isc-kea (2.6.3-1) unstable; urgency=medium

  * New upstream version 2.6.3.
    Closes: #1106737 by fixing:
    - CVE-2025-32801:
      Loading a malicious hook library can lead to local privilege escalation
    - CVE-2025-32802:
      Insecure handling of file paths allows multiple local attacks
    - CVE-2025-32803:
      Insecure file permissions can result in confidential information leakage
    Thanks: Salvatore Bonaccorso
  * d/*.service: restrict RuntimeDirectory and StateDirectory.
    This is part of the fix of the aforementioned CVEs.
  * d/kea-common.postinst: make /etc/kea owned by _kea:_kea and chmod 0750
  * d/p/0009-disable-database-tests.patch: refresh (context)
  * d/p/0010-set-control-sockets-location.patch drop patch (upstreamed)
  * d/p/0011-kea-ctrl-agent-authentication.patch: drop patch (upstreamed)
  * d/t/smoke-test: execute some test commands as the _kea user.

 -- Paride Legovini <paride@debian.org>  Mon, 02 Jun 2025 19:00:06 +0200

isc-kea (2.6.1-2) unstable; urgency=medium

  [ Gioele Barabucci ]
  * d/control: Remove outdated debconf version constraint (Closes: #1096119)

  [ Paride Legovini ]
  * d/po/pt.po: add Portuguese debconf translation.
    Thanks to Américo Monteiro (Closes: #1065408)
  * d/po/pt_BR.po: add Brazilian Portuguese debconf translation.
    Thanks to Paulo Henrique de Lima Santana (Closes: #1098449)
  * d/po/ro.po: add Romanian debconf translation.
    Thanks to Remus-Gabriel Chelu (Closes: #1101800)

 -- Paride Legovini <paride@debian.org>  Wed, 02 Apr 2025 09:44:44 +0200

isc-kea (2.6.1-1) unstable; urgency=medium

  [ Paride Legovini ]
  * d/control: drop useless Build-Depends: elinks.
  * CI: Add Salsa CI pipeline for Ubuntu.
    Thanks to Ahmed Siam, Otto Kekäläinen

  [ Helmut Grohne ]
  * d/control, d/rules: reduce Build-Depends
    - Drop unused docbook, docbook-xsl, elinks, xsltproc.
    - Annotate procps <!nocheck>.
    - Reduce python3-dev to python3 as no extension is being built.
    - Annotate python3 with :any to support cross building.
    - Declaratively enable python3 sequence addon. (Closes: #1080444)

  [ Carles Pina i Estany ]
  * Added po-debconf Catalan translation

  [ Athos Ribeiro ]
  * New upstream version 2.6.1. (Closes: #1087295)
  * d/p/0009-disable-database-tests.patch: refresh patch
  * d/tests/kea-dhcp4*: explicitly configure subnet ID.
    These are no longer optionally auto generated.
  * d/p/0002-kea_admin_fix.patch: drop patch.
    The local paths being removed are spread among several other files and
    the code paths using them are not accessed when running the installed
    version of these files/binaries.
  * d/salsa-ci.yml: update ubuntu series to plucky

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 06 Jan 2025 15:21:15 -0300

isc-kea (2.4.1-3) unstable; urgency=medium

  [ Paride Legovini ]
  * d/t/smoke-test: add sleep to allow for the services to start
  * d/t/kea-ctrl-agent-debconf override systemd restart limit.
    Thanks to Andreas Hasenack
  * ci: salsa pipeline: disable the crossbuild-arm64 job
  * ci: salsa pipeline: fail on Lintian warnings
  * d/*.l-o: drop unused overrides
  * kea-dev: build and install kea-msg-compiler.
    Thanks to Quentin Armitage (Closes: #1065362)
  * d/kea-dev.l-o: override no-manual-page for kea-msg-compiler
  * ci: salsa pipeline: enable reprotest, without build_path variation.
    Thanks to Holger Levsen
  * d/p/0001-support_kfreebsd.patch: drop patch.
    The development of Debian GNU/kFreeBSD terminated in July 2023.
  * d/p/0011-kea-ctrl-agent-authentication.patch: add dep-3 headers
  * d/*.init: fix SysV init scripts.
    Thanks to Stefan Klein (Closes: #1055438)
  * d/rules: disable LTO on ppc64el as it causes crashes.
    Thanks to Sergio Durigan Junior (LP: #2055151)

  [ Andreas Hasenack ]
  * apparmor: also allow reading the pid file.
    At least kea-ctrl-agent attempts to read the pid file, and it makes
    sense to allow that. Also make the change for all other profiles.

 -- Paride Legovini <paride@debian.org>  Fri, 29 Mar 2024 16:38:54 +0100

isc-kea (2.4.1-2) unstable; urgency=medium

  * Team upload.

  [ Athos Ribeiro ]
  * d/*.service: Remove dhcp{4,6} WantedBy statements

  [ Paride Legovini ]
  * d/po/fr.po: add French templates translation.
    Thanks to Jean-Pierre Giraud (Closes: #1059863)
  * d/copyright: update copyright years for debian/*

  [ Andreas Hasenack ]
  * apparmor: add missing include directive.
    Add a missing include directive to all profiles include the
    site-specific additions and overrides. (Closes: #1064513)

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 26 Feb 2024 10:32:35 -0300

isc-kea (2.4.1-1) unstable; urgency=medium

  * New upstream version 2.4.1

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 14 Dec 2023 17:21:04 -0300

isc-kea (2.4.0-1) unstable; urgency=medium

  [ Paride Legovini ]
  * d/control: add Athos Ribeiro to Uploaders
  * d/*.init: specify the daemons' full path.
    Thanks to Alessandro Vesely (Closes: #1052338)

  [ Athos Ribeiro ]
  * New upstream version 2.4.0 (Closes: #1040523)
  * d/patches: refresh patches
  * d/rules: remove cleanup for kea_connector2.py
  * d/t/kea-dhcp4: check if lease lifetime is valid

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 26 Oct 2023 09:17:18 -0300

isc-kea (2.2.1-3) unstable; urgency=medium

  [ Andreas Hasenack ]
  * apparmor: allow kea-ctrl-agent to access IPv6 sockets
    (Closes: #1052764)

 -- Paride Legovini <paride@debian.org>  Wed, 27 Sep 2023 14:47:14 +0200

isc-kea (2.2.1-2) unstable; urgency=medium

  * d/po/de.po: add German debconf translation.
    Thanks to Christoph Brinkhaus (Closes: #1041710)
  * d/po/es.po: add Spanish debconf translation.
    Thanks to Camaleón (Closes: #1041772)
  * d/po/nl.po: add Dutch debconf translation.
    Thanks to Frans Spiesschaert (Closes: #1041875)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Sun, 10 Sep 2023 10:09:52 -0300

isc-kea (2.2.1-1) unstable; urgency=medium

  * d/u/signing-key.asc: update upstream signing key
  * New upstream version 2.2.1
  * Fix typo in debconf string.
    Thanks to Helge Kreutzmann (Closes: #1041394)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 04 Aug 2023 07:37:08 -0300

isc-kea (2.2.0-8) unstable; urgency=medium

  [ Athos Ribeiro ]
  * d/rules: add strict shlibs control file

  [ Andreas Hasenack ]
  * Restrict access to the default RESTful API on 127.0.0.1:8000 to
    authenticated users (Closes: #1033367) (LP #2007312):
    - Add debconf templates to restrict API access
    - d/control: add debconf build-deps
    - d/kea-ctrl-agent.postinst: handle kea-api password creation
    - d/kea-ctrl-agent.config: prepare debconf questions
    - d/kea-ctrl-agent.postrm: purge api password file
    - d/p/0011-kea-ctrl-agent-authentication.patch
    - d/t/kea-ctrl-agent.service: require a non-empty kea api password file
    - d/t/control, d/t/kea-ctrl-agent-debconf: test debconf options
    - d/t/smoke-tests, d/t/kea-dhcp4: support kea-ctrl-agent authentication
  * d/NEWS: update with noteworthy changes

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 04 Jul 2023 10:40:32 -0300

isc-kea (2.2.0-6) unstable; urgency=medium

  [ Andreas Hasenack ]
  * apparmor: use the apparmor nameservice abstraction.
    Use the apparmor nameservice abstraction instead of hand-picked rules.
    (Closes: #1033640, #1033639)

 -- Paride Legovini <paride@debian.org>  Mon, 03 Apr 2023 12:48:28 +0200

isc-kea (2.2.0-5) unstable; urgency=medium

  [ Paride Legovini ]
  * d/control: update to Standards-Version 4.6.2, no changes needed

  [ Andreas Hasenack ]
  * d/t/kea-dhcp4.conf.template: retry opening a socket. Sometimes the
    `keabr0` bridge used in the DEP8 test takes a while to become ready, and
    kea-dhcp4 fails to open a socket on it. Add configuration options to
    kea-dhcp4 to retry opening the socket a few times before giving up.
    (LP: #2008932)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 02 Mar 2023 14:00:17 -0300

isc-kea (2.2.0-4) unstable; urgency=medium

  [ Athos Ribeiro ]
  * d/rules: use MathJax from libjs-mathjax instead loading from external CDN

  [ Andreas Hasenack ]
  * d/t/kea-dhcp4: make the test more robust
    - increase dhclient timeout to 60s, and run in verbose mode
    - show logs in the case of failure
    - set +e inside the cleanup handler
    - fix resolv.conf regexp

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 27 Feb 2023 14:58:26 -0300

isc-kea (2.2.0-3) unstable; urgency=medium

  [ Andreas Hasenack ]
  * Add apparmor profiles.
    - d/control: add build-depends on dh-apparmor
    - d/usr.sbin.kea-*: add the profiles
    - d/kea-*.install: install the profiles
    - d/rules: use dh_apparmor to enable the profiles
  * d/tests: Add DEP8 test for kea-dhcp4

 -- Paride Legovini <paride@debian.org>  Fri, 17 Feb 2023 19:59:43 +0100

isc-kea (2.2.0-2) unstable; urgency=medium

  [ Athos Ribeiro ]
  * d/tests: add simple DEP8 smoke tests
  * Set default control sockets location to /run/kea (Closes: #1014929)
    (LP: #1863100)

  [ Paride Legovini ]
  * d/control: drop dependency on lsb-base (obsolete)
  * d/salsa-ci.yml: enable the autopkgtest job
  * d/kea-common.*:
    - Do not install keactrl. The keactrl script is not systemd-aware and not
      installed by the upstream .deb packages. Remove it from the Debian
      packaging
    - Leave handling of /var/*/kea directories to systemd. No need to create
      them in packaging as the systemd units will automatically create them
      with the right ownership and permissions
  * d/*.service:
    - Do not set KEA_LOGGER_DESTINATION. The variable is meant to tell the
      daemons where to log *before* their config files are loaded. If unset
      the default is stdout, which works well with systemd
    - Do not set KEA_PIDFILE_DIR. What we set it to corresponds to the
      defaults. The documentation says that KEA_PIDFILE_DIR "is intended
      primarily for testing"
  * d/rules: use the systemd journal for logging (Closes: #1016747)
    (LP: #2006522)
  * d/kea-doc.README.Debian: document how logging is done by default
  * d/tests/smoke-tests: check location of PID and lock files

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 14 Feb 2023 11:24:58 -0300

isc-kea (2.2.0-1) unstable; urgency=medium

  * New upstream version 2.2.0.
    Thanks to Daniel Baumann (Closes: #1016109)
  * debian/patches:
    - 0002-kea_admin_fix.patch: refresh patch
    - 0007-keyctrl-colored-ddns-status.patch: drop patch (fixed upstream)
    - 0009-disable-database-tests.patch: refresh patch
    - 0010-build-libco-when-gtest-is-not-enabled: drop patch (fixed upstream)
    - 0011-sphinx-set-language.patch: drop patch (fixed upstream)
  * d/kea-doc.doc-base: register documentation to doc-base
  * Lintian overrides:
    - *.lintian-overrides: adapt to "pointed hints" syntax
    - kea-admin.l-o: bash-term-in-posix-shell (false positives)
    - d/kea-doc.l-o: add overrides for sphinx installed fonts.
      + font-in-non-font-package [usr/share/doc/kea/html/_static/fonts/*]
      + font-outside-font-dir [usr/share/doc/kea/html/_static/fonts/*]
  * d/copyright: remove file patterns made unnecessary by new release
  * d/salsa-ci.yml: add salsa CI

 -- Paride Legovini <paride@debian.org>  Tue, 02 Aug 2022 12:16:45 +0000

isc-kea (2.0.2-3) unstable; urgency=medium

  * d/rules: configure: specify the Python site packages location.
    Related changes:
     - d/python3-kea-connector.install: update paths accordingly
    Thanks to Kilian Krause (Closes: #1014995)

 -- Paride Legovini <paride@debian.org>  Wed, 20 Jul 2022 16:03:19 +0000

isc-kea (2.0.2-2) unstable; urgency=medium

  * d/patches: explicitly set the sphinx doc language.
    Needed for compatibility with Sphinx 5.0. New patch:
    - d/p/0011-sphinx-set-language.patch (Closes: #1013407)
  * d/control: bump Standards-Version to 4.6.1, no changes needed
  * d/gbp.conf: debian-branch = debian/unstable (DEP-14)
  * d/gbp.conf: enable use of pristine-tar
  * d/watch.include-odd-versions: alternative watch file.
    Also covers the odd-numbered (= devel) upstream releases.

 -- Paride Legovini <paride@debian.org>  Sun, 26 Jun 2022 14:48:25 +0000

isc-kea (2.0.2-1) unstable; urgency=medium

  * New upstream version 2.0.2

 -- Paride Legovini <paride@debian.org>  Mon, 07 Mar 2022 21:13:17 +0000

isc-kea (2.0.1-2) unstable; urgency=medium

  * Upload to Debian unstable
  * wrap-and-sort -bast (cosmetic)

 -- Paride Legovini <paride@debian.org>  Sun, 30 Jan 2022 19:39:09 +0100

isc-kea (2.0.1-1) experimental; urgency=medium

  * New upstream version 2.0.1 (Closes: #954768, #973641)
  * d/watch: fix search path and only match stable versions (Closes: #974611)
  * d/u/signing-key.asc: replace with new key for 2021-2022.
  * d/control:
    - Update Standards-Version to 4.6.0 (no changes needed)
    - Switch to dh compat level 13
    - Set Rules-Requires-Root: no
    - Drop ORed dependency on obsolete libmysqlclient-dev
    - Add python3-kea-connector dependency to kea-ctrl-agent
    - Build-Depend on procps (test dependency)
    - Drop Section: libs for kea-common (fallback to Section: net)
    - Minor cosmetic changes to the descriptions
  * d/rules:
    - Don't pass --as-needed to ld (it's now the default)
    - Drop explicit `dh_missing --fail-missing` (default in dh 13)
    - Drop useless override_dh_auto_make target
    - Drop override_dh_clean (not needed)
    - Use execute_after_* targets where appropriate
    - Do not ignore the test results
    - Drop unnecessary $@ in override_dh_auto_configure
    - Disable out-of-source building (dh -B)
    - Set localstatedir to /var (Closes: #959149)
    - Delete __pycache__ recursively
    - Don't delete keactrl.8
    - Drop `dh_installdocs -A`: it prevents using a main doc package
    - Build perfdhcp (configure flag: --enable-perfdhcp)
  * d/patches:
    - 0001-support_kfreebsd: refresh patch
    - 0002-kea_admin_fix: refresh patch
    - 0003-Use-runstatedir-for-pid-file-location.patch: drop, fixed upstream
    - d/p/0004-Put-KEA_LOCKFILE_DIR-to-runstatedir.patch: drop patch.
      Replaced by setting the KEA_LOCKFILE_DIR environment variable.
    - 0007-keyctrl-colored-ddns-status.patch: add patch
    - 0009-disable-database-tests.patch: add patch.
      Skip the database tests (problematic to run in automation).
    - 0010-build-libco-when-gtest-is-not-enabled.patch: add patch.
      Fix test suite fails if Kea is built without gtest.
    - Always use the .patch extension for uniformity
  * d/docs: drop file, replaced by kea-doc.docs
  * d/kea-doc.install: drop file, replaced by d/kea-doc.docs
  * d/kea-admin.install: install perfdhcp
  * d/*.install: move manpages to d/*.manpages
  * d/kea-common.manpages: install keactrl.8
  * d/kea-doc.docs:
    - Add CONTRIBUTING.md
    - Install the API reference
  * d/not-installed: refresh list of not-installed files
  * d/s/lintian-overrides: override very-long-line-length-in-source-file
  * d/kea-common.l-o: override script-not-executable etc/kea/keactrl.conf.
    Has a shebang but it's meant to be sourced, not executed.
  * d/u/metadata: add upstream metadata file
  * d/copyright:
    - Add Canonical Ltd. for debian/*
    - Drop references to nonexisting files
  * d/control: add Paride Legovini to Uploaders

 -- Paride Legovini <paride@debian.org>  Thu, 27 Jan 2022 12:27:23 +0100

isc-kea (1.7.5-1) unstable; urgency=medium

  * Bump dh compat to 12, bump debian standard to 4.5.0
    (dh_compat v11 is broken and should not be used)
  * New upstream version 1.7.5
  * Security issues fixed since 1.5.0-2:
   + CVE-2019-6472: A packet containing a malformed DUID can cause the
     kea-dhcp6 server to terminate
   + CVE-2019-6473: An invalid hostname option can cause the kea-dhcp4
     server to terminate
   + CVE-2019-6474: An oversight when validating incoming client requests
     can lead to a situation where the Kea server will exit when trying to
     restart
  * Add python3-sphinx and python3-sphinx-rtd-theme to Build-Depends to
    build the documentation
  * Adjust installed files
  * Add 'kea' metapackage that depends on all server components of Kea
  * Fix more ISC KEA -> Kea naming
  * Cleanup the lintian warnings

 -- Ondřej Surý <ondrej@debian.org>  Mon, 23 Mar 2020 11:11:05 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog kea-common`.
