medium

  * d/p/initialize-uid-gid-main-functions.patch: Initialize UID/GID
    variables in "main" functions, preventing inadvertent changes in
    p11_child.log file permissions. (LP: #1989356)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 04 Oct 2022 19:00:49 -0400

sssd (2.7.3-2ubuntu1) kinetic; urgency=medium
    
  * Merge with Debian unstable (LP: #1987348, #1988615). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
  * Add changes:
    - Revert dh_nss usage; the feature is still being polished.
      + d/control: Don't Build-Depend on dh-sequence-installnss.
      + d/libnss-sss.nss: Remove file.
      + d/libnss-sss.postinst: Revert changes to use dh-nss.
      + d/libnss-sss.postrm: Likewise.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 06 Sep 2022 13:56:06 -0400

sssd (2.7.3-2) unstable; urgency=medium

  [ Timo Aaltonen ]
  * patches: Allow building the pac_responder with krb5 1.20. (Closes:
    #1016220)

  [ Gioele Barabucci ]
  * d/libnss-sss.post{inst,rm}: Add DPKG_ROOT support
  * d/libnss-sss.postinst: Fix use of outdated `automounter` instead of `automount`
  * d/libnss-sss.nss: Install NSS service `sss` via dh_installnss

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Aug 2022 16:46:47 +0300

sssd (2.7.3-1) unstable; urgency=medium

  * New upstream release.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 06 Jul 2022 08:52:58 +0300

sssd (2.7.2-3ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Thu, 23 Jun 2022 14:03:54 -0400

sssd (2.7.2-3) unstable; urgency=medium

  * d/p/fix-shebang-on-sss_analyze.patch: Fix shebang on sss_analyze.

 -- Sergio Durigan Junior <sergiodj@debian.org>  Wed, 22 Jun 2022 11:00:11 -0400

sssd (2.7.2-2) unstable; urgency=medium

  * rules, install: Fix python install directory. (LP: #1979453)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 22 Jun 2022 16:54:42 +0300

sssd (2.7.2-1) unstable; urgency=medium

  * New upstream release.
  * pac-relax-default-for-pac_check-option.diff: Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 22 Jun 2022 13:19:27 +0300

sssd (2.7.1-2ubuntu1) kinetic; urgency=medium

  * Merge with Debian unstable (LP: #1971327, #1934997). Remaining changes:
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
  * Dropped changes:
    - d/rules: Disable lto, not ready upstream.
    [ Incorporated by Debian ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 14 Jun 2022 16:59:20 -0400

sssd (2.7.1-2) unstable; urgency=medium

  * pac-relax-default-for-pac_check-option.diff: Drop pac_present from
    default PAC check. (Closes: #1012502)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 09 Jun 2022 10:19:37 +0300

sssd (2.7.1-1) unstable; urgency=medium

  * New upstream release.
  * control: Drop sssd-ipd from sssd-ipa depends.
  * sssd-common.install: Add a new manpage.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 06 Jun 2022 16:32:34 +0300

sssd (2.7.0-1) unstable; urgency=medium

  * New upstream release.
  * Update signing-key.asc.
  * source: Update diff-ignores.
  * control, rules: Add sssd-idp package, which includes plugins for
    external identity providers.
  * control, rules: Enable krb5 config snippets by default.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 25 May 2022 12:59:05 +0300

sssd (2.6.3-3) unstable; urgency=medium

  * tests: Dump the daemon status after restart, hoping to see what the
    error is if it fails to start.
  * rules: Drop --with-ldb-dir, use the default value from the pkgconfig
    file. (Closes: #1009223)

 -- Timo Aaltonen <tjaalton@debian.org>  Sun, 10 Apr 2022 10:57:30 +0300

sssd (2.6.3-2) unstable; urgency=medium

  * rules: Disable lto.
  * Rebuild against current python-defaults. (Closes: #1008583)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 29 Mar 2022 10:04:50 +0300

sssd (2.6.3-1ubuntu3) jammy; urgency=medium

  * No-change rebuild with new samba 4.15.5

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 24 Feb 2022 08:55:08 -0300

sssd (2.6.3-1ubuntu2) jammy; urgency=medium

  * No-change rebuild with new libnfsidmap from src:nfs-utils

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 17 Feb 2022 10:57:41 -0300

sssd (2.6.3-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1946904). Remaining changes:
    - d/rules: Disable lto, not ready upstream.
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
  * Dropped changes, picked by Debian:
    - Remove RANDFILE from the config template. It's no longer necessary and
      breaks with openssl 3.0.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 14 Feb 2022 16:21:21 -0500

sssd (2.6.3-1) unstable; urgency=medium

  * New upstream release.
  * control: Migrate to PCRE2. (Closes: #999951)
  * Update signing-key.asc.
  * control: Drop python3-click from sssd-tools depends.
  * sssd-tools.install: Updated.
  * tests: Drop RANDFILE from tests/util. (Closes: #1001476)

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 11 Feb 2022 09:35:43 +0200

sssd (2.6.1-1ubuntu4) jammy; urgency=medium

  * No-change rebuild with Python 3.10 as default version

 -- Graham Inggs <ginggs@ubuntu.com>  Sun, 16 Jan 2022 15:13:06 +0000

sssd (2.6.1-1ubuntu3) jammy; urgency=medium

  * Remember how architecture lists in debian/control work.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 17 Dec 2021 23:12:51 +0000

sssd (2.6.1-1ubuntu2) jammy; urgency=medium

  * Don't build sssd-tools on i386, now uninstallable due to added
    python3-{click,systemd} dependencies.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 17 Dec 2021 21:50:00 +0000

sssd (2.6.1-1ubuntu1) jammy; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Disable lto, not ready upstream.
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - Remove RANDFILE from the config template. It's no longer necessary and
      breaks with openssl 3.0.
  * Dropped changes, included upstream:
    - d/p/fix-python-tests.patch: Fix Python tests by making them
      assert Python module paths by using full pathnames.
  * Dropped changes, included in Debian:
    - debian/control: Switch to libsemanage-dev from libsemanage1-dev

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 10 Dec 2021 10:29:16 -0800

sssd (2.6.1-1) unstable; urgency=medium

  * New upstream release.
  * patches: Dropped upstream patches.
  * control: Add libunistring-dev to build-depends.
  * sssd-common.install: Drop libsss_secrets, removed upstream.
  * tools: Add sss_analyze.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 17 Nov 2021 20:33:29 +0200

sssd (2.5.2-5) unstable; urgency=medium

  * control: Fix libsemanage-dev build-dep. (Closes: #998634)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 08 Nov 2021 21:17:29 +0200

sssd (2.5.2-4ubuntu4) jammy; urgency=medium

  * No-change rebuild against libssl3

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 09 Dec 2021 00:19:23 +0000

sssd (2.5.2-4ubuntu3) jammy; urgency=medium

  * Remove RANDFILE from the config template. It's no longer necessary and
    breaks with openssl 3.0.

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Tue, 23 Nov 2021 20:19:07 +0100

sssd (2.5.2-4ubuntu2) jammy; urgency=medium

  * debian/control: Switch to libsemanage-dev from libsemanage1-dev

 -- Rico Tzschichholz <ricotz@ubuntu.com>  Mon, 22 Nov 2021 20:51:36 +0100

sssd (2.5.2-4ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1946904). Remaining changes:
    - Disable lto, not ready upstream.
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/p/fix-python-tests.patch: Fix Python tests by making them
      assert Python module paths by using full pathnames.
  * Dropped changes:
    - d/apparmor-profile: Update profile. (LP #1910611)
      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
      + Add read/execute permission to /usr/libexec/sssd/*.
      [ Incorporated by Debian.  ]
    - Fix FTBFS with newer autoconf
      + debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
        and PYTHON_EXEC_PREFIX in src/external/python.m4.
      [ Incorporated by Debian. ]
    - SECURITY UPDATE: shell command injection in sssctl comment
      + debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
        avoid execution of user supplied command in
        src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
        src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
      + CVE-2021-3621
      [ Incorporated by Debian. ]
    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
      which is failing when running inside sbuild.
      [ Not needed anymore; issue does not reproduce on Jammy. ]

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 27 Oct 2021 20:16:31 -0400

sssd (2.5.2-4) unstable; urgency=medium

  * control: Promote libnss-sss and libpam-sss to sssd-common Depends.
    (Closes: #995730)
  * common: Drop old Breaks/Replaces.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 11 Oct 2021 17:46:04 +0300

sssd (2.5.2-3) unstable; urgency=medium

  * rules: Explicitly set sssd-user as root.
  * install: Add sssd-pcsc.rules to -common.
  * postinst: Correct file/dir permissions and ownership when the daemon
    is run as root. (Closes: #994807)
  * 0001-ad-fallback-to-ldap-if-cldap-is-not-available-in-lib.patch: Our
    libldap is built without LDAP_CONNECTIONLESS, cope with that.
    (Closes: #994879)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 22 Sep 2021 18:54:07 +0300

sssd (2.5.2-2) unstable; urgency=medium

  * rules: Disable tests for now. (Closes: #994479)

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 20 Sep 2021 17:38:19 +0300

sssd (2.5.2-1) unstable; urgency=medium

  [ Sergio Durigan Junior ]
  * d/apparmor-profile: Update profile:
    - Extend read permissions to /etc/sssd/conf.d/* and /etc/gss/mech.d/*.
    - Add read/execute permission to /usr/libexec/sssd/*.

  [ Timo Aaltonen ]
  * New upstream release. (Closes: #978904, #992815, #983795)
  * fix-whitespace-test.diff: Refreshed.
  * control, rules: Drop libwbclient-sssd-*, support for it was dropped upstream.
  * fix_newer_autoconf.patch: Don't unset python prefix/exec-prefix.
  * patches: Fix CVE-2021-3621. (Closes: #992710)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 16 Sep 2021 14:51:42 +0300

sssd (2.4.1-2ubuntu4) impish; urgency=medium

  * Fix FTBFS with newer autoconf
    - debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
      and PYTHON_EXEC_PREFIX in src/external/python.m4.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 08 Sep 2021 11:39:53 -0400

sssd (2.4.1-2ubuntu3) impish; urgency=medium

  * SECURITY UPDATE: shell command injection in sssctl comment
    - debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
      avoid execution of user supplied command in
      src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
      src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
    - CVE-2021-3621

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 18 Aug 2021 08:13:38 -0400

sssd (2.4.1-2ubuntu2) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 18:09:16 -0400

sssd (2.4.1-2ubuntu1) impish; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - d/apparmor-profile: Update profile. (LP #1910611)
      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
      + Add read/execute permission to /usr/libexec/sssd/*.
    - Disable lto, not ready upstream.
    - d/control: Drop libgdm-dev Build-Depend on i386.
  * Dropped changes:
    - d/p/condition-path-exists-sssd-conf.patch: Only start
      sssd.service if there is a configuration file present.
      (LP: #1900642)
      [ Included in 2.4.1-2 ]
    - d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
      Upstream patch to make sssd.service only able to start when there
      is a configuration file present.  (LP #1900642)
    - d/p/condition-path-exists-sssd-conf.patch: Remove.
      [ Included in 2.4.1-2 ]
    - Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP #1908065):
      + d/p/lp-1908065-01-syslog_identifier-format.patch:
        Upstream patch to include "sssd[]" identifier in program names.
      + d/p/lp-1908065-02-remove-syslog_identifier.patch:
        Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
      [ Included in 2.4.1-2 ]
  * Added changes:
    - d/p/fix-python-tests.patch: Fix Python tests by making them
      assert Python module paths by using full pathnames.
    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
      which is failing when running inside sbuild.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 18 May 2021 17:29:58 -0400

sssd (2.4.1-2) unstable; urgency=medium

  [ Marco Trevisan (Treviño) ]
  * debian/control: Mark test packages as <!nocheck>
    - Add missing test dependencies
    - Enable libcmocka (and so unit tests) all the archs
  * debian/rules:
    - Don't run tests if nocheck is set
    - Enable tests again
  * debian/patches:
    - Get libsofthsm2 from right path for each architecture

  [ Timo Aaltonen ]
  * test_ca-Look-for-libsofthsm2-in-libdir-before-falling-bac.patch:
    Dropped, upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 10 Feb 2021 13:49:04 +0200

sssd (2.4.1-1) unstable; urgency=medium

  * New upstream release.
  * libpam-sss.install: Add pam_sss_gss.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 10 Feb 2021 11:32:35 +0200

sssd (2.4.0-1ubuntu7) impish; urgency=medium

  * d/control: Drop libgdm-dev Build-Depend on i386.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 11 May 2021 16:22:31 -0400

sssd (2.4.0-1ubuntu6) hirsute; urgency=medium

  * Disable lto, not ready upstream.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 23 Mar 2021 13:18:53 +0100

sssd (2.4.0-1ubuntu5) hirsute; urgency=medium

  * No change rebuild with fixed ownership.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 16 Feb 2021 15:22:14 +0000

sssd (2.4.0-1ubuntu4) hirsute; urgency=medium

  * Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP: #1908065):
    - d/p/lp-1908065-01-syslog_identifier-format.patch:
      Upstream patch to include "sssd[]" identifier in program names.
    - d/p/lp-1908065-02-remove-syslog_identifier.patch:
      Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.

 -- Valters Jansons <valter.jansons@gmail.com>  Fri, 05 Feb 2021 20:51:32 +0000

sssd (2.4.0-1ubuntu3) hirsute; urgency=medium

  * d/apparmor-profile: Update profile. (LP: #1910611)
    - Extend read permissions to /etc/sssd/conf.d/* and /etc/gss/mech.d/*.
    - Add read/execute permission to /usr/libexec/sssd/*.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 18 Jan 2021 16:57:21 -0500

sssd (2.4.0-1ubuntu2) hirsute; urgency=medium

  * d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
    Upstream patch to make sssd.service only able to start when there
    is a configuration file present.  (LP: #1900642)
  * d/p/condition-path-exists-sssd-conf.patch: Remove.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 12 Jan 2021 16:17:38 -0500

sssd (2.4.0-1ubuntu1) hirsute; urgency=medium

  * d/p/condition-path-exists-sssd-conf.patch: Only start
    sssd.service if there is a configuration file present.
    (LP: #1900642)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Thu, 10 Dec 2020 14:20:24 -0500

sssd (2.4.0-1) unstable; urgency=medium

  * New upstream release.
  * source: Update diff-ignore.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 08 Dec 2020 22:36:54 +0200

sssd (2.3.1-3) unstable; urgency=medium

  * control: Move libsss-sudo to sssd-common Suggests. (LP: #1249777)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 06 Oct 2020 15:56:19 +0300

sssd (2.3.1-2) unstable; urgency=medium

  * control: Add sssd-dbus to sssd-tools Recommends. (LP: #1895645)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 17 Sep 2020 14:15:03 +0300

sssd (2.3.1-1) unstable; urgency=medium

  * New upstream release. (Closes: #965307, #965143)
  * source: Extend diff-ignore.
  * rules: Set --with-libwbclient.
  * control: Add libsofthsm2 to build-depends for tests.

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 28 Jul 2020 17:14:55 +0300

sssd (2.3.0-2) unstable; urgency=medium

  * rules: Drop quilt, autoreconf from dh.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 13 Jul 2020 15:49:20 +0300

sssd (2.3.0-1) unstable; urgency=medium

  * New upstream release. (Closes: #964701, #964240)
  * source: Migrate to 3.0 (quilt).
  * source/local-options: Add files not found on upstream tarball to
    extend-diff-ignore.
  * rules: Use journald for logging. (Closes: #960673)
  * rules: Use /run for pid-path.
  * sssd-common.sssd.default: Add DEBUG_LOGGER but commented out.
  * watch: Update url to github.
  * Add signing-key from Pavel Březina.
  * fix-946847.diff, fix-python3.8-ftbfs.diff: Dropped, upstream.
  * control: Use debhelper-compat.
  * control, rules: Build with openssl.
  * rules: Disable tests until a failing pam upn test is sorted out.
  * control: Drop quilt from build-depends.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 13 Jul 2020 11:35:33 +0300

sssd (2.2.3-3) unstable; urgency=medium

  * libnss-sss: Fix a typo in adding the NSS entry for automount.
    (LP: #1873752)
  * control, watch: Update upstream url to github.

 -- Timo Aaltonen <tjaalton@debian.org>  Mon, 20 Apr 2020 17:52:18 +0300

sssd (2.2.3-2) unstable; urgency=medium

  * libnss-sss: Add an entry for automounter to nsswitch.conf. This is
    needed by ipa-client-automount.
  * Added gitlab-ci.yml.
  * fix-python3.8-ftbfs.diff: Fix build against python3.8.

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 06 Mar 2020 21:58:28 +0200

sssd (2.2.3-1.1) unstable; urgency=medium

  * Non-maintainer upload with maintainer permission.
  * Fix sssd_be busy-looping when LDAP connection flickers.
    (Closes: #946847)

 -- Thorsten Glaser <tg@mirbsd.de>  Fri, 21 Feb 2020 14:04:25 +0100

sssd (2.2.3-1) unstable; urgency=medium

  * New upstream release.
  * default-to-socket-activated-services.diff: Refreshed.
  * sssd-ldap.install: Updated.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 20 Feb 2020 13:06:35 +0200

sssd (2.2.2-1) unstable; urgency=medium

  * New upstream release.
  * default-to-socket-activated-services.diff: Don't enable any
    services when run without a conffile.
  * fix-have-systemd.diff: Dropped, upstream.
  * default-to-socket-activated-services.diff: Refreshed.
  * signing-key: Add key from Michal Židek.
  * Get rid of all old pre/postinst file removal fluff, since that's all
    obsolete by now.
  * Drop python2 support. (Closes: #938566)

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 18 Sep 2019 15:27:44 +0300

sssd (2.2.0-4) unstable; urgency=medium

  [ Sam Morris ]
  * fix-have-systemd.patch: correct detection of systemd.pc
    (Closes: #932080)
  * default-to-socket-activated-services.diff: rely on socket activation
    to spawn nss and pam responders

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 19 Jul 2019 18:15:41 +0300

sssd (2.2.0-3) unstable; urgency=medium

  * common/ipa/krb5-common/proxy.postinst: Use libexec path. (Closes:
    #931859)

 -- Timo Aaltonen <tjaalton@debian.org>  Fri, 12 Jul 2019 10:01:06 +0300

sssd (2.2.0-2) unstable; urgency=medium

  * rules: Override dh_installman, let dh_install handle installing
    manpages too.

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 11 Jul 2019 00:53:36 +0300

sssd (2.2.0-1) unstable; urgency=medium

  * New upstream release.
  * control: Bump policy to 4.4.0.
  * control, compat, rules: Bump debhelper to 12.
  * *.install: Updated, some files moved to /usr/libexec.

 -- Timo Aaltonen <tjaalton@debian.org>  Wed, 10 Jul 2019 10:14:09 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libsss-sudo`.
