Merge ~ahasenack/ubuntu/+source/openldap:groovy-openldap-2.4.50-merge-and-delta-drop into ubuntu/+source/openldap:debian/sid

[Andreas Hasenack]

Most of the diff is in d/changelog, for carrying such a large delta for so long.

Debian merge of 2.4.50, plus a lot of delta drop. Let's go!

Bileto (still running, mostly done, i386 known failures so far): https://bileto.ubuntu.com/#/ticket/4053

I added sssd to that ticket because it has nice ldap integration tests.

First, remaining "normal" delta:
- apparmor
- ufw
- apport

The remaining bits:
    - d/slapd.scripts-common:
      - add slapcat_opts to local variables.
Added to debian in https://salsa.debian.org/openldap-team/openldap/-/commit/50a32c03d83ed8f8026a93da0fba0ef0b639a7ee

      - Fix backup directory naming for multiple reconfiguration.
Submitted to debian via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960449

    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
Adopted by debian in https://salsa.debian.org/openldap-team/openldap/-/commit/50a32c03d83ed8f8026a93da0fba0ef0b639a7ee

    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
      of test timing issue.
Not submitted yet

    - d/p/set-maintainer-name: use the Maintainer field from d/control
      instead of hardcoding an email (LP: #1875697)
Submitted to debian via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960448

The drops!

I hope the reasoning for each drop, even though just a short sentence, is clarifying enough. Most of the drops are because we no longer ship likewise-open. But here we go:
- nss overlay: we don't need another name service switch module, we have standardized on sssd
- gssapi support: we still have it, via sasl gssapi. Bug #495418 (which introduced this delta) even has a comment from upstream asking us to drop this. This was also added because of likewise-open, it probably didn't work with sasl back then.
- olcRootDN for the ldif init: not worth keeping a delta for. It's just an authentication entity that there is no way for someone to authenticate as, but the ACL in that ldif grant the "manage" access to the sasl external entity, so that is in effect the new admin. There is no harm in keeping olcRootDN, so let's drop this.
- CLDAP support. Also added because of likewise-open. This was required for windows 2k domain joins, as cldap was the only way to query the server for what ldap suffixes it had, and other discovery things.
- show distribution in version: debian now shows the package version, which will have the "ubuntu" name in it in our case, so dropped (also requested in https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1875697). The delta I added makes the maintainer email dynamic, and I pushed that to debian too (but see the (*) remark above). The debian maintainer said in the bug he would accept something dynamic, so let's see if my parsing of d/control is ok.

That's it!

[Andreas Hasenack (ahasenack)]

I got this review via email from Ryan Tandy, the debian maintainer of openldap. ">" are his comments, and my reply below.

> - dropping GSSAPI is an ABI break (removing public symbols), therefore I
> think it requires a SONAME change and transition. I was going to
> propose dropping this when we eventually update to 2.5 as I don't
> foresee a SONAME bump happening sooner.

After an LTS is the right time to drop such an old delta, that was
even requested by (now upstream)
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/495418/comments/2

We should be able to rely on the symbols file to handle upgrades, no?
Or do you mean in terms of debian policy the soname must change?

> - dropping nssov breaks upgrades for anyone who has it enabled, unless
> you specifically add scripting to detect and disable it. I guess the
> numbers of users is small but I know at least one person who was (not
> sure whether still is) using nssov.

Scripting with the cn=config backend is tough. And just removing nssov
for the sake of having slapd start up fine would hide the change
somewhat.

For both these changes, we will certainly need release notes, and I
wrote this down already to add to the notes when we are closer to
release. I can also email ubuntu-server@ or even ubuntu-devel@ to get
a feeling who is using these, and what people think. I also think that
right after the LTS is a good time to tackle this problem and drop
stuff we don't use anymore, nor want our users still use. The nss
overlay requires "the client-side stuf library from nss-pam-ldapd",
which we only have in universe since precise, and I would like to
standardize on sssd as much as possible.

[Andreas Hasenack (ahasenack)]

More comments. This time, ">" are mine:

On Tue, May 12, 2020 at 02:32:18PM -0300, Andreas Hasenack wrote:
>We should be able to rely on the symbols file to handle upgrades, no?
>Or do you mean in terms of debian policy the soname must change?

The symbols file tracks when new interfaces were added, but when
changing or removing already exported ones, the SONAME must change.

https://www.debian.org/doc/debian-policy/ch-sharedlibs.html#run-time-shared-libraries

>Scripting with the cn=config backend is tough. And just removing nssov
>for the sake of having slapd start up fine would hide the change
>somewhat.

Yeah. I was thinking more along the lines of failing the upgrade in
preinst if nssov is enabled, rather than get into a state where recovery
requires manual changes in /etc/ldap/slapd.d.

But the number of users affected is honestly going to be single-digit or
zero, so a release note is probably about all the effort it's worth.

>The nss overlay requires "the client-side stuf library from
>nss-pam-ldapd", which we only have in universe since precise, and I
>would like to standardize on sssd as much as possible.

ACK, recommending sssd makes sense for sure.

[Christian Ehrhardt  (paelzer)]

Looong changelog, but after reading it twice I agree.
Glad you could drop so much.

I like that you added the reasoning for each of them.
And I also agree that early in the post-LTS cycle is the right time to do so.

Also thanks for sending all the remaining bits that are applicable to Debian already.

This is so much I need to look a bit further, but so far it LGTM

[Christian Ehrhardt  (paelzer)]

ok, AFAICS old delta is retained correctly.
But a lot is going on, so I hope I didn't miss anything.

Hopefully you can drop more of the already submitted changes next time to further clean this up.

review: Approve

[ben thielsen (btb-bitrate)]

i use and prefer nss-pam-ldapd, so removing nssov would break things for my installations. it doesn't really matter to me if nssov is loaded/enabled/configured by the packaging system [in fact, i would prefer it not be, myself], but it's not clear to me what problem it causes to include it in the package, so people who want it can use it.

as a side note, it would be disappointing to see sssd pushed over nss-pam-ldapd, generally speaking.

[Andreas Hasenack (ahasenack)]

As recommended by Ryan Tandy (debian maintainer of openldap), and after a discussion with my colleagues, we decided to not drop the gssapi and CLDAP deltas at this time, because that would require buming the soname of the openldap libraries, which is already at 2.4. When the next upstream major release happens, 2.5, that will be the right time to drop this delta. It's unfortunate, but it's the price to pay for having introduced that back in 2009 without much thinking ahead.

[Andreas Hasenack (ahasenack)]

I emailed ubuntu-server@ about these changes, and also posted on the discourse forum.

https://lists.ubuntu.com/archives/ubuntu-server/2020-May/008333.html

https://discourse.ubuntu.com/t/cleaning-up-openldap-packaging/16287

ben thielsen (btb-bitrate), we can continue the nss overlay discussion there.

[Andreas Hasenack (ahasenack)]

About the nssov removal, if the previous install is using the overlay, the upgrade fails, quite as expected:

May 21 19:05:20 groovy-nss-overlay slapd[1275]: lt_dlopenext failed: (nssov) file not found
...

Errors were encountered while processing:
 slapd
E: Sub-process /usr/bin/dpkg returned an error code (1)

Expected, but not very nice. Ryan Tandy suggested a check in preinst.

[Andreas Hasenack (ahasenack)]

If I check for the nss overlay in slapd.preinst, and exit 1 (just for the sake of testing, let's assume there are debconf prompts asking what to do, and the user chose to abort), then we get:

(...)
Preparing to unpack .../slapd_2.4.50+dfsg-1ubuntu1~ppa4_amd64.deb ...
Saving current slapd configuration to /var/backups/slapd-2.4.49+dfsg-2ubuntu2...
nss overlay in use, aborting install
dpkg: error processing archive ./slapd_2.4.50+dfsg-1ubuntu1~ppa4_amd64.deb (--install):
 new slapd package pre-installation script subprocess returned error exit status 1
  Backing up /etc/ldap/slapd.d in /var/backups/slapd-2.4.50+dfsg-1ubuntu1~ppa4... done.
Setting up libldap-common (2.4.50+dfsg-1ubuntu1~ppa4) ...
Setting up libldap-2.4-2:amd64 (2.4.50+dfsg-1ubuntu1~ppa4) ...
Setting up ldap-utils (2.4.50+dfsg-1ubuntu1~ppa4) ...
Processing triggers for man-db (2.9.1-1) ...
Processing triggers for libc-bin (2.31-0ubuntu9) ...
Errors were encountered while processing:
 ./slapd_2.4.50+dfsg-1ubuntu1~ppa4_amd64.deb
$ echo $?
1

Summary:
- apt exits 1, indicating a failure
- slapd stays at the previous version, but other packages remain upgraded
- slapd is restarted, but stays running instead of failing to come up

Removing the nss overlay configuration in postinst is complicated, error prone, and might render the system without a working login (assuming the overlay is being used in that system for logins: not always the case).

These are the options as far as I can see, at the moment:
a) don't remove nssov
b) remove nssov, and exit 1 in preinst if it's detected, with the outcome detailed above
c) remove nssov and not handle it. apt fails, slapd remains stopped at the end, system might be without a working logn
d) remove nssov, go through great lengths to remove it from slapd's config (very complicated due to cn=config and the fact that slapd doesn't support removing modules dynamically via ldap commands), and in the end have a running slapd, but without nssov. System might again be without a working login, if nssov was used for that on this system.

If we chose (a), I might as well fix bug #381829 and bug #1452087

[Andreas Hasenack (ahasenack)]

I emailed ubuntu-devel[1] about the nssov situation, and will keep the overlay for now until I can come up with a better plan for its removal that doesn't horribly break upgrades for people who are using it.

[Andreas Hasenack (ahasenack)]

And the link to my ubuntu-devel post, which I forgot to add in my previous comment:

https://lists.ubuntu.com/archives/ubuntu-devel/2020-May/041004.html

[Andreas Hasenack (ahasenack)]

I updated the branch keeping the nssov delta, and I also rearranged the commits a bit so they are together where it makes sense:

a)
commit cee0c2496d9abaee94778cb201462300372d0763
Author: Andreas Hasenack <email address hidden>
Date: Fri Feb 8 18:23:23 2019 -0200

        - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
          - CLDAP (UDP) was added in 2.4.17-1ubuntu2
          - GSSAPI support was enabled in 2.4.18-0ubuntu2

I split this one up in two pieces, and folded them together each with the commit that added the feature. I also added notes about when this can be dropped:
commit b8787fe7f9e5ed0a9d3aabd0fe3c65c5a3d64db1
Author: Andreas Hasenack <email address hidden>
Date: Fri Feb 8 18:22:00 2019 -0200

        - Add support for CLDAP (UDP) support, back then required by
          likewise-open (first enabled in 2.4.17-1ubuntu2):
          + d/rules: Enable -DLDAP_CONNECTIONLESS
          + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
          This should be dropped when the soname changes.

and
commit 90eba5f78d1a44aa3b86956b6916edc8e518f9f8
Author: Andreas Hasenack <email address hidden>
Date: Fri Feb 8 18:16:01 2019 -0200

        - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
...
          + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
          This should be dropped when the soname changes.

b)
commit a23fad285c57ba7ba8c2a14668c66e637a2a584a
Author: Andreas Hasenack <email address hidden>
Date: Mon Feb 11 09:18:28 2019 -0200

        - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
          Debian bug #919136, we also have to patch the nssov makefile
          accordingly and thus update this patch.

Squashed the above commit into the one adding the nssov delta:
commit 3ebf10cacef2c35e7598c131118aea769b091427
Author: Andreas Hasenack <email address hidden>
Date: Fri Feb 8 18:19:09 2019 -0200

        - Enable nss overlay:
...
          + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
            Debian bug #919136, we also have to patch the nssov makefile
            accordingly and thus update this patch.

[Andreas Hasenack (ahasenack)]

Finally, i also updated the commit messages with the correct list symbol for each indentation level. Basically, replaced many "-" with "+".

b76ceba... by Ryan Tandy on 2020-05-23

  * Added:
    - d/rules, debian/patches/set-maintainer-name: Extract maintainer
      address dynamically from debian/control. Thanks to Ryan Tandy
      <email address hidden> (Closes: #960448, LP: #1875697)

[Christian Ehrhardt  (paelzer)]

sigh, soname troubles plus this nssov thing - this clearly is one of the more ugly merged.
/me hugs Andreas

Re-reviewing the MP as it is right now ...

- Ack on not removing nssov (for now)
- Ack on keeping the bad symbols until we can soname bump
(both as discussed)

+1 on the new set of kept/dropped changes.

One thing if you want to experiment a bit more with it since we can't get rid of the extra features/symbols we have that came to my mind last weekend was deprecating them.
Would it be a reasonable delta to throw in some "deprecated" attributes via [1]?
That way - once we some day remove it - everyone linking against them would have had quite some time being told that they are deprecated.

One could think of a similar strategy for nssov to now yell/warn/message about that it will be dropped later in all places you can - to reduce the impact when you do it some time down the road. IIRC you already have the code to detect nssov and while I agree messing with the config is error-prone, warning that it should not be used would be fine IMHO.

[1]: https://gcc.gnu.org/onlinedocs/gcc-4.7.1/gcc/Type-Attributes.html#Type-Attributes

review: Needs Information

[Andreas Hasenack (ahasenack)]

> One thing if you want to experiment a bit more with it since we can't get rid of
> the extra features/symbols we have that came to my mind last weekend was
> deprecating them. Would it be a reasonable delta to throw in some "deprecated"
> attributes via [1]?

I can play with this, but I'm not sure it's the right thing to do. These symbols are not deprecated, and they fall into two categories:

- cldap support: ber_sockbuf_io_udp and ldap_is_ldapc_url. Both defined in public header files:

include/lber.h:LBER_V( Sockbuf_IO ) ber_sockbuf_io_udp;

and

include/ldap.h:
#ifdef LDAP_CONNECTIONLESS
LDAP_F( int )
ldap_is_ldapc_url LDAP_P((
    LDAP_CONST char *url ));
#endif

Both are only used if LDAP_CONNECTIONLESS is defined.

- gssapi support
This is the "bad" one, as the delta we have is adding internal symbols to the symbols file. For example, ldap_int_gssapi_close is defined in ./libraries/libldap/ldap-int.h. This header file is not even shipped in the libldap2-dev package. Hm, since the header file isn't shipped, I wonder if these symbols can even be used?

Anyway, going back to the point of deprecating symbols, adding a patch that changes C code marking the, say, gssapi symbols deprecated isn't correct, as they shouldn't be exposed in the first place. Using them when linking with the ubuntu openldap packages (if possible, given we don't ship the corresponding header file), that is what is "deprecated", because we want to remove them.

[Andreas Hasenack (ahasenack)]

Hm, there are many other *_int_* symbols in the symbols file, also defined just in the -int header file that is not shipped. Meh.

[Andreas Hasenack (ahasenack)]

I tested patching one attribute with that flag:

-LDAP_F(void) ldap_int_gssapi_close LDAP_P(( LDAP *ld, LDAPConn *lc ));
+LDAP_F(void) ldap_int_gssapi_close LDAP_P(( LDAP *ld, LDAPConn *lc )) __attribute__ ((deprecated));

The build shows this then:
../../../../libraries/libldap/gssapi.c: In function ‘ldap_int_gssapi_setup’:
../../../../libraries/libldap/gssapi.c:620:2: warning: ‘ldap_int_gssapi_close’ is deprecated [-Wdeprecated-declarations]
  620 | ldap_int_gssapi_close( ld, lc );
      | ^~~~~~~~~~~~~~~~~~~~~
../../../../libraries/libldap/gssapi.c:581:6: note: declared here
  581 | void ldap_int_gssapi_close( LDAP *ld, LDAPConn *lc )
      | ^~~~~~~~~~~~~~~~~~~~~

since that function is used internally, correctly. So I don't think it's a good approach.

[Christian Ehrhardt  (paelzer)]

Ok, thanks for trying - it was worth that but you have shown it doesn't match your case :-/

I was +1 otherwise on it, so +1 is all that is left after trying the deprecation trick.

review: Approve

[Andreas Hasenack (ahasenack)]

About notifying the user that nssov will eventually be removed, I thought of these options:
- d/NEWS file. A bit weird, because we are not changing it yet, so I'm not sure this mechanism applies. But is an interesting notification mechanism for those who have apt-listchanges (I think that's the name) installed. It would only show once, thouch, iiuc.
- simple postinst "echo" lines. Can get lost in all those messages, but can show the warning with every upgrade if we want (i.e., do the check regardless of the package version that is being upgraded)

Any other ideas? Also keep in mind we might not be able to cleanly removed this overlay, so maybe adding these warnings now is premature.

[Christian Ehrhardt  (paelzer)]

We know that eventually there will always be someone that misses it and later complain.
So don't let perfection be the enemy of progress and pick something that works for the majority.

For this particular case I'm fan of something very noisy on the upgrade if we detected it is in use.
That way the majority of users won't see anything and that is ok as it isn't "for them".
For all the others I think it would be good to be loud and noisy on upgrades.
Actually - we can detect that it is in use can we?

Furthermore orthogonal to the packaging changes something that you can find with a search engine, maybe release notes or server guide (or even a blog if you want). Whatever you think is best for you.

[Andreas Hasenack (ahasenack)]

I'm actually -1 on adding notes about future upcoming changes to the packaging at the moment, when such changes aren't there. It's our intention, and that was communicated in 2 mailing lists and the discourse forum. I added a d/slapd.NEWS bit, but am ready to revert that.

421b8d2... by Andreas Hasenack on 2020-06-01

merge-changelogs

1c96234... by Andreas Hasenack on 2020-06-01

reconstruct-changelog

890c4ee... by Andreas Hasenack on 2020-06-01

update-maintainer

[Christian Ehrhardt  (paelzer)]

As I said above, "Whatever you think is best for you", so if ML+Discourse is what you want that is fine with me. The NEWS entry would be just another Delta with potentially low gain - so I'm ok if you drop it before upload.
I mostly wanted to spawn the idea of trying to communicate it, not define how exactly we do it.

[Andreas Hasenack (ahasenack)]

Thanks, sorry for misunderstanding.

[Andreas Hasenack (ahasenack)]

Tagging and uploading 890c4eea118142866ff23abe7b8be5d408316d98

$ git push pkg upload/2.4.50+dfsg-1ubuntu1
Enumerating objects: 94, done.
Counting objects: 100% (94/94), done.
Delta compression using up to 4 threads
Compressing objects: 100% (76/76), done.
Writing objects: 100% (78/78), 28.91 KiB | 1.11 MiB/s, done.
Total 78 (delta 55), reused 6 (delta 2)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/openldap
 * [new tag] upload/2.4.50+dfsg-1ubuntu1 -> upload/2.4.50+dfsg-1ubuntu1

$ dput ubuntu ../openldap_2.4.50+dfsg-1ubuntu1_source.changes
Checking signature on .changes
gpg: ../openldap_2.4.50+dfsg-1ubuntu1_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../openldap_2.4.50+dfsg-1ubuntu1.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openldap_2.4.50+dfsg-1ubuntu1.dsc: done.
  Uploading openldap_2.4.50+dfsg-1ubuntu1.debian.tar.xz: done.
  Uploading openldap_2.4.50+dfsg-1ubuntu1_source.buildinfo: done.
  Uploading openldap_2.4.50+dfsg-1ubuntu1_source.changes: done.
Successfully uploaded packages.

[Andreas Hasenack (ahasenack)]

This migrated.

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
 new file mode 100644
index 0000000..793fa7b
--- /dev/null
+++ b/debian/apparmor-profile
@@ -0,0 +1,60 @@
+# vim:syntax=apparmor
+# Last Modified: Fri Jan  4 15:18:13 2008
+# Author: Jamie Strandboge <[e-mail]>
+
+#include <tunables/global>
+
+/usr/sbin/slapd {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/p11-kit>
+
+  #include <abstractions/ssl_certs>
+  /etc/ssl/private/ r,
+  /etc/ssl/private/* r,
+
+  /etc/sasldb2 r,
+
+  capability dac_override,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+
+  /etc/gai.conf r,
+  /etc/hosts.allow r,
+  /etc/hosts.deny r,
+
+  # ldap files
+  /etc/ldap/** kr,
+  /etc/ldap/slapd.d/** rw,
+
+  # kerberos/gssapi
+  /dev/tty rw,
+  /etc/gss/mech.d/   r,
+  /etc/gss/mech.d/* kr,
+  /etc/krb5.keytab kr,
+  /etc/krb5/user/*/client.keytab kr,
+  owner /tmp/krb5cc_* rwk,
+  /var/tmp/ rw,
+  /var/tmp/** rw,
+
+  # the databases and logs
+  /var/lib/ldap/ r,
+  /var/lib/ldap/** rwk,
+
+  # lock file
+  /var/lib/ldap/alock kw,
+
+  # pid files and sockets
+  /{,var/}run/slapd/* w,
+  /{,var/}run/slapd/ldapi rw,
+  /{,var/}run/nslcd/socket rw,
+
+  /usr/lib/ldap/ r,
+  /usr/lib/ldap/* mr,
+
+  /usr/sbin/slapd mr,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.slapd>
+}
diff --git a/debian/changelog b/debian/changelog
index 7d3dc4c..504f29f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,69 @@
+openldap (2.4.50+dfsg-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
+      + d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      + d/configure.options: Configure with --with-gssapi
+      + d/control: Added heimdal-dev as a build depend
+      + d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+      + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
+      This should be dropped when the soname changes.
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      + d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      + d/slapd.install:
+        - install nssov overlay
+      + d/slapd.manpages:
+        - install slapo-nssov(5) man page
+      + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+        Debian bug #919136, we also have to patch the nssov makefile
+        accordingly and thus update this patch.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.scripts-common:
+      + add slapcat_opts to local variables.
+      + Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - Add support for CLDAP (UDP) support, back then required by
+      likewise-open (first enabled in 2.4.17-1ubuntu2):
+      + d/rules: Enable -DLDAP_CONNECTIONLESS
+      + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
+      This should be dropped when the soname changes.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
+      of test timing issue.
+  * Dropped:
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+      [Not worth keeping a delta for, as having olcRootDN doesn't hurt]
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [Debian now shows the full package version]
+    - SECURITY UPDATE: denial of service via nested search filters
+      + debian/patches/CVE-2020-12243.patch: limit depth of nested
+        filters in servers/slapd/filter.c.
+      [Fixed upstream]
+  * Added:
+    - d/rules, debian/patches/set-maintainer-name: Extract maintainer
+      address dynamically from debian/control. Thanks to Ryan Tandy
+      <[e-mail]> (Closes: #960448, LP: #1875697)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 01 Jun 2020 09:19:58 -0300
+
 openldap (2.4.50+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -40,6 +106,69 @@ openldap (2.4.49+dfsg-3) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sat, 04 Apr 2020 10:43:56 -0700
 
+openldap (2.4.49+dfsg-2ubuntu2) groovy; urgency=medium
+
+  * SECURITY UPDATE: denial of service via nested search filters
+    - debian/patches/CVE-2020-12243.patch: limit depth of nested filters in
+      servers/slapd/filter.c.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because of
+      test timing issue.
+    - CVE-2020-12243
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 01 May 2020 13:09:12 -0400
+
+openldap (2.4.49+dfsg-2ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable (LP: #1866303). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+        [Dropped the ldap_gssapi_bind_s() hunk as that is already
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 06 Mar 2020 11:39:12 -0300
+
 openldap (2.4.49+dfsg-2) unstable; urgency=medium
 
   * slapd.README.Debian: Document the initial setup performed by slapd's
@@ -51,6 +180,62 @@ openldap (2.4.49+dfsg-2) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 05 Mar 2020 12:59:46 -0800
 
+openldap (2.4.49+dfsg-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+        [Dropped the ldap_gssapi_bind_s() hunk as that is already
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+  * Dropped:
+    - d/control: slapd can depend on perl:any since it only uses perl for
+      some maintainer and helper scripts.
+      [In 2.4.49+dfsg-1]
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 10 Feb 2020 12:13:47 -0300
+
 openldap (2.4.49+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -79,6 +264,102 @@ openldap (2.4.49+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 06 Feb 2020 10:08:12 -0800
 
+openldap (2.4.48+dfsg-1ubuntu4) focal; urgency=medium
+
+  * d/control: slapd can depend on perl:any since it only uses perl for
+    some maintainer and helper scripts. The perl backend links against
+    the correct architecture perl libraries already. Can be dropped
+    after https://salsa.debian.org/openldap-team/openldap/commit/794c736
+    is in a Debian upload.
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 06 Jan 2020 16:46:11 -0300
+
+openldap (2.4.48+dfsg-1ubuntu3) focal; urgency=medium
+
+  * No-change rebuild against libnettle7
+
+ -- Steve Langasek <[e-mail]>  Thu, 31 Oct 2019 22:13:44 +0000
+
+openldap (2.4.48+dfsg-1ubuntu2) focal; urgency=medium
+
+  * No-change rebuild for the perl update.
+
+ -- Matthias Klose <[e-mail]>  Fri, 18 Oct 2019 19:37:23 +0000
+
+openldap (2.4.48+dfsg-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+  * Dropped:
+    - Fix sysv-generator unit file by customizing parameters (LP #1821343)
+      + d/slapd-remain-after-exit.conf: Override RemainAfterExit to allow
+        correct systemctl status for slapd daemon.
+      + d/slapd.install: place override file in correct location.
+      [Included in 2.4.48+dfsg-1]
+    - SECURITY UPDATE: rootDN proxyauthz not restricted to its own databases
+      + debian/patches/CVE-2019-13057-1.patch: add restriction to
+        servers/slapd/saslauthz.c.
+      + debian/patches/CVE-2019-13057-2.patch: add tests to
+        tests/data/idassert.out, tests/data/slapd-idassert.conf,
+        tests/data/test-idassert1.ldif, tests/scripts/test028-idassert.
+      + debian/patches/CVE-2019-13057-3.patch: fix typo in
+        tests/scripts/test028-idassert.
+      + debian/patches/CVE-2019-13057-4.patch: fix typo in
+        tests/scripts/test028-idassert.
+      + CVE-2019-13057
+      [Fixed upstream]
+    - SECURITY UPDATE: SASL SSF not initialized per connection
+      + debian/patches/CVE-2019-13565.patch: zero out sasl_ssf in
+        connection_init in servers/slapd/connection.c.
+      + CVE-2019-13565
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 31 Jul 2019 18:01:14 -0300
+
 openldap (2.4.48+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -106,6 +387,87 @@ openldap (2.4.48+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 25 Jul 2019 08:32:00 -0700
 
+openldap (2.4.47+dfsg-3ubuntu3) eoan; urgency=medium
+
+  * SECURITY UPDATE: rootDN proxyauthz not restricted to its own databases
+    - debian/patches/CVE-2019-13057-1.patch: add restriction to
+      servers/slapd/saslauthz.c.
+    - debian/patches/CVE-2019-13057-2.patch: add tests to
+      tests/data/idassert.out, tests/data/slapd-idassert.conf,
+      tests/data/test-idassert1.ldif, tests/scripts/test028-idassert.
+    - debian/patches/CVE-2019-13057-3.patch: fix typo in
+      tests/scripts/test028-idassert.
+    - debian/patches/CVE-2019-13057-4.patch: fix typo in
+      tests/scripts/test028-idassert.
+    - CVE-2019-13057
+  * SECURITY UPDATE: SASL SSF not initialized per connection
+    - debian/patches/CVE-2019-13565.patch: zero out sasl_ssf in
+      connection_init in servers/slapd/connection.c.
+    - CVE-2019-13565
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 26 Jul 2019 13:21:00 -0400
+
+openldap (2.4.47+dfsg-3ubuntu2) disco; urgency=medium
+
+  * Fix sysv-generator unit file by customizing parameters (LP: #1821343)
+    - d/slapd-remain-after-exit.conf: Override RemainAfterExit to allow
+      correct systemctl status for slapd daemon.
+    - d/slapd.install: place override file in correct location.
+
+ -- Heitor Alves de Siqueira <[e-mail]>  Mon, 08 Apr 2019 12:39:12 -0300
+
+openldap (2.4.47+dfsg-3ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+  * Added changes:
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 11 Feb 2019 09:20:47 -0200
+
 openldap (2.4.47+dfsg-3) unstable; urgency=medium
 
   * Restore patches to contrib Makefiles to set CFLAGS, CPPFLAGS, and LDFLAGS
@@ -121,6 +483,63 @@ openldap (2.4.47+dfsg-3) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sat, 02 Feb 2019 10:30:10 -0800
 
+openldap (2.4.47+dfsg-2ubuntu1) disco; urgency=medium
+
+  * Merge from Debian unstable (LP: #1811630).  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+  * Update nssov build and packaging for Debian changes:
+    - Drop patch nssov-build
+    - d/rules:
+      - add nssov to CONTRIB_MODULES
+      - add sysconfdir to CONTRIB_MAKEVARS
+    - d/slapd.install:
+      - install nssov overlay
+    - d/slapd.manpages:
+      - install slapo-nssov(5) man page
+
+ -- Ryan Tandy <[e-mail]>  Sun, 13 Jan 2019 04:47:09 +0000
+
 openldap (2.4.47+dfsg-2) unstable; urgency=medium
 
   * Reintroduce slapi-dev binary package. (Closes: #711469)
@@ -158,6 +577,63 @@ openldap (2.4.47+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 23 Dec 2018 12:50:40 -0800
 
+openldap (2.4.46+dfsg-5ubuntu3) disco; urgency=medium
+
+  * d/apparmor-profile: update apparmor profile to allow reading of
+    files needed when slapd is behaving as a kerberos/gssapi client
+    and acquiring its own ticket. (LP: #1783183)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 09 Nov 2018 21:29:51 -0200
+
+openldap (2.4.46+dfsg-5ubuntu2) disco; urgency=medium
+
+  * No-change rebuild for the perl 5.28 transition.
+
+ -- Adam Conrad <[e-mail]>  Fri, 02 Nov 2018 18:14:37 -0600
+
+openldap (2.4.46+dfsg-5ubuntu1) cosmic; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 09 May 2018 13:44:37 +0200
+
 openldap (2.4.46+dfsg-5) unstable; urgency=medium
 
   * Restore slapd-smbk5pwd now that libldap is installable in unstable.
@@ -177,6 +653,49 @@ openldap (2.4.46+dfsg-3) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Fri, 04 May 2018 07:36:58 -0700
 
+openldap (2.4.46+dfsg-2ubuntu1) cosmic; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 04 May 2018 10:19:24 +0200
+
 openldap (2.4.46+dfsg-2) unstable; urgency=medium
 
   * Remove version constraint from libldap-2.4-2 dependency on libldap-common.
@@ -206,6 +725,49 @@ openldap (2.4.46+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 03 May 2018 07:03:30 -0700
 
+openldap (2.4.45+dfsg-1ubuntu1) artful; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 28 Jul 2017 14:49:07 +0200
+
 openldap (2.4.45+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -247,6 +809,49 @@ openldap (2.4.45+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 27 Jul 2017 18:04:41 -0700
 
+openldap (2.4.44+dfsg-8ubuntu1) artful; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 17 Jul 2017 10:58:24 +0200
+
 openldap (2.4.44+dfsg-8) unstable; urgency=medium
 
   * Disable test060-mt-hot on ppc64el temporarily to avoid failing tests until 
@@ -257,6 +862,52 @@ openldap (2.4.44+dfsg-8) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 16 Jul 2017 12:57:41 -0700
 
+openldap (2.4.44+dfsg-7ubuntu1) artful; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Tue, 27 Jun 2017 10:21:41 +0200
+
 openldap (2.4.44+dfsg-7) unstable; urgency=medium
 
   * Relax the dependency of libldap-2.4-2 on libldap-common to also permit 
@@ -264,6 +915,52 @@ openldap (2.4.44+dfsg-7) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Tue, 27 Jun 2017 18:53:12 -0700
 
+openldap (2.4.44+dfsg-6ubuntu1) artful; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Tue, 27 Jun 2017 10:21:41 +0200
+
 openldap (2.4.44+dfsg-6) unstable; urgency=medium
 
   * Update the list of non-translatable strings for the 
@@ -272,6 +969,54 @@ openldap (2.4.44+dfsg-6) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Mon, 26 Jun 2017 19:42:02 -0700
 
+openldap (2.4.44+dfsg-5ubuntu1) artful; urgency=medium
+
+   * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    [ undocumented in prior merge, added in 2.4.41+dfsg-1ubuntu1 ]
+    - Fix use after free with GnuTLS. (LP #1557248)
+
+ -- Gianfranco Costamagna <[e-mail]>  Sun, 28 May 2017 22:43:50 +0200
+
 openldap (2.4.44+dfsg-5) unstable; urgency=medium
 
   * debian/patches/ITS-8644-wait-for-slapd-to-start-in-test064.patch: Fix an 
@@ -283,6 +1028,54 @@ openldap (2.4.44+dfsg-5) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 28 May 2017 09:59:46 -0700
 
+openldap (2.4.44+dfsg-4ubuntu1) artful; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    [ undocumented in prior merge, added in 2.4.41+dfsg-1ubuntu1 ]
+    - Fix use after free with GnuTLS. (LP #1557248)
+
+ -- Gianfranco Costamagna <[e-mail]>  Sat, 22 Apr 2017 14:28:54 +0200
+
 openldap (2.4.44+dfsg-4) unstable; urgency=medium
 
   * Improve the slapd/ppolicy_schema_needs_update debconf template. Thanks to 
@@ -329,6 +1122,67 @@ openldap (2.4.44+dfsg-4) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 16 Apr 2017 20:10:43 -0700
 
+openldap (2.4.44+dfsg-3ubuntu2) zesty; urgency=medium
+
+  * d/rules: Fix typo in previous upload.
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 10 Feb 2017 12:17:02 -0800
+
+openldap (2.4.44+dfsg-3ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian unstable (LP: #1663702, LP: #1654416). Remaining
+    changes
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    [ undocumented in prior merge, added in 2.4.41+dfsg-1ubuntu1 ]
+    - Fix use after free with GnuTLS. (LP #1557248)
+  * Drop:
+    - d/slapd.scripts-common:
+      + Remove unused variable new_conf.
+    [ configure_v2_protocol_support function removed in 2.4.44+dfsg-1 ]
+    - d/b/config.log: add config.log
+    [ previously undocumented, stray change ]
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 10 Feb 2017 11:38:57 -0800
+
 openldap (2.4.44+dfsg-3) unstable; urgency=medium
 
   * Apply upstream patch to fix FTBFS on kFreeBSD. (Closes: #845394)
@@ -401,6 +1255,73 @@ openldap (2.4.44+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Mon, 14 Nov 2016 18:59:30 -0800
 
+openldap (2.4.42+dfsg-2ubuntu5) zesty; urgency=medium
+
+  * No-change rebuild for perl 5.24 transition
+
+ -- Iain Lane <[e-mail]>  Mon, 24 Oct 2016 10:37:13 +0100
+
+openldap (2.4.42+dfsg-2ubuntu4) yakkety; urgency=medium
+
+  * Fix use after free with GnuTLS. (LP: #1557248)
+
+ -- Maciej Puzio <[e-mail]>  Fri, 25 Mar 2016 15:24:25 -0500
+
+openldap (2.4.42+dfsg-2ubuntu3) xenial; urgency=medium
+
+  * Fix building with gssapi suppport:
+    - Explicitly add -I/usr/include/heimdal to CFLAGS.
+    - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+
+ -- Matthias Klose <[e-mail]>  Thu, 18 Feb 2016 09:17:27 +0100
+
+openldap (2.4.42+dfsg-2ubuntu2) xenial; urgency=medium
+
+  * No-change rebuild for gnutls transition.
+
+ -- Matthias Klose <[e-mail]>  Wed, 17 Feb 2016 22:27:04 +0000
+
+openldap (2.4.42+dfsg-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian testing (LP: #1532648). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+  * Drop CVE-2015-6908.patch, included in Debian.
+  * Remove DEB_HOST_ARCH from debian/rules: left over from when mdb was 
+    disabled on ppc64el, no longer used, and missed in the previous merge.
+
+ -- Ryan Tandy <[e-mail]>  Sun, 10 Jan 2016 15:50:53 -0800
+
 openldap (2.4.42+dfsg-2) unstable; urgency=medium
 
   [ Ryan Tandy ]
@@ -468,6 +1389,71 @@ openldap (2.4.42+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Fri, 21 Aug 2015 13:07:51 -0700
 
+openldap (2.4.41+dfsg-1ubuntu3) xenial; urgency=medium
+
+  * Rebuild for Perl 5.22.1.
+
+ -- Colin Watson <[e-mail]>  Fri, 18 Dec 2015 15:10:17 +0000
+
+openldap (2.4.41+dfsg-1ubuntu2) wily; urgency=medium
+
+  * SECURITY UPDATE: denial of service via crafted BER data
+    - debian/patches/CVE-2015-6908.patch: remove obsolete assert in
+      libraries/liblber/io.c.
+    - CVE-2015-6908
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 14 Sep 2015 10:25:04 -0400
+
+openldap (2.4.41+dfsg-1ubuntu1) wily; urgency=medium
+
+  * Merge from Debian testing (LP: #1471831). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+  * Dropped changes:
+    - Fix cpp calls for GCC 5: fixed upstream (ITS#8056)
+  * Upstream fixes:
+    - slapd crash with auditlog overlay and large (~27KB) attribute values
+      (ITS#8003) (LP: #1461276)
+    - nssov updated to support recent nss-pam-ldapd client libraries
+      (ITS#8097) (LP: #1393306)
+  * Update d/patches/nssov-build for upstream changes.
+  * Tweak d/patches/gssapi.diff to apply without fuzz.
+  * d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+    - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+    - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Ryan Tandy <[e-mail]>  Fri, 24 Jul 2015 14:12:06 -0700
+
 openldap (2.4.41+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -487,6 +1473,62 @@ openldap (2.4.40+dfsg-2) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 28 Jun 2015 20:40:37 -0700
 
+openldap (2.4.40+dfsg-1ubuntu2) wily; urgency=medium
+
+  * No-change rebuild for the libnettle6 transition.
+
+ -- Adam Conrad <[e-mail]>  Sun, 14 Jun 2015 03:58:30 -0600
+
+openldap (2.4.40+dfsg-1ubuntu1) wily; urgency=low
+
+  * Merge from Debian testing (LP: #1395098, LP: #1316124). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+  * Drop patches included upstream:
+    - d/patches/0001-ITS-7430-GnuTLS-Avoid-use-of-deprecated-function.patch
+    - d/patches/bdb-deadlock.patch
+    - d/patches/its-7354-fix-delta-sync-mmr.diff
+  * Drop hardening-wrapper as Debian now sets PIE and bindnow flags.
+  * debian/patches/nssov-build: Adjust for upstream changes.
+  * debian/apparmor-profile:
+    - Change 'r' to 'rw' for ldapi and nslcd sockets, required for apparmor
+      kernel ABI v7 (utopic and later). (LP: #1392018)
+    - Reduce permissions on /run/nslcd to just the nslcd socket.
+  * Enable the mdb backend again on ppc64el, fixed upstream in ITS#7713.
+    (LP: #1293250)
+
+ -- Ryan Tandy <[e-mail]>  Mon, 25 May 2015 19:49:21 -0700
+
 openldap (2.4.40+dfsg-1) unstable; urgency=medium
 
   * Remove inetorgperson.schema from the upstream source. Replace it with a
@@ -675,6 +1717,187 @@ openldap (2.4.39-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Mon, 17 Mar 2014 15:27:31 -0700
 
+openldap (2.4.31-1+nmu2ubuntu12) vivid; urgency=medium
+
+  * Fix cpp calls for GCC 5.
+
+ -- Matthias Klose <[e-mail]>  Fri, 06 Mar 2015 13:23:29 +0100
+
+openldap (2.4.31-1+nmu2ubuntu11) utopic; urgency=medium
+
+  * debian/apparmor-profile:
+    - allow p11-kit abstraction
+    - allow read of /etc/gss/mech.d/*
+
+ -- Jamie Strandboge <[e-mail]>  Tue, 02 Sep 2014 15:29:05 -0500
+
+openldap (2.4.31-1+nmu2ubuntu10) utopic; urgency=medium
+
+  * Rebuild for Perl 5.20.0.
+
+ -- Colin Watson <[e-mail]>  Thu, 21 Aug 2014 13:29:20 +0100
+
+openldap (2.4.31-1+nmu2ubuntu9) utopic; urgency=medium
+
+  * Cherry-pick upstream patch for compat with recent GNUTLS.
+  * Build-depend on libgnutls28-dev.
+  * Build-depend on libgcrypt20-dev.
+
+ -- Dimitri John Ledkov <[e-mail]>  Fri, 08 Aug 2014 11:01:56 +0100
+
+openldap (2.4.31-1+nmu2ubuntu8) trusty; urgency=medium
+
+  * Bump database_format_changed value to 2.4.31-1+nmu2ubuntu5 for db5.3.
+
+ -- Adam Conrad <[e-mail]>  Mon, 17 Mar 2014 12:50:18 -0600
+
+openldap (2.4.31-1+nmu2ubuntu7) trusty; urgency=medium
+
+  * Disable mdb backend on ppc64el due to test-suite failures.
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 17 Mar 2014 16:32:29 +0000
+
+openldap (2.4.31-1+nmu2ubuntu6) trusty; urgency=low
+
+  * Fix segfault issue with master-master syncrepl (LP: #1287730):
+    - d/patches/its-7354-fix-delta-sync-mmr.diff: Cherry picked
+      patch from upstream VCS.
+
+ -- Pierre Fersing <[e-mail]>  Tue, 04 Mar 2014 16:04:57 +0100
+
+openldap (2.4.31-1+nmu2ubuntu5) trusty; urgency=low
+
+  * Build-depend on libdb5.3-dev, instead of libdb5.1-dev.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Mon, 04 Nov 2013 08:04:30 +0000
+
+openldap (2.4.31-1+nmu2ubuntu4) trusty; urgency=low
+
+  * Rebuild for Perl 5.18.
+
+ -- Colin Watson <[e-mail]>  Tue, 22 Oct 2013 12:16:39 +0100
+
+openldap (2.4.31-1+nmu2ubuntu3) saucy; urgency=low
+
+  * Update build/config.guess and build/config.sub at build time; this was
+    not done automatically because the top-level configure.in does not use
+    Automake.
+
+ -- Colin Watson <[e-mail]>  Tue, 08 Oct 2013 17:24:59 +0100
+
+openldap (2.4.31-1+nmu2ubuntu2) saucy; urgency=low
+
+  * debian/control: added lsb-release
+  * debian/patches/fix-ldap-distribution.patch: show distribution in version
+
+ -- Yolanda Robla <[e-mail]>  Mon, 08 Jul 2013 16:53:09 +0200
+
+openldap (2.4.31-1+nmu2ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+      - d/slapd.dirs: add etc/apparmor.d/force-complain
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added libkrb5-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,/rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common: 
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - d/{control,rules}: enable PIE hardening
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 30 May 2013 13:03:25 -0400
+
+openldap (2.4.31-1+nmu2) unstable; urgency=high
+
+  * Non-maintainer upload.
+  * No-change rebuild in a clean environment
+
+ -- Jonathan Wiltshire <[e-mail]>  Tue, 23 Apr 2013 13:10:00 +0100
+
+openldap (2.4.31-1+nmu1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Avoid deadlocks in back-bdb that truncate slapcat output (closes: #673038).
+
+ -- Michael Gilbert <[e-mail]>  Tue, 16 Apr 2013 03:35:31 +0000
+
+openldap (2.4.31-1ubuntu2) quantal-proposed; urgency=low
+
+  * debian/slapd.py: Add AppArmor info and logs to apport hook.
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 20 Aug 2012 08:46:02 -0400
+
+openldap (2.4.31-1ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+      - d/slapd.dirs: add etc/apparmor.d/force-complain
+    - Enable GSSAPI support (LP: #495418):
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added libkrb5-dev as a build depend
+    - Enable ufw support (LP: #423246):
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay (LP: #675391):
+      - d/{patches/nssov-build,/rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook. (LP: #610544)
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common: 
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open (LP: #390579)
+    - d/{control,rules}: enable PIE hardening
+  * Dropped changes:
+    - d/patches/its-7107-fix-Operation-init-on-reuse.diff: Included in upstream release.
+    - d/patches/CVE-2011-4079: Included in upstream release.
+    - d/patches/service-operational-before-detach: Included in upstream release.
+    - d/schema/extra/misc.ldif: Included upstream.
+    - d/{rules,schema/extra}: Fix configure and clean rules to support
+      extra schemas shipped as part of the debian/schema/ directory; no longer required.
+    - Included in Debian:
+      + Document cn=config in README file.
+      + Install a default DIT; actually a minimal configuration.
+      + d/patches/heimdal-fix.
+  * General tidy of d/patches to remove obsolete patches being held in Ubuntu delta.
+
+ -- James Page <[e-mail]>  Fri, 20 Jul 2012 13:48:32 +0100
+
 openldap (2.4.31-1) unstable; urgency=low
 
   * New upstream release.
@@ -701,6 +1924,121 @@ openldap (2.4.31-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Wed, 27 Jun 2012 03:27:34 +0000
 
+openldap (2.4.28-1.1ubuntu6) quantal; urgency=low
+
+  * Fix issue with intermittent connection issues when using LDAPv3
+    protocol (LP: #1023025):
+    - d/patches/its-7107-fix-Operation-init-on-reuse.diff: Cherry picked
+      patch from upstream VCS which ensures objects are initialized before
+      re-use.
+
+ -- Pierre Fersing <[e-mail]>  Thu, 19 Jul 2012 14:05:09 +0100
+
+openldap (2.4.28-1.1ubuntu5) quantal; urgency=low
+
+  * debian/rules: Add smbk5pwd build.
+  * debian/control: Add slapd-smbk5pwd binary package.
+  * debian/patches/heimdal-fix: adapt parameters of 
+    hdb_generate_key_set_password() to heimdal 1.6~git20120311
+    (patch from Debian #664930).
+
+ -- Jorge Salamero Sanz <[e-mail]>  Wed, 18 Jul 2012 09:30:28 -0400
+
+openldap (2.4.28-1.1ubuntu4) precise; urgency=low
+
+  * debian/control: Build-Depends on dh-apparmor (LP: #948481)
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 05 Apr 2012 09:34:37 -0500
+
+openldap (2.4.28-1.1ubuntu3) precise; urgency=low
+
+  * Add its-7176-only-poll-sockets-for-write-as-needed.diff
+    (LP: #932823).
+
+ -- Timo Aaltonen <[e-mail]>  Tue, 21 Feb 2012 15:36:29 +0200
+
+openldap (2.4.28-1.1ubuntu2) precise; urgency=low
+
+  * Remove debian/patches/CVE-2011-4079; it's already in this upstream
+    version. Fixes FTBFS.
+
+ -- Daniel T Chen <[e-mail]>  Wed, 25 Jan 2012 17:26:17 -0500
+
+openldap (2.4.28-1.1ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+     + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+       neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+      + debian/patches/CVE-2011-4079: fix off by one error in postalAddressNormalize()
+        (CVE-2011-4079)
+
+
+ -- Chuck Short <[e-mail]>  Mon, 23 Jan 2012 10:01:13 -0500
+
+openldap (2.4.28-1.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Disable the mdb backend on non-Linux, it looks like it doesn't work with
+    linuxthreads (closes: #654824).
+
+ -- Julien Cristau <[e-mail]>  Mon, 16 Jan 2012 19:45:42 +0100
+
 openldap (2.4.28-1) unstable; urgency=low
 
   * New upstream release.
@@ -728,6 +2066,72 @@ openldap (2.4.28-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Thu, 05 Jan 2012 06:07:11 +0000
 
+openldap (2.4.25-4ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+     + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+       neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+      + debian/patches/CVE-2011-4079: fix off by one error in postalAddressNormalize()
+        (CVE-2011-4079)
+
+ -- Chuck Short <[e-mail]>  Tue, 22 Nov 2011 06:17:49 +0000
+
 openldap (2.4.25-4) unstable; urgency=low
 
   * Drop explicit depends on libdb4.8, since we're now linking against
@@ -761,6 +2165,85 @@ openldap (2.4.25-4) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 18 Oct 2011 01:08:34 +0000
 
+openldap (2.4.25-3ubuntu3) precise; urgency=low
+
+  * Rebuild for Perl 5.14.
+
+ -- Colin Watson <[e-mail]>  Tue, 15 Nov 2011 20:50:09 +0000
+
+openldap (2.4.25-3ubuntu2) precise; urgency=low
+
+  * SECURITY UPDATE: potential denial of service (LP: #884163)
+    - debian/patches/CVE-2011-4079: fix off by one error in
+      postalAddressNormalize()
+    - CVE-2011-4079
+
+ -- Jamie Strandboge <[e-mail]>  Mon, 14 Nov 2011 13:59:56 -0600
+
+openldap (2.4.25-3ubuntu1) precise; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+     + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+       neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+
+ -- Chuck Short <[e-mail]>  Wed, 19 Oct 2011 20:53:08 +0000
+
 openldap (2.4.25-3) unstable; urgency=low
 
   * Brown paper bag: really fix the .links.in handling, so we don't generate
@@ -783,6 +2266,92 @@ openldap (2.4.25-2) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Sun, 14 Aug 2011 23:17:09 -0700
 
+openldap (2.4.25-1.1ubuntu4) oneiric; urgency=low
+
+  * Brown paper bag: really fix the .links.in handling, so we don't generate
+    broken /usr/lib/${DEB_HOST_MULTIARCH} dirs.
+
+ -- Steve Langasek <[e-mail]>  Mon, 15 Aug 2011 09:43:29 +0000
+
+openldap (2.4.25-1.1ubuntu3) oneiric; urgency=low
+
+  * Cherry-pick multiarch support from Debian (LP: #826601):
+    - Bump to compat level 7, so we don't have to spell out debian/tmp in
+      every single .install file
+    - Build for multiarch.
+
+ -- Steve Langasek <[e-mail]>  Mon, 15 Aug 2011 02:23:43 -0700
+
+openldap (2.4.25-1.1ubuntu2) oneiric; urgency=low
+
+  * debian/apparmor-profile: Allow /var/run and /run. (LP: #810270)
+
+ -- Martin Pitt <[e-mail]>  Thu, 14 Jul 2011 15:18:02 +0200
+
+openldap (2.4.25-1.1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+      + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+        neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+
+ -- Chuck Short <[e-mail]>  Sun, 05 Jun 2011 17:38:40 +0100
+
 openldap (2.4.25-1.1) unstable; urgency=low
 
   * Non-maintainer upload to fix RC bug.
@@ -790,6 +2359,75 @@ openldap (2.4.25-1.1) unstable; urgency=low
 
  -- Thijs Kinkhorst <[e-mail]>  Tue, 31 May 2011 11:57:29 +0200
 
+openldap (2.4.25-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+      + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+        neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+       + Dropped:
+         - debian/patches/gold: Use the debian version instead
+         - debian/patches/CVE-2011-1024: Fixed upstream
+         - debian/patches/CVE-2011-1025: Fixed upstream
+         - debian/patches/CVE-2011-1081: Fixed upstream 
+
+ -- Chuck Short <[e-mail]>  Sun, 08 May 2011 16:34:09 +0100
+
 openldap (2.4.25-1) unstable; urgency=low
 
   * New upstream version (Closes: #617606, #618904, #606815, #608813)
@@ -821,6 +2459,116 @@ openldap (2.4.23-7) unstable; urgency=low
 
  -- Matthijs Mohlmann <[e-mail]>  Sat, 06 Nov 2010 12:13:01 +0100
 
+openldap (2.4.23-6ubuntu7) oneiric; urgency=low
+
+  * Rebuild for Perl 5.12.
+
+ -- Colin Watson <[e-mail]>  Sun, 08 May 2011 13:40:28 +0100
+
+openldap (2.4.23-6ubuntu6) natty; urgency=low
+
+  * SECURITY UPDATE: fix successful anonymous bind via chain overlay when
+    using forwarded authentication failures
+    - debian/patches/CVE-2011-1024
+    - CVE-2011-1024
+  * SECURITY UPDATE: verify password when authenticating to rootdn and using ndb
+    backend. Note: Ubuntu is not compiled with --enable-ndb by default
+    - debian/patches/CVE-2011-1025
+    - CVE-2011-1025
+  * SECURITY UPDATE: fix DoS when processing unauthenticated modrdn requests
+    and requestDN is empty
+    - debian/patches/CVE-2011-1081
+    - CVE-2011-1081
+    - LP: #742104
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 07 Apr 2011 11:36:53 -0500
+
+openldap (2.4.23-6ubuntu5) natty; urgency=low
+
+  * debian/patches/service-operational-before-detach: New patch replacing
+    old one of same name as previous could cause database corruption, 
+    based on upstream commits. (LP: #727973)
+
+ -- Dave Walker (Daviey) <[e-mail]>  Wed, 02 Mar 2011 20:33:08 +0000
+
+openldap (2.4.23-6ubuntu4) natty; urgency=low
+
+  * Fix FTBFS with ld.gold.
+
+ -- Matthias Klose <[e-mail]>  Wed, 19 Jan 2011 07:39:49 +0100
+
+openldap (2.4.23-6ubuntu3) natty; urgency=low
+
+  * debian/patches/gssapi.diff:
+    Update patch so that likewise-open is usable again (LP: #661547)
+
+ -- Thierry Carrez (ttx) <[e-mail]>  Fri, 26 Nov 2010 15:50:11 +0100
+
+openldap (2.4.23-6ubuntu2) natty; urgency=low
+
+  * Install nss overlay (LP: #675391):
+    - debian/rules: run install target for nssov module.
+    - debian/patches/nssov-build: fix patch to install schema in
+      /etc/ldap/schema.
+
+ -- Mathias Gug <[e-mail]>  Wed, 17 Nov 2010 18:16:42 -0500
+
+openldap (2.4.23-6ubuntu1) natty; urgency=low
+
+  * Merge from Debian unstable:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+      + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+        neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+
+ -- Mathias Gug <[e-mail]>  Fri, 12 Nov 2010 15:19:07 -0500
+
 openldap (2.4.23-6) unstable; urgency=high
 
   * Check for an empty directory to prevent an rm -f /*. (Closes: #597704)
@@ -943,6 +2691,80 @@ openldap (2.4.23-1) unstable; urgency=low
 
  -- Matthijs Mohlmann <[e-mail]>  Mon, 12 Jul 2010 13:25:00 +0200
 
+openldap (2.4.23-0ubuntu4) natty; urgency=low
+
+  * debian/slapd.templates: amended typo in slapd/move_old_database 
+    (LP: #666028)
+
+ -- James Page <[e-mail]>  Mon, 08 Nov 2010 10:00:58 +0000
+
+openldap (2.4.23-0ubuntu3.2) maverick-proposed; urgency=low
+
+  * debian/slapd.templates: re-add slapd/move_old_database template as it's
+    used during the package upgrade. Thanks to James Page for pointing it.
+  * debian/slapd.config: restore debconf question slapd/move_old_database.
+
+ -- Mathias Gug <[e-mail]>  Thu, 14 Oct 2010 16:56:38 -0400
+
+openldap (2.4.23-0ubuntu3.1) maverick-proposed; urgency=low
+
+  [ James Page ]
+  * Fixed install/upgrade process to dump/restore databases due 
+    to uplift to libdb4.8-dev (LP: #658227)   
+
+ -- Mathias Gug <[e-mail]>  Thu, 14 Oct 2010 14:50:49 -0400
+
+openldap (2.4.23-0ubuntu3) maverick; urgency=low
+
+  * debian/rules: move dh_apparmor before dh_installinit
+
+ -- Jamie Strandboge <[e-mail]>  Fri, 06 Aug 2010 17:34:21 -0500
+
+openldap (2.4.23-0ubuntu2) maverick; urgency=low
+
+  * convert to using dh_apparmor:
+    - debian/rules, debian/slapd.post{inst,rm}: use dh_apparmor
+    - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+  * debian/apparmor-profile: use local include
+
+ -- Jamie Strandboge <[e-mail]>  Fri, 06 Aug 2010 15:08:55 -0500
+
+openldap (2.4.23-0ubuntu1) maverick; urgency=low
+
+  * New release, features include:
+    + Fixed libldap to return server's error code (ITS#6569)
+    + Fixed libldap memleaks (ITS#6568)
+    + Fixed liblutil off-by-one with delta (ITS#6541)
+    + Fixed slapd acls with glued databases (ITS#6468)
+    + Fixed slapd syncrepl rid logging (ITS#6533)
+    + Fixed slapd modrdn handling of invalid values (ITS#6570)
+    + Fixed slapd-bdb hasSubordinates computation (ITS#6549)
+    + Fixed slapd-bdb to use memcpy instead for strcpy (ITS#6474)
+    + Fixed slapd-bdb entry cache delete failure (ITS#6577)
+    + Fixed slapd-ldap to return control responses (ITS#6530)
+    + Fixed slapo-ppolicy to use Debug (ITS#6566)
+    + Fixed slapo-refint to zero out freed DN vals (ITS#6572)
+    + Fixed slapo-rwm to use Debug (ITS#6566)
+    + Fixed slapo-sssvlv to use Debug (ITS#6566)
+    + Fixed slapo-syncprov lost deletes in refresh phase (ITS#6555)
+    + Fixed slapo-valsort to use Debug (ITS#6566)
+    + Fixed contrib/nssov network.c missing patch (ITS#6562)
+    + Fixed test043 attribute sorting (ITS#6553)
+    + slapd-config(5) note default rootdn (ITS#6546)
+  * Rebased patches debian/patches/dropped nssov-build
+  * Resynchronize with Debian:
+    + debian/control:
+      - Bump standards-version to 3.9.0
+      - Use libdb4.8-dev (LP: #572489)
+    + Added debian/patches/issue-6534-patch
+    + Added debian/patches/ldap-conf-tls-cacertdir
+  * Add ufw support, thanks to  PatRiehecky (LP: #423246)
+
+   [Adam Sommer]
+   * debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+
+ -- Chuck Short <[e-mail]>  Wed, 28 Jul 2010 11:35:16 -0400
+
 openldap (2.4.21-1) unstable; urgency=low
 
   [ Steve Langasek ]
@@ -974,6 +2796,79 @@ openldap (2.4.21-1) unstable; urgency=low
 
  -- Matthijs Mohlmann <[e-mail]>  Thu, 22 Apr 2010 23:40:30 +0200
 
+openldap (2.4.21-0ubuntu5) lucid; urgency=low
+
+  * Fix local root connection access: replace olcAuthzRegexp mapping to
+    cn=localroot,cn=config with using the SASL dn directly in olcAccess.
+    Makes upgrades much simpler and robust (LP: #563829).
+
+ -- Mathias Gug <[e-mail]>  Fri, 23 Apr 2010 00:23:31 -0400
+
+openldap (2.4.21-0ubuntu4) lucid; urgency=low
+
+  [ Simon Olofsson ]
+  * debian/slapd.postinst:
+    - Show a message after successful migration (LP: #538848)
+
+  [ Jorgen Rosink ]
+  * debian/slapd.init: add simple status checking with LSB compatible exit
+    codes (LP: #562377)
+  * debian/slapd.init.ldif:
+    - remove admin user in default config database (LP: #556176)
+    - in default config, add olcAccess entries giving access to controls
+      available and cn=subschema (LP: #427842)
+
+  [ Scott Moser ]
+  *  debian/slapd.scripts-common: Do not create /nonexistent directory
+     for openldap user's home (LP: #556176)
+  *  debian/slapd.postinst: fix cn=config olcAccess migration (LP: #559070)
+
+ -- Scott Moser <[e-mail]>  Mon, 12 Apr 2010 16:16:47 -0400
+
+openldap (2.4.21-0ubuntu3) lucid; urgency=low
+
+  * debian/slapd.postinst, debian/slapd.scripts-common: Upgrade databases
+    before trying to convert to slapd.d, to avoid upgrade failure from hardy
+    (LP: #536958)
+  * debian/slapd.postinst: Add a {1} numeric index to olcAccess entry in
+    olcDatabase={0}config.ldif to avoid upgrade failures (LP: #538516, #526230)
+
+ -- Thierry Carrez <[e-mail]>  Mon, 29 Mar 2010 13:31:47 +0200
+
+openldap (2.4.21-0ubuntu2) lucid; urgency=low
+
+  * debian/apparmor-profile: Update apparmor profile. (LP: #508190) 
+
+ -- Chuck Short <[e-mail]>  Tue, 09 Mar 2010 13:33:35 -0500
+
+openldap (2.4.21-0ubuntu1) lucid; urgency=low
+
+  * New upstream release.
+  * debian/rules, debian/schema/extra/: 
+    Fix get-orig-source rule to supports extra schemas shipped as part of the
+    debian/schema/ directory.
+
+ -- Mathias Gug <[e-mail]>  Thu, 18 Feb 2010 00:58:13 -0500
+
+openldap (2.4.18-0ubuntu2) lucid; urgency=low
+
+  * debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+    - Add --with-gssapi support
+    - Make guess_service_principal() more robust when determining principal
+  * Enable GSSAPI support (LP: #495418):
+    - debian/configure.options: Configure with --with-gssapi
+    - debian/control: Added libkrb5-dev as a build depend
+
+ -- Thierry Carrez <[e-mail]>  Fri, 11 Dec 2009 11:31:11 +0100
+
+openldap (2.4.18-0ubuntu1) karmic; urgency=low
+
+  * New upstream release: (LP: #419515):
+    + pcache overlay supports disconnected mode.
+  * Fix nss overlay load (LP: #417163).
+
+ -- Mathias Gug <[e-mail]>  Mon, 07 Sep 2009 13:41:10 -0400
+
 openldap (2.4.17-2.1) unstable; urgency=high
 
   * Non-maintainer upload by the Security Team.
@@ -1000,6 +2895,108 @@ openldap (2.4.17-2) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 22 Sep 2009 20:06:34 -0700
 
+openldap (2.4.17-1ubuntu3) karmic; urgency=low
+
+   * Install a minimal slapd configuration instead of creating a default
+     database with a default DIT:
+     + Move openldap user home from /var/lib/ldap to /nonexistent.
+     + Remove all code and templates dealing with the default database and DIT
+       creation.
+     + Add an Authz map from root user (UID=0) to cn=localroot,cn=config and
+       grant all access to the latter in the cn=config database as well as the
+       default backend configuration.
+   * Add cn=localroot,cn=config authz mapping on upgrades.
+
+ -- Mathias Gug <[e-mail]>  Tue, 11 Aug 2009 14:48:56 -0400
+
+openldap (2.4.17-1ubuntu2) karmic; urgency=low
+
+  [ Thierry Carrez ]
+  * debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+    in the openldap library, as required by Likewise-Open (LP: #390579)
+
+  [ Mathias Gug ]
+  * debian/patches/its6077-uniqueness-overlay: fixes some issues with the
+    uniqueness overlay.
+  * debian/patches/its6220-writetimeout-directive: fixes a problem with the
+    writetimeout directive being in effect even if it wasn't set, 
+    closing connections incorrectly.
+  * debian/patches/its6222-dncachesize-parameter: fixes the behavior of the
+    dncachesize parameter that was added in RE24, so that if it is set to 
+    "0" (now the default), it has an unlimited DN cache (RE23 always 
+    had an unlimited DN cache).
+
+ -- Mathias Gug <[e-mail]>  Fri, 31 Jul 2009 13:43:46 -0400
+
+openldap (2.4.17-1ubuntu1) karmic; urgency=low
+  
+  [ Steve Langasek ]
+  * Fix up the lintian warnings:
+    - add missing misc-depends on all packages
+    - slapd, libldap-2.4-2-dbg sections changed to 'debug' to match archive
+      overrides
+    - bump Standards-Version to 3.8.2, no changes required.
+
+  [ Mathias Gug ]
+  * Resynchronise with Debian. Remaining changes:
+    - AppArmor support:
+      - debian/apparmor-profile: add AppArmor profile
+      - updated debian/slapd.README.Debian for note on AppArmor
+      - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      - debian/slapd.postrm: remove symlink in force-complain/ on purge
+      - debian/rules: install apparmor profile.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct
+      ownership and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group
+      readable) and /var/run/slapd (world readable).
+    - Enable nssoverlay:
+      - debian/patches/nssov-build, debian/rules: Build and package the nss
+        overlay.
+      - debian/schema/misc.ldif: add ldif file for the misc schema which
+        defines rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of
+      slapd.conf. Migrate slapd.conf file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to
+      the cn=config tree.
+    - debian/slapd.postinst: create /var/run/slapd before updating its
+      permissions.
+    - debian/slapd.init: Correctly set slapd config backend option even if
+      the pidfile is configured in slapd default file.
+  * Dropped:
+    - Merged in Debian:
+      - Update priority of libldap-2.4-2 to match the archive override.
+      - Add the missing ldapexop and ldapurl tools to ldap-utils, as well as
+        the ldapurl(1) manpage.
+      - Bump build-dependency on debhelper to 6 instead of 5, since that's
+        what we're using.
+      - Set the default SLAPD_SERVICES to ldap:/// ldapi:///, instead of using
+        the built-in default of ldap:/// only.
+    - Fixed in upstream release:
+      - debian/patches/fix-ldap_back_entry_get_rwa.patch: fix test-0034
+        failure when built with PIE.
+      - debian/patches/gnutls-enable-v1-ca-certs: Enable V1 CA certs to be
+        trusted.
+    - Update Apparmor profile support: don't support upgrade from pre-hardy
+      systems:
+      - debian/slapd.postinst: Reload AA profile on configuration
+      - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+      - debian/control: Conflicts with apparmor-profiles <<
+        2.1+1075-0ubuntu4 to make sure that if earlier version of
+        apparmor-profiles gets installed it won't overwrite our profile.
+      - follow ApparmorProfileMigration and force apparmor complain mode on
+        some upgrades
+      - debian/slapd.preinst: create symlink for force-complain on
+        pre-feisty upgrades, upgrades where apparmor-profiles profile is
+        unchanged (ie non-enforcing) and upgrades where apparmor profile
+        does not exist.
+    - debian/patches/autogen.sh: no longer needed with karmic libtool.
+      - Call libtoolize with the --install option to install
+        config.{guess,sub} files.
+
+ -- Mathias Gug <[e-mail]>  Thu, 30 Jul 2009 16:42:58 -0400
+
 openldap (2.4.17-1) unstable; urgency=low
 
   * New upstream version.
@@ -1022,6 +3019,153 @@ openldap (2.4.17-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 28 Jul 2009 10:17:15 -0700
 
+openldap (2.4.15-1.1ubuntu1) karmic; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - AppArmor support:
+      - debian/apparmor-profile: add AppArmor profile
+      - debian/slapd.postinst: Reload AA profile on configuration
+      - updated debian/slapd.README.Debian for note on AppArmor
+      - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+      - debian/control: Conflicts with apparmor-profiles <<
+        2.1+1075-0ubuntu4 to make sure that if earlier version of
+        apparmor-profiles gets installed it won't overwrite our profile.
+      - follow ApparmorProfileMigration and force apparmor complain mode on
+        some upgrades
+      - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      - debian/slapd.preinst: create symlink for force-complain on
+        pre-feisty upgrades, upgrades where apparmor-profiles profile is
+        unchanged (ie non-enforcing) and upgrades where apparmor profile
+        does not exist.
+      - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/autogen.sh:
+      - Call libtoolize with the --install option to install
+        config.{guess,sub} files.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct
+      ownership and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group
+      readable) and /var/run/slapd (world readable).
+    - Enable nssoverlay:
+      - debian/patches/nssov-build, debian/rules: Build and package the nss
+        overlay.
+      - debian/schema/misc.ldif: add ldif file for the misc schema which
+        defines rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of
+      slapd.conf. Migrate slapd.conf file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to
+      the cn=config tree.
+    - Update priority of libldap-2.4-2 to match the archive override.
+    - Add the missing ldapexop and ldapurl tools to ldap-utils, as well as
+      the ldapurl(1) manpage.
+    - Bump build-dependency on debhelper to 6 instead of 5, since that's
+      what we're using.
+    - Set the default SLAPD_SERVICES to ldap:/// ldapi:///, instead of using
+      the built-in default of ldap:/// only.
+    - debian/patches/fix-ldap_back_entry_get_rwa.patch: fix test-0034
+      failure when built with PIE.
+    - debian/patches/gnutls-enable-v1-ca-certs: Enable V1 CA certs to be
+      trusted.
+    - debian/slapd.postinst: create /var/run/slapd before updating its
+      permissions.
+    - debian/slapd.init: Correctly set slapd config backend option even if
+      the pidfile is configured in slapd default file.
+  * Drop patch to avoid the test suite on hppa, as hppa is EOL.
+
+ -- Colin Watson <[e-mail]>  Wed, 24 Jun 2009 10:45:20 +0100
+
+openldap (2.4.15-1.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Change libltdl3-dev Build-Depends to libltdl-dev | libltdl3-dev
+    (Closes: #522965)
+
+ -- Kurt Roeckx <[e-mail]>  Sun, 19 Apr 2009 18:24:32 +0200
+
+openldap (2.4.15-1ubuntu3) jaunty; urgency=low
+
+  * No-change rebuild to fix lpia shared library dependencies.
+
+ -- Colin Watson <[e-mail]>  Thu, 19 Mar 2009 09:52:40 +0000
+
+openldap (2.4.15-1ubuntu2) jaunty; urgency=low
+
+  * debian/slapd.postinst: create /var/run/slapd before updating its
+    permissions (LP: #298928). 
+  * debian/slapd.init: Correclty set slapd config backend option even if the
+    pidfile is configured in slapd default file (LP: #292364).
+  * debian/apparmor-profile: support multiple databases to be stored under
+    /var/lib/ldap/. (LP: #286614).
+
+ -- Mathias Gug <[e-mail]>  Fri, 13 Mar 2009 13:56:12 -0400
+
+openldap (2.4.15-1ubuntu1) jaunty; urgency=low
+
+  [ Steve Langasek ]
+  * Update priority of libldap-2.4-2 to match the archive override.
+  * Add the missing ldapexop and ldapurl tools to ldap-utils, as well as the
+    ldapurl(1) manpage.  Thanks to Peter Marschall for the patch.
+    Closes: #496749.
+  * Bump build-dependency on debhelper to 6 instead of 5, since that's
+    what we're using.  Closes: #498116.
+  * Set the default SLAPD_SERVICES to ldap:/// ldapi:///, instead of using
+    the built-in default of ldap:/// only.
+
+  [ Mathias Gug ]
+  * Merge from debian unstable, remaining changes:
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - AppArmor support:
+      - debian/apparmor-profile: add AppArmor profile
+      - debian/slapd.postinst: Reload AA profile on configuration
+      - updated debian/slapd.README.Debian for note on AppArmor
+      - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+      - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+        to make sure that if earlier version of apparmour-profiles gets
+        installed it won't overwrite our profile.
+      - follow ApparmorProfileMigration and force apparmor compalin mode on 
+        some upgrades (LP: #203529)
+      - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+        upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+        non-enforcing) and upgrades where apparmor profile does not exist.
+      - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/control:
+      - Build-depend on libltdl7-dev rather then libltdl3-dev.
+    - debian/patches/autogen.sh:
+      - Call libtoolize with the --install option to install config.{guess,sub}
+        files.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash (LP: #286063).
+    - Disable the testsuite on hppa. Allows building of packages on this
+      architecture again, once this package is in the archive.
+      LP: #288908.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct ownership
+      and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group readable) and
+      /var/run/slapd (world readable). (LP: #257667).
+    - Enable nssoverlay:
+      - debian/patches/nssov-build, debian/rules: Build and package 
+        the nss overlay.
+      - debian/schema/misc.ldif: add ldif file for the misc schema
+        which defines rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of 
+      slapd.conf. Migrate slapd.conf  file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to the
+      cn=config tree.
+  * Dropped:
+    - debian/patches/corrupt-contextCSN: The contextCSN can get corrupted at
+      times. (ITS: #5947) Fixed in new upstream version 2.4.15.
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now. Implemented in Debian.
+  * debian/patches/fix-ldap_back_entry_get_rwa.patch: fix test-0034 failure
+    when built with PIE.
+  * debian/patches/gnutls-enable-v1-ca-certs: Enable V1 CA certs to be
+    trusted (LP: #305264).
+
+ -- Mathias Gug <[e-mail]>  Fri, 06 Mar 2009 17:34:21 -0500
+
 openldap (2.4.15-1) unstable; urgency=low
 
   * New upstream version
@@ -1039,6 +3183,69 @@ openldap (2.4.15-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 24 Feb 2009 14:27:35 -0800
 
+openldap (2.4.14-0ubuntu1) jaunty; urgency=low
+
+  [ Steve Langasek ]
+  * New upstream version
+    - Fixes a bug with the pcache overlay not returning cached entries
+      (closes: #497697)
+    - Update evolution-ntlm patch to apply to current Makefiles.
+    - (tentatively) drop gnutls-ciphers, since this bug was reported to be
+      fixed upstream in 2.4.8.  The fix applied in 2.4.8 didn't match the
+      patch from the bug report, so this should be watched for regressions.
+  * Build against db4.7 instead of db4.2 at last!  Closes: #421946.
+  * Build with --disable-ndb, to avoid a misbuild when libmysqlclient is
+    installed in the build environment.
+  * New patch, no-crlcheck-for-gnutls, to fix a build failure when using
+    --with-tls=gnutls.
+
+  [ Mathias Gug ]
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/control:
+      - Build-depend on libltdl7-dev rather then libltdl3-dev.
+    - debian/patches/autogen.sh:
+      - Call libtoolize with the --install option to install config.{guess,sub}
+        files.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash (LP: #286063).
+    - Disable the testsuite on hppa. Allows building of packages on this
+      architecture again, once this package is in the archive.
+      LP: #288908.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct ownership
+      and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group readable) and
+      /var/run/slapd (world readable). (LP: #257667).
+    - debian/patches/nssov-build, debian/rules: 
+      Build and package the nss overlay.
+      debian/schema/misc.ldif: add ldif file for the misc schema, which defines
+      rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of 
+      slapd.conf. Migrate slapd.conf  file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to the
+      cn=config tree.
+  * debian/patches/corrupt-contextCSN: The contextCSN can get corrupted at
+    times. (ITS: #5947)
+
+ -- Mathias Gug <[e-mail]>  Wed, 18 Feb 2009 18:44:00 -0500
+
 openldap (2.4.11-1) unstable; urgency=low
 
   * New upstream version (closes: #499560).
@@ -1061,6 +3268,110 @@ openldap (2.4.11-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Sat, 11 Oct 2008 01:53:55 -0700
 
+openldap (2.4.11-0ubuntu7) jaunty; urgency=low
+
+  * Don't use local statement in config script as it fails if /bin/sh
+    points to bash (LP: #286063).
+
+ -- Mathias Gug <[e-mail]>  Tue, 04 Nov 2008 20:03:46 -0500
+
+openldap (2.4.11-0ubuntu6) intrepid; urgency=low
+
+  * Disable the testsuite on hppa. Allows building of packages on this
+    architecture again, once this package is in the archive.
+    LP: #288908.
+
+ -- Matthias Klose <[e-mail]>  Fri, 24 Oct 2008 23:22:33 +0200
+
+openldap (2.4.11-0ubuntu5) intrepid; urgency=low
+
+  * Don't set admin passwords in ldif files if adminpw is empty. 
+    (LP: #273988 - LP: #276606).  
+
+ -- Mathias Gug <[e-mail]>  Mon, 13 Oct 2008 19:31:15 -0400
+
+openldap (2.4.11-0ubuntu4) intrepid; urgency=low
+
+  * debian/slapd.postinst, debian/slapd.script-common: set correct ownership
+    and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group readable) and
+    /var/run/slapd (world readable). (LP: #257667).
+  * debian/slapd.script-common: 
+    - Fix package reconfiguration:
+      + Remove slapd.d/ directory if it already exists when creating a new 
+        configuration.
+      + Fix backup directory naming for multiple reconfiguration.
+
+ -- Mathias Gug <[e-mail]>  Wed, 24 Sep 2008 21:01:42 -0400
+
+openldap (2.4.11-0ubuntu3) intrepid; urgency=low
+
+  * debian/patches/nssov-build, debian/rules: 
+    Build and package the nss overlay.
+  * debian/schema/misc.ldif: add ldif file for the misc schema, which defines
+    rfc822MailMember (required by the nss overlay).
+
+ -- Mathias Gug <[e-mail]>  Tue, 26 Aug 2008 18:42:54 -0400
+
+openldap (2.4.11-0ubuntu2) intrepid; urgency=low
+
+  * debian/{control,rules}: enable PIE hardening
+
+ -- Kees Cook <[e-mail]>  Wed, 20 Aug 2008 15:47:01 -0700
+
+openldap (2.4.11-0ubuntu1) intrepid; urgency=low
+
+  * New upstream version:
+    - Mainly bug fixes.
+    - New nss slapd overlay (not compiled by default).
+  * Use cn=config as the default configuration backend instead of 
+    slapd.conf. Migrate slapd.conf  file to /etc/ldap/slapd.d/ on upgrade
+    asking the end user to enter a new password to control the access to the
+    cn=config tree.
+
+ -- Mathias Gug <[e-mail]>  Mon, 11 Aug 2008 20:26:05 -0400
+
+openldap (2.4.10-3ubuntu1) intrepid; urgency=low
+
+  [ Mathias Gug ]
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/patches/fix-unique-overlay-assertion.patch: 
+      Fix another assertion error in unique overlay (LP: #243337).
+      Backport from head.
+  * Dropped - implemented in Debian:
+    - debian/patches/fix-gnutls-key-strength.patch:
+      Fix slapd handling of ssf using gnutls. (LP: #244925).
+    - debian/control:
+      Add time as build dependency: needed by make test.
+  * debian/control:
+    - Build-depend on libltdl7-dev rather then libltdl3-dev.
+  * debian/patches/autogen.sh:
+    - Call libtoolize with the --install option to install config.{guess,sub}
+    files.
+
+  [ Jamie Strandboge ]
+  * adjust apparmor profile to allow gssapi (LP: #229252)
+  * adjust apparmor profile to allow cnconfig (LP: #243525) 
+
+ -- Mathias Gug <[e-mail]>  Wed, 30 Jul 2008 19:46:02 -0400
+
 openldap (2.4.10-3) unstable; urgency=low
 
   [ Steve Langasek ]
@@ -1094,6 +3405,40 @@ openldap (2.4.10-3) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Mon, 28 Jul 2008 15:26:06 -0700
 
+openldap (2.4.10-2ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/patches/fix-unique-overlay-assertion.patch: 
+      Fix another assertion error in unique overlay (LP: #243337).
+      Backport from head.
+    - debian/patches/fix-gnutls-key-strength.patch:
+      Fix slapd handling of ssf using gnutls. (LP: #244925).
+    - debian/control:
+      Add time as build dependency: needed by make test.
+  * Dropped - implemented in Debian:
+    - debian/rules:
+      Support debuild nocheck option: don't run tests if nocheck is set.
+
+ -- Mathias Gug <[e-mail]>  Thu, 10 Jul 2008 14:45:49 -0400
+
 openldap (2.4.10-2) unstable; urgency=low
 
   * Support DEB_BUILD_OPTIONS=nocheck to disable running the test suite at
@@ -1108,6 +3453,54 @@ openldap (2.4.10-2) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Sun, 06 Jul 2008 22:03:32 -0700
 
+openldap2.3 (2.4.10-1ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/patches/fix-unique-overlay-assertion.patch: 
+      Fix another assertion error in unique overlay (LP: #243337).
+      Backport from head.
+  * debian/control:
+    - add time as build dependency: needed by make test.
+  * debian/rules:
+    - support debuild nocheck option: don't run tests if nocheck is set.
+  * debian/patches/fix-gnutls-key-strength.patch:
+    - fix slapd handling of ssf using gnutls. (LP: #244925).
+  * Dropped - accepted in Debian:
+    - debian/rules, debian/slapd.links: use hard links to slapd instead of
+      symlinks for slap* so these applications aren't confined by apparmor
+      (LP: #203898)
+  * Dropped - fixed in new upstream release:
+    - debian/patches/fix-assertion-io.patch: Fixes ber_flush2 assertion. 
+      (LP: #215904)
+    - debian/patches/fix-dnpretty-assertion.patch: Fix dnPrettyNormal assertion
+      error. (LP: #234196)
+    - dropped debian/patches/fix-notify-crasher.patch: Fix modify timestamp crashes.
+      (LP: #220724)
+    - debian/patches/fix-syncrepl-oops: Fixes segmentation fault when using
+      syncrepl. (LP: #227178) 
+    - dropped debian/patches/SECURITY_CVE-2008-0658.patch. Already applied 
+      upstream.
+
+ -- Mathias Gug <[e-mail]>  Thu, 03 Jul 2008 14:15:08 -0400
+
 openldap2.3 (2.4.10-1) unstable; urgency=low
 
   [ Steve Langasek ]
@@ -1132,6 +3525,64 @@ openldap2.3 (2.4.10-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Mon, 30 Jun 2008 04:28:34 -0700
 
+openldap2.3 (2.4.9-1ubuntu4) intrepid; urgency=low
+
+  * debian/patches/fix-unique-overlay-assertion.patch: 
+    - Fix another assertion error in unique overlay, backported from head.
+      (LP: #243337) Note: This patch will still be needed when moved to 2.4.10 
+
+ -- Chuck Short <[e-mail]>  Mon, 30 Jun 2008 18:49:52 +0000
+
+openldap2.3 (2.4.9-1ubuntu3) intrepid; urgency=low
+
+  * Drop spurious dependency on hiemdal-dev. Caused by an aborted attempt to
+    include the smbk5pwd overlay.
+
+ -- Chuck Short <[e-mail]>  Wed, 11 Jun 2008 21:25:40 +0000
+
+openldap2.3 (2.4.9-1ubuntu2) intrepid; urgency=low
+
+  * Rebuild for perl 5.10 transition (LP: #230016)
+  * debian/patches/fix-syncrepl-oops: Fixes segmentation fault when using
+    syncrepl. (LP: #227178) 
+
+ -- Chuck Short <[e-mail]>  Mon, 09 Jun 2008 14:56:40 +0000
+
+openldap2.3 (2.4.9-1ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/rules, debian/slapd.links: use hard links to slapd instead of
+      symlinks for slap* so these applications aren't confined by apparmor
+      (LP: #203898)
+    - debian/patches/fix-assertion-io.patch: Fixes ber_flush2 assertion. 
+      (LP: #215904)
+    - debian/patches/fix-dnpretty-assertion.patch: Fix dnPrettyNormal assertion
+      error. (LP: #234196)
+    - dropped debian/patches/fix-notify-crasher.patch: Fix modify timestamp crashes.
+      (LP: #220724)
+    - dropped debian/patches/SECURITY_CVE-2008-0658.patch. Already applied 
+      upstream.
+   * Added debian/patches/fix-ucred-libc due to changes how newer glibc handle
+     the ucred struct now.
+
+ -- Chuck Short <[e-mail]>  Fri, 30 May 2008 17:09:53 +0100
+
 openldap2.3 (2.4.9-1) unstable; urgency=low
 
   [ Updated debconf translations ]
@@ -1202,6 +3653,51 @@ openldap2.3 (2.4.7-6.1) unstable; urgency=high
 
  -- Nico Golde <[e-mail]>  Tue, 04 Mar 2008 14:34:44 +0100
 
+openldap2.3 (2.4.7-6ubuntu3) hardy; urgency=low
+
+  * remove apparmor-profile workaround for Launchpad #202161 (it's now fixed
+    in klibc)
+
+ -- Jamie Strandboge <[e-mail]>  Mon, 07 Apr 2008 16:09:38 -0400
+
+openldap2.3 (2.4.7-6ubuntu2) hardy; urgency=low
+
+  * apparmor-profile workaround for Launchpad #202161 
+  * follow ApparmorProfileMigration and force apparmor complain mode on some
+    upgrades (LP: #203529)
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain/ on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+  * debian/rules, debian/slapd.links: use hard links to slapd instead of
+    symlinks for slap* so these applications aren't confined by apparmor
+    (LP: #203898)
+
+ -- Jamie Strandboge <[e-mail]>  Tue, 18 Mar 2008 13:53:23 -0400
+
+openldap2.3 (2.4.7-6ubuntu1) hardy; urgency=low
+
+  * Merge from Debian unstable, remaining changes:
+    + debian/patches/SECURITY_CVE-2008-0658.patch (LP: #197077)
+      slapd/back-bdb/modrdn.c in the BDB backend for slapd in OpenLDAP 2.3.39
+      allows remote authenticated users to cause a denial of service (daemon
+      crash) via a modrdn operation with a NOOP (LDAP_X_NO_OPERATION)
+      control, a related issue to CVE-2007-6698.
+    + debian/apparmor-profile: add AppArmor profile
+    + debian/slapd.postinst: Reload AA profile on configuration
+    + updated debian/slapd.README.Debian for note on AppArmor
+    + debian/control: Replaces apparmor-profiles << 2.1+1075-0ubuntu4 as we
+      should now take control
+    + debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmor-profiles gets
+      installed it won't overwrite our profile
+    + Modify Maintainer value to match the DebianMaintainerField
+      specification.
+
+ -- Steve Langasek <[e-mail]>  Tue, 04 Mar 2008 01:59:51 +0000
+
 openldap2.3 (2.4.7-6) unstable; urgency=low
 
   [ Updated debconf translations ]
@@ -1247,6 +3743,37 @@ openldap2.3 (2.4.7-6) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Thu, 28 Feb 2008 22:15:17 -0800
 
+openldap2.3 (2.4.7-5ubuntu2) hardy; urgency=low
+
+  * SECURITY UPDATE: 
+   + debian/patches/SECURITY_CVE-2008-0658.patch (LP: #197077)
+     slapd/back-bdb/modrdn.c in the BDB backend for slapd in OpenLDAP 2.3.39 
+     allows remote authenticated users to cause a denial of service (daemon crash) 
+     via a modrdn operation with a NOOP (LDAP_X_NO_OPERATION) control, a related 
+     issue to CVE-2007-6698.
+
+  * References
+   - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2008-0658
+   - http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5358
+
+ -- Emanuele Gentili <[e-mail]>  Sun, 02 Mar 2008 16:34:30 +0100
+
+openldap2.3 (2.4.7-5ubuntu1) hardy; urgency=low
+
+  * add AppArmor profile
+    + debian/apparmor-profile
+    + debian/slapd.postinst: Reload AA profile on configuration
+  * updated debian/slapd.README.Debian for note on AppArmor
+  * debian/control: Replaces apparmor-profiles << 2.1+1075-0ubuntu4 as we
+    should now take control
+  * debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+    to make sure that if earlier version of apparmor-profiles gets installed
+    it won't overwrite our profile
+  * Modify Maintainer value to match the DebianMaintainerField
+    specification.
+
+ -- Jamie Strandboge <[e-mail]>  Wed, 13 Feb 2008 17:15:41 +0000
+
 openldap2.3 (2.4.7-5) unstable; urgency=low
 
   [ Updated debconf translations ]
diff --git a/debian/configure.options b/debian/configure.options
index 08a55e0..9d3704e 100644
--- a/debian/configure.options
+++ b/debian/configure.options
@@ -175,6 +175,7 @@
 #  --with-fetch		  with fetch(3) URL support [auto]
 #  --with-threads	  with threads [auto]
 --with-threads
+--with-gssapi
 #  --with-tls		  with TLS/SSL support auto|openssl|gnutls|moznss [auto]
 --with-tls=gnutls
 #  --with-yielding-select  with implicitly yielding select [auto]
diff --git a/debian/control b/debian/control
index fa7c8a1..f8060d2 100644
--- a/debian/control
+++ b/debian/control
@@ -1,14 +1,16 @@
 Source: openldap
 Section: net
 Priority: optional
-Maintainer: Debian OpenLDAP Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian OpenLDAP Maintainers <[e-mail]>
 Uploaders: Steve Langasek <[e-mail]>,
  Torsten Landschoff <[e-mail]>,
  Ryan Tandy <[e-mail]>
 Build-Depends: debhelper (>= 10),
+               dh-apparmor,
                dpkg-dev (>= 1.17.14),
                groff-base,
-               heimdal-multidev (>= 7.4.0.dfsg.1-1~) <!pkg.openldap.noslapd>,
+               heimdal-dev (>= 7.4.0.dfsg.1-1~) <!pkg.openldap.noslapd>,
                libargon2-dev <!pkg.openldap.noslapd>,
                libdb5.3-dev <!pkg.openldap.noslapd>,
                libgnutls28-dev,
@@ -35,7 +37,7 @@ Depends: ${shlibs:Depends}, libldap-2.4-2 (= ${binary:Version}),
  coreutils (>= 4.5.1-1), psmisc, perl:any (>> 5.8.0) | libmime-base64-perl,
  adduser, lsb-base (>= 3.2-13), ${perl:Depends}, ${misc:Depends}
 Recommends: libsasl2-modules
-Suggests: ldap-utils,
+Suggests: ldap-utils, ufw,
  libsasl2-modules-gssapi-mit | libsasl2-modules-gssapi-heimdal
 Conflicts: umich-ldapd, ldap-server, libltdl3 (= 1.5.4-1)
 Replaces: libldap2, ldap-utils (<< 2.2.23-3)
diff --git a/debian/libldap-2.4-2.symbols b/debian/libldap-2.4-2.symbols
index d42ccec..55421bc 100644
--- a/debian/libldap-2.4-2.symbols
+++ b/debian/libldap-2.4-2.symbols
@@ -118,6 +118,7 @@ liblber-2.4.so.2 libldap-2.4-2 #MINVER#
  ber_sockbuf_io_fd@OPENLDAP_2.4_2 2.4.7
  ber_sockbuf_io_readahead@OPENLDAP_2.4_2 2.4.7
  ber_sockbuf_io_tcp@OPENLDAP_2.4_2 2.4.7
+ ber_sockbuf_io_udp@OPENLDAP_2.4_2 2.4.17-1ubuntu2
  ber_sockbuf_remove_io@OPENLDAP_2.4_2 2.4.7
  ber_sos_dump@OPENLDAP_2.4_2 2.4.7
  ber_start@OPENLDAP_2.4_2 2.4.7
@@ -280,6 +281,11 @@ libldap_r-2.4.so.2 libldap-2.4-2 #MINVER#
  ldap_int_flush_request@OPENLDAP_2.4_2 2.4.7
  ldap_int_global_options@OPENLDAP_2.4_2 2.4.7
  ldap_int_gmtime_mutex@OPENLDAP_2.4_2 2.4.23
+ ldap_int_gssapi_close@OPENLDAP_2.4_2 2.4.18-0ubuntu2
+ ldap_int_gssapi_config@OPENLDAP_2.4_2 2.4.18-0ubuntu2
+ ldap_int_gssapi_get_option@OPENLDAP_2.4_2 2.4.18-0ubuntu2
+ ldap_int_gssapi_mutex@OPENLDAP_2.4_2 2.4.18-0ubuntu2
+ ldap_int_gssapi_set_option@OPENLDAP_2.4_2 2.4.18-0ubuntu2
  ldap_int_hostname@OPENLDAP_2.4_2 2.4.7
  ldap_int_hostname_mutex@OPENLDAP_2.4_2 2.4.39
  ldap_int_inet4or6@OPENLDAP_2.4_2 2.4.7
@@ -312,6 +318,7 @@ libldap_r-2.4.so.2 libldap-2.4-2 #MINVER#
  ldap_int_tls_start@OPENLDAP_2.4_2 2.4.7
  ldap_int_utils_init@OPENLDAP_2.4_2 2.4.7
  ldap_is_ldap_url@OPENLDAP_2.4_2 2.4.7
+ ldap_is_ldapc_url@OPENLDAP_2.4_2 2.4.17-1ubuntu2
  ldap_is_ldapi_url@OPENLDAP_2.4_2 2.4.7
  ldap_is_ldaps_url@OPENLDAP_2.4_2 2.4.7
  ldap_is_read_ready@OPENLDAP_2.4_2 2.4.7
diff --git a/debian/patches/contrib-makefiles b/debian/patches/contrib-makefiles
index 0aea4c3..bf04e60 100644
--- a/debian/patches/contrib-makefiles
+++ b/debian/patches/contrib-makefiles
@@ -183,3 +183,24 @@
  	-rpath $(moduledir) -module -o $@ $? $(LIBS)
  
  clean:
+--- a/contrib/slapd-modules/nssov/Makefile
++++ b/contrib/slapd-modules/nssov/Makefile
+@@ -52,15 +52,15 @@
+ .SUFFIXES: .c .o .lo
+ 
+ .c.lo:
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $<
+ 
+ tio.lo:	nss-pam-ldapd/tio.c
+-	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $?
++	$(LIBTOOL) --mode=compile $(CC) $(CFLAGS) $(CPPFLAGS) $(DEFS) $(INCS) -c $?
+ 
+ $(OBJS):	nssov.h
+ 
+ nssov.la:	$(OBJS) $(XOBJS)
+-	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info 0:0:0 \
++	$(LIBTOOL) --mode=link $(CC) $(LDFLAGS) -version-info 0:0:0 \
+ 	-rpath $(moduledir) -module -o $@ $(OBJS) $(XOBJS) $(LIBS)
+ 
+ install: nssov.la
diff --git a/debian/patches/fix_test_timing.patch b/debian/patches/fix_test_timing.patch
 new file mode 100644
index 0000000..bc57140
--- /dev/null
+++ b/debian/patches/fix_test_timing.patch
@@ -0,0 +1,27 @@
+Description: fix test timing on slow builders such as riscv64
+Author: Marc Deslauriers <[e-mail]>
+
+--- a/tests/data/ppolicy.ldif
++++ b/tests/data/ppolicy.ldif
+@@ -25,7 +25,7 @@ pwdLockoutDuration: 15
+ pwdInHistory: 6
+ pwdCheckQuality: 2
+ pwdExpireWarning: 10
+-pwdMaxAge: 30
++pwdMaxAge: 40
+ pwdMinLength: 5
+ pwdGraceAuthnLimit: 3
+ pwdAllowUserChange: TRUE
+--- a/tests/scripts/test022-ppolicy
++++ b/tests/scripts/test022-ppolicy
+@@ -100,8 +100,8 @@ if test $RC != 0 ; then
+ fi
+ 
+ echo "Testing password expiration"
+-echo "Waiting 20 seconds for password to expire..."
+-sleep 20
++echo "Waiting 40 seconds for password to expire..."
++sleep 40
+ 
+ $LDAPSEARCH -e ppolicy -h $LOCALHOST -p $PORT1 -D "$USER" -w $PASS \
+ 	-b "$BASEDN" -s base > $SEARCHOUT 2>&1
diff --git a/debian/patches/gssapi.diff b/debian/patches/gssapi.diff
 new file mode 100644
index 0000000..5bcf266
--- /dev/null
+++ b/debian/patches/gssapi.diff
@@ -0,0 +1,140 @@
+--- a/configure.in
++++ b/configure.in
+@@ -244,6 +244,8 @@
+ 	auto, [auto yes no] )
+ OL_ARG_WITH(fetch,[  --with-fetch		  with fetch(3) URL support],
+ 	auto, [auto yes no] )
++OL_ARG_WITH(gssapi,[  --with-gssapi               with GSSAPI support],
++        auto, [auto yes no] )
+ OL_ARG_WITH(threads,[  --with-threads	  with threads],
+ 	auto, [auto nt posix mach pth lwp yes no manual] )
+ OL_ARG_WITH(tls,[  --with-tls		  with TLS/SSL support auto|openssl|gnutls|moznss],
+@@ -591,6 +593,7 @@
+ KRB4_LIBS=
+ KRB5_LIBS=
+ SASL_LIBS=
++GSSAPI_LIBS=
+ TLS_LIBS=
+ MODULES_LIBS=
+ SLAPI_LIBS=
+@@ -1153,6 +1156,63 @@
+ fi
+ 
+ dnl ----------------------------------------------------------------
++dnl GSSAPI
++ol_link_gssapi=no
++
++case $ol_with_gssapi in yes | auto)
++
++        ol_header_gssapi=no
++        AC_CHECK_HEADERS(gssapi/gssapi.h)
++        if test $ac_cv_header_gssapi_gssapi_h = yes ; then
++                ol_header_gssapi=yes
++        else
++                AC_CHECK_HEADERS(gssapi.h)
++                if test $ac_cv_header_gssapi_h = yes ; then
++                        ol_header_gssapi=yes
++                fi
++
++                dnl## not every gssapi has gss_oid_to_str()
++                dnl## as it's not defined in the GSSAPI V2 API
++                dnl## anymore
++                saveLIBS="$LIBS"
++                LIBS="$LIBS $GSSAPI_LIBS"
++                AC_CHECK_FUNCS(gss_oid_to_str)
++                LIBS="$saveLIBS"
++        fi
++
++        if test $ol_header_gssapi = yes ; then
++                dnl## we check for gss_wrap
++                dnl## as it's new to the GSSAPI V2 API
++                AC_CHECK_LIB(gssapi, gss_wrap,
++                             [ol_link_gssapi=yes;GSSAPI_LIBS="-lgssapi"],
++                             [ol_link_gssapi=no])
++                if test $ol_link_gssapi != yes ; then
++                        AC_CHECK_LIB(gssapi_krb5, gss_wrap,
++                                     [ol_link_gssapi=yes;GSSAPI_LIBS="-lgssapi_krb5"],
++                                     [ol_link_gssapi=no])
++                fi
++                if test $ol_link_gssapi != yes ; then
++                        AC_CHECK_LIB(gss, gss_wrap,
++                                     [ol_link_gssapi=yes;GSSAPI_LIBS="-lgss"],
++                                     [ol_link_gssapi=no])
++                fi
++        fi
++
++        ;;
++esac
++
++WITH_GSSAPI=no
++if test $ol_link_gssapi = yes; then
++        AC_DEFINE(HAVE_GSSAPI, 1, [define if you have GSSAPI])
++        WITH_GSSAPI=yes
++elif test $ol_with_gssapi = auto ; then
++        AC_MSG_WARN([Could not locate GSSAPI package])
++        AC_MSG_WARN([GSSAPI authentication not supported!])
++elif test $ol_with_gssapi = yes ; then
++        AC_MSG_ERROR([GSSAPI detection failed])
++fi
++
++dnl ----------------------------------------------------------------
+ dnl TLS/SSL
+ 	
+ if test $ol_with_tls = yes ; then
+@@ -1928,6 +1988,13 @@
+ fi
+ AC_SUBST(VERSION_OPTION)
+ 
++VERSION_OPTION=""
++OL_SYMBOL_VERSIONING
++if test $ol_cv_ld_version_script_option = yes ; then
++  VERSION_OPTION="-Wl,--version-script="
++fi
++AC_SUBST(VERSION_OPTION)
++
+ dnl ----------------------------------------------------------------
+ if test $ol_enable_wrappers != no ; then
+ 	AC_CHECK_HEADERS(tcpd.h,[
+@@ -3159,6 +3226,7 @@
+ AC_SUBST(KRB4_LIBS)
+ AC_SUBST(KRB5_LIBS)
+ AC_SUBST(SASL_LIBS)
++AC_SUBST(GSSAPI_LIBS)
+ AC_SUBST(TLS_LIBS)
+ AC_SUBST(MODULES_LIBS)
+ AC_SUBST(SLAPI_LIBS)
+--- a/include/portable.hin
++++ b/include/portable.hin
+@@ -253,6 +253,18 @@
+ /* Define to 1 if you have the <grp.h> header file. */
+ #undef HAVE_GRP_H
+ 
++/* define if you have GSSAPI */
++#undef HAVE_GSSAPI
++
++/* Define to 1 if you have the <gssapi/gssapi.h> header file. */
++#undef HAVE_GSSAPI_GSSAPI_H
++
++/* Define to 1 if you have the <gssapi.h> header file. */
++#undef HAVE_GSSAPI_H
++
++/* Define to 1 if you have the `gss_oid_to_str' function. */
++#undef HAVE_GSS_OID_TO_STR
++
+ /* Define to 1 if you have the `hstrerror' function. */
+ #undef HAVE_HSTRERROR
+ 
+--- a/build/top.mk
++++ b/build/top.mk
+@@ -190,9 +190,10 @@
+ KRB5_LIBS = @KRB5_LIBS@
+ KRB_LIBS = @KRB4_LIBS@ @KRB5_LIBS@
+ SASL_LIBS = @SASL_LIBS@
++GSSAPI_LIBS = @GSSAPI_LIBS@
+ TLS_LIBS = @TLS_LIBS@
+ AUTH_LIBS = @AUTH_LIBS@
+-SECURITY_LIBS = $(SASL_LIBS) $(KRB_LIBS) $(TLS_LIBS) $(AUTH_LIBS)
++SECURITY_LIBS = $(SASL_LIBS) $(KRB_LIBS) $(GSSAPI_LIBS) $(TLS_LIBS) $(AUTH_LIBS)
+ 
+ MODULES_CPPFLAGS = @SLAPD_MODULES_CPPFLAGS@
+ MODULES_LDFLAGS = @SLAPD_MODULES_LDFLAGS@
diff --git a/debian/patches/series b/debian/patches/series
index 6181d9b..c93db6f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,6 +8,7 @@ index-files-created-as-root
 sasl-default-path 
 libldap-symbol-versions
 getaddrinfo-is-threadsafe
+gssapi.diff
 do-not-second-guess-sonames
 contrib-makefiles
 smbk5pwd-makefile-manpage
@@ -20,3 +21,4 @@ no-bdb-ABI-second-guessing
 ITS6035-olcauthzregex-needs-restart.patch
 set-maintainer-name
 ITS-9086-Add-debug-logging-for-more-GnuTLS-errors.patch
+fix_test_timing.patch
diff --git a/debian/patches/set-maintainer-name b/debian/patches/set-maintainer-name
index 262b7ef..35f8f77 100644
--- a/debian/patches/set-maintainer-name
+++ b/debian/patches/set-maintainer-name
@@ -10,7 +10,7 @@
 -else
 -   WHOWHERE="$USER@$(uname -n):$(pwd)"
 -fi
-+WHOWHERE="Debian OpenLDAP Maintainers <[e-mail]>"
++WHOWHERE="${DEB_MAINTAINER:-openldap}"
  
  cat << __EOF__
  /* This work is part of OpenLDAP Software <http://www.openldap.org/>.
diff --git a/debian/rules b/debian/rules
index 1eb0d5b..30cf8e0 100755
--- a/debian/rules
+++ b/debian/rules
@@ -7,13 +7,17 @@ include /usr/share/dpkg/pkg-info.mk
 # want the checks for DFSG-freeness.
 #DFSG_NONFREE = 1
 
-export DEB_CFLAGS_MAINT_APPEND := -Wall -Wno-format-extra-args -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE
+export DEB_CFLAGS_MAINT_APPEND := -Wall -Wno-format-extra-args -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -DLDAP_CONNECTIONLESS -I/usr/include/heimdal
+export DEB_LDFLAGS_MAINT_APPEND := -L/usr/lib/$(DEB_HOST_MULTIARCH)/heimdal
 export DEB_BUILD_MAINT_OPTIONS := hardening=+pie,+bindnow
 
 # Configure calls AM_INIT_AUTOMAKE, but Automake fails as there is no Makefile.am.
 # Tell dh-autoreconf to skip automake.
 export AUTOMAKE = true
 
+# Expose maintainer address to build/mkversion (see debian/patches/set-maintainer-name)
+export DEB_MAINTAINER := $(shell sed -ne 's/^Maintainer:\s\+//p' debian/control)
+
 # Expose DEB_VERSION to build/version.sh (see debian/patches/debian-version)
 export DEB_VERSION
 
@@ -28,7 +32,7 @@ ifneq ($(filter pkg.openldap.noslapd,$(DEB_BUILD_PROFILES)),)
 	CONFIG += --disable-slapd
 endif
 
-CONTRIB_MODULES = autogroup lastbind passwd passwd/argon2 passwd/pbkdf2 passwd/sha2 smbk5pwd
+CONTRIB_MODULES = autogroup lastbind nssov passwd passwd/argon2 passwd/pbkdf2 passwd/sha2 smbk5pwd
 
 # Ensure CC is set correctly for cross builds, unless it has already 
 # been set explicitly.
@@ -48,7 +52,8 @@ CONTRIB_MAKEVARS := \
 	LDAP_BUILD='$(builddir)' \
 	prefix=/usr \
 	ldap_subdir=/ldap \
-	moduledir='$$(libdir)$$(ldap_subdir)'
+	moduledir='$$(libdir)$$(ldap_subdir)' \
+	sysconfdir='/etc$$(ldap_subdir)'
 
 # These variables are used only by get-orig-source, which will normally only
 # be run by maintainers.
@@ -162,6 +167,22 @@ endif
 	find $(installdir)/usr/share/man -name \*.8 \
 		| xargs perl -pi -e 's#(\.TH \w+ 8)C#$$1#'
 
+ifeq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
+override_dh_install-arch:
+	dh_install
+
+	# install AppArmor profile
+	install -D -m 644 $(CURDIR)/debian/apparmor-profile $(CURDIR)/debian/slapd/etc/apparmor.d/usr.sbin.slapd
+
+	# install Apport hook
+	install -D -m 644 $(CURDIR)/debian/slapd.py $(CURDIR)/debian/slapd/usr/share/apport/package-hooks/slapd.py
+
+	# install ufw profile
+	install -D -m 644 $(CURDIR)/debian/slapd.ufw.profile $(CURDIR)/debian/slapd/etc/ufw/applications.d/slapd
+
+	dh_apparmor -pslapd --profile-name=usr.sbin.slapd
+endif
+
 override_dh_installinit:
 	dh_installinit -- "defaults 19 80"
 
@@ -222,6 +243,8 @@ ifeq ($(filter pkg.openldap.noslapd,$(DEB_BUILD_PROFILES)),)
 	    done; \
 	fi
 
+	rm -f contrib/slapd-modules/nssov/nss-pam-ldapd/config.sub contrib/slapd-modules/nssov/nss-pam-ldapd/config.guess
+
 	# Clean the contrib directory
 	for mod in $(CONTRIB_MODULES); do \
 		dh_auto_clean -Dcontrib/slapd-modules/$$mod -Bcontrib/slapd-modules/$$mod || exit $?; \
diff --git a/debian/slapd.README.Debian b/debian/slapd.README.Debian
index a43dfe4..216e6ac 100644
--- a/debian/slapd.README.Debian
+++ b/debian/slapd.README.Debian
@@ -204,8 +204,8 @@ Running slapd under a Different UID/GID
 
   - Tell linux slapd can access configuration files -- usually:
 
-      chgrp <group> /etc/ldap/slapd.conf
-      chmod 0640 /etc/ldap/slapd.conf
+      chgrp -R <group> /etc/ldap/slapd.d
+      chmod -R g+rX /etc/ldap/slapd.d
 
   - Tell linux slapd can access /var/run/slapd and write a PID file:
 
@@ -339,3 +339,14 @@ Unsafe access control rule installed by default in previous versions
   slapd.access(5) man page.
 
  -- Ryan Tandy <[e-mail]>, Mon, 20 Oct 2014 11:45:20 -0700
+
+Apparmor Profile
+----------------
+
+  If your system uses AppArmor, please note that the shipped enforcing profile
+  works with the default installation, and changes in your configuration may
+  require changes to the installed apparmor profile. Please see
+  https://wiki.ubuntu.com/DebuggingApparmor before filing a bug against this
+  software.
+
+ -- Jamie Strandboge <[e-mail]>, Mon,  4 Feb 2008 21:18:21 -0500
diff --git a/debian/slapd.default b/debian/slapd.default
index 372b8f4..4212e07 100644
--- a/debian/slapd.default
+++ b/debian/slapd.default
@@ -12,7 +12,7 @@ SLAPD_USER="openldap"
 SLAPD_GROUP="openldap"
 
 # Path to the pid file of the slapd server. If not set the init.d script
-# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by
+# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.d by
 # default)
 SLAPD_PIDFILE=
 
diff --git a/debian/slapd.install b/debian/slapd.install
index 0987dad..206a208 100644
--- a/debian/slapd.install
+++ b/debian/slapd.install
@@ -54,5 +54,7 @@ usr/lib/ldap/autogroup.so*
 usr/lib/ldap/autogroup.la
 usr/lib/ldap/lastbind.so*
 usr/lib/ldap/lastbind.la
+usr/lib/ldap/nssov.so*
+usr/lib/ldap/nssov.la
 usr/lib/ldap/pw-sha2.so*
 usr/lib/ldap/pw-sha2.la
diff --git a/debian/slapd.manpages b/debian/slapd.manpages
index ffd3243..25f6d43 100644
--- a/debian/slapd.manpages
+++ b/debian/slapd.manpages
@@ -43,3 +43,4 @@ debian/tmp/usr/share/man/man5/slapo-valsort.5
 
 # contrib modules installed in main package
 debian/tmp/usr/share/man/man5/slapo-lastbind.5
+contrib/slapd-modules/nssov/slapo-nssov.5
diff --git a/debian/slapd.py b/debian/slapd.py
 new file mode 100644
index 0000000..7d78699
--- /dev/null
+++ b/debian/slapd.py
@@ -0,0 +1,51 @@
+#!/usr/bin/python
+
+'''apport hook for slapd
+
+(c) 2010 Adam Sommer.
+Author: Adam Sommer <[e-mail]>
+
+This program is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2 of the License, or (at your
+option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
+the full text of the license.
+'''
+
+from apport.hookutils import *
+import os
+
+# Scrub olcRootPW attribute and credentials strings if necessary.
+def scrub_pass_strings(config):
+    olcrootpw_regex = re.compile('olcRootPW:.*')
+    olcrootpw_string = olcrootpw_regex.search(config)
+    if olcrootpw_string:
+        config = config.replace(olcrootpw_string.group(0), 'olcRootPW: @@APPORTREPLACED@@') 
+
+    credentials_regex = re.compile('credentials=.* ')
+    credentials_string = credentials_regex.search(config)
+    if credentials_string:
+        config = config.replace(credentials_string.group(0), 'credentials=@@APPORTREPLACED@@ ') 
+
+    return config
+
+def add_info(report, ui):
+    response = ui.yesno("The contents of your /etc/ldap/slapd.d directory "
+                        "may help developers diagnose your bug more "
+                        "quickly.  However, it may contain sensitive "
+                        "information.  Do you want to include it in your "
+                        "bug report?")
+
+    if response == None: # user cancelled
+        raise StopIteration
+
+    elif response == True:
+        # Get the cn=config tree.
+        cn_config = root_command_output(['/usr/bin/ldapsearch', '-Q', '-LLL', '-Y EXTERNAL', '-H ldapi:///', '-b cn=config'])
+        report['CNConfig'] = scrub_pass_strings(cn_config)
+
+        # Get slapd messages from /var/log/syslog
+        slapd_re = re.compile('slapd', re.IGNORECASE)
+        report['SysLog'] = recent_syslog(slapd_re)
+
+        attach_mac_events(report, '/usr/sbin/slapd')
diff --git a/debian/slapd.scripts-common b/debian/slapd.scripts-common
index b2b3d3d..0dc0045 100644
--- a/debian/slapd.scripts-common
+++ b/debian/slapd.scripts-common
@@ -175,8 +175,7 @@ dump_config() {								# {{{
 dump_databases() {							# {{{
 # If the user wants us to dump the databases they are dumped to the 
 # configured directory.
-
-	local db suffix file dir failed
+	local db suffix file dir failed slapcat_opts
 
 	database_dumping_enabled || return 0
 
@@ -365,6 +364,12 @@ compute_backup_path() {							# {{{
 	id="$OLD_VERSION"
 	[ -n "$id" ] || id=`date +%Y%m%d-%H%M%S`
 	target="/var/backups/$basedn-$id.ldapdb"
+	# Configuration via dpkg-reconfigure. 
+	# The backup directory already exists when reconfigured 
+	# twice or more: append a timestamp.
+	if [ -e "${target}" ] && ([ "$MODE" = reconfigure ] || [ "$DEBCONF_RECONFIGURE" ]); then
+			 target="$target-`date +%Y%m%d-%H%M%S`"
+	fi
 	if [ -e "$target" ] && [ -z "$ok_exists" ]; then
 		echo >&2
 		echo >&2 "  Backup path $target exists. Giving up..."
diff --git a/debian/slapd.ufw.profile b/debian/slapd.ufw.profile
 new file mode 100644
index 0000000..3c4f676
--- /dev/null
+++ b/debian/slapd.ufw.profile
@@ -0,0 +1,9 @@
+[OpenLDAP LDAP]
+title=OpenLDAP with TLS
+description=OpenLDAP is a free, fast, lightweight LDAP server
+ports=389/tcp
+
+[OpenLDAP LDAPS]
+title=OpenLDAP over SSL
+description=OpenLDAP is a free, fast, lightweight LDAP server
+ports=636/tcp