Merge ~ahasenack/ubuntu/+source/squid:eoan-squid-4.8-merge into ubuntu/+source/squid:debian/sid

[Andreas Hasenack]

Merge from debian 4.8-2

Bileto: https://bileto.ubuntu.com/#/ticket/3765
PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3765/+packages
sudo add-apt-repository ppa:ci-train-ppa-service/3765 -y -u

Debian wrapped the zz_apparmor DEP8 test in a conditional and I couldn't understand exactly what is happening there. This dep8 test started failing for them as soon as they added our (disabled by default) apparmor profile to the package. I think the reason it's failing is because debian is using lxc for these tests, whereas we use lxd, and our lxd setup allows this confinement. It's not clear to me, so for now I decided to essentially force that test to run in our case, by replacing the conditional with "True".

I did a few runs with the test as-is from debian, with their conditional, and in our case the test still ran, but since I'm not fully understanding what is going on, I thought it better to really force the run in the ubuntu case. I added a question to debian's commit which introduced this change (https://salsa.debian.org/squid-team/squid/commit/e36148f6798499afa70baf811c6b668ebe072eb4)

The recent gcc9 patch to fix build issues was merged upstream, so should disappear soon from the package.

d/rules' -Wno-format-truncation addition: haven't tested yet if that is still needed for ppc64el. I'm trying to bring up a ppc64 instance in canonistack to verify.

d/NEWS, and d/rules' -latomic changes were submitted to salsa but got no response yet:
https://salsa.debian.org/squid-team/squid/merge_requests/7
https://salsa.debian.org/squid-team/squid/merge_requests/6

[Andreas Hasenack (ahasenack)]

Left a ppc64el build running on https://launchpad.net/~ahasenack/+archive/ubuntu/squid-ppc64el/+packages, where I reverted that d/rules delta for ppc64el builds, will see tomorrow if that worked or not. If the build failed, we keep the delta. If it worked, we drop it.

[Andreas Hasenack (ahasenack)]

squid ppc64el build failed without the d/rules delta, so that is to be kept. The upstream bug is still open even.

[Christian Ehrhardt  (paelzer)]

yes on all drops
yes on retained Delta - that just is Ubuntu special customization e.g. maas
yes on changelog
yes on tests

[Christian Ehrhardt  (paelzer)]

shouldn't the conditional be true for us?

if os.path.exists(self.aa_abs_profile):

with:
        self.aa_profile = "usr.sbin.squid"
        self.aa_abs_profile = "/etc/apparmor.d/%s" % self.aa_profile

in Container:
root@e:~# apt install squid3
root@e:~# ll /etc/apparmor.d/usr.sbin.squid
-rw-r--r-- 1 root root 2462 Jul 19 12:01 /etc/apparmor.d/usr.sbin.squid

So can't we just keep the conditional and get the tests running without added Delta?

review: Needs Information

[Christian Ehrhardt  (paelzer)]

+1 with the rest.
I'll set approved in case the apparmor change is something obvious that I miss.
Otherwise lets discuss about the apparmor delta ...

review: Approve

[Andreas Hasenack (ahasenack)]

> shouldn't the conditional be true for us?
>
> if os.path.exists(self.aa_abs_profile):
>
> with:
> self.aa_profile = "usr.sbin.squid"
> self.aa_abs_profile = "/etc/apparmor.d/%s" % self.aa_profile
>
> in Container:
> root@e:~# apt install squid3
> root@e:~# ll /etc/apparmor.d/usr.sbin.squid
> -rw-r--r-- 1 root root 2462 Jul 19 12:01 /etc/apparmor.d/usr.sbin.squid
>
>
> So can't we just keep the conditional and get the tests running without added
> Delta?

One would think this is how it would work in Debian, but alas, apparently not. I'm not sure why this change was needed in debian. The explanation doesn't seem to match what I see in their ci.debian.net log, where the dep8 tests are run in lxc (not lxd) and apparently enabling an apparmor profile in an lxc guest doesn't work out of the box.

Why this check for the file is enough to skip the test in debian I did not understand. Since I didn't understand it, I thought it best to make clear that in ubuntu we want that to run always.

90ead55... by Andreas Hasenack on 2019-07-30

  * Added:
    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
      mounted

[Andreas Hasenack (ahasenack)]

Salsa PR to fix this properly in debian:

https://salsa.debian.org/squid-team/squid/merge_requests/9

I'll pull that into my branch, and hopefully it will be accepted soon in debian, so we know it's a delta we can drop later.

[Andreas Hasenack (ahasenack)]

I pulled in the change I submitted to debian, and will kick a new round of dep8 tests in our infrastructure.

[Andreas Hasenack (ahasenack)]

I kept the last change as two commits, for easier review: one reverts the debian change, and the other adds the new check. Were it just one commit, most of it would be indentation changes.

7e4b443... by Andreas Hasenack on 2019-07-31

changelog

[Andreas Hasenack (ahasenack)]

I changed my mind and squashed the mentioned two commits, sorry.

[Andreas Hasenack (ahasenack)]

https://bileto.ubuntu.com/#/ticket/3765

DEP8 passed with the new test, please take another quick look at the change (90ead55)

[Christian Ehrhardt  (paelzer)]

Tests ok
We discussed the test cahnges - those are good now - ok
  It looks like more diff zhan it is due to the indent change.

Thanks for submitting that to Debian as well.

+1

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks!

Tagging and uploading 7e4b4430883e3d77ee87247bca3ab01e29b2b322

$ git push pkg upload/4.8-1ubuntu1
Enumerating objects: 72, done.
Counting objects: 100% (72/72), done.
Delta compression using up to 2 threads
Compressing objects: 100% (61/61), done.
Writing objects: 100% (62/62), 13.62 KiB | 929.00 KiB/s, done.
Total 62 (delta 39), reused 4 (delta 1)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/squid
 * [new tag] upload/4.8-1ubuntu1 -> upload/4.8-1ubuntu1

$ dput ubuntu ../squid_4.8-1ubuntu1_source.changes
Checking signature on .changes
gpg: ../squid_4.8-1ubuntu1_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../squid_4.8-1ubuntu1.dsc: Valid signature from AC983EB5BF6BCBA9
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading squid_4.8-1ubuntu1.dsc: done.
  Uploading squid_4.8.orig.tar.gz: done.
  Uploading squid_4.8-1ubuntu1.debian.tar.xz: done.
  Uploading squid_4.8-1ubuntu1_source.buildinfo: done.
  Uploading squid_4.8-1ubuntu1_source.changes: done.
Successfully uploaded packages.

[Andreas Hasenack (ahasenack)]

This migrated.

diff --git a/debian/NEWS.debian b/debian/NEWS
similarity index 100%
rename from debian/NEWS.debian
rename to debian/NEWS
diff --git a/debian/changelog b/debian/changelog
index 7c1c5cd..94f69c6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,57 @@
+squid (4.8-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c. (LP #1835831)
+  * Dropped:
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Fixed upstream]
+    - debian/patches/413.patch: Fix gcc-9 build issues with upstream merged
+      patch
+      [Fixed upstream]
+    - SECURITY UPDATE: incorrect digest auth parameter parsing
+      + debian/patches/CVE-2019-12525.patch: check length in
+        src/auth/digest/Config.cc.
+      + CVE-2019-12525
+      [Fixed upstream]
+    - SECURITY UPDATE: buffer overflow in basic auth decoding
+      + debian/patches/CVE-2019-12527.patch: switch to SBuf in
+        src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+        src/clients/FtpGateway.cc.
+      + CVE-2019-12527
+      [Fixed upstream]
+    - SECURITY UPDATE: basic auth uudecode length issue
+      + debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+        base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+        include/uudecode.h, lib/uudecode.c.
+      + CVE-2019-12529
+      [Fixed upstream]
+    - SECURITY UPDATE: XSS issues in cachemgr.cgi
+      + debian/patches/CVE-2019-13345.patch: properly escape values in
+        tools/cachemgr.cc.
+      + CVE-2019-13345
+      [Fixed upstream]
+  * Added:
+    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
+      mounted
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 24 Jul 2019 16:38:59 -0300
+
 squid (4.8-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -16,6 +70,86 @@ squid (4.8-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Thu, 18 Jul 2019 22:28:15 +0200
 
+squid (4.6-2ubuntu4) eoan; urgency=medium
+
+  * Fix gcc-9 issues (LP: #1835831)
+    - Remove -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c.
+  * SECURITY UPDATE: incorrect digest auth parameter parsing
+    - debian/patches/CVE-2019-12525.patch: check length in
+      src/auth/digest/Config.cc.
+    - CVE-2019-12525
+  * SECURITY UPDATE: buffer overflow in basic auth decoding
+    - debian/patches/CVE-2019-12527.patch: switch to SBuf in
+      src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+      src/clients/FtpGateway.cc.
+    - CVE-2019-12527
+  * SECURITY UPDATE: basic auth uudecode length issue
+    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+      include/uudecode.h, lib/uudecode.c.
+    - CVE-2019-12529
+  * SECURITY UPDATE: XSS issues in cachemgr.cgi
+    - debian/patches/CVE-2019-13345.patch: properly escape values in
+      tools/cachemgr.cc.
+    - CVE-2019-13345
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 19 Jul 2019 08:01:58 -0400
+
+squid (4.6-2ubuntu3) eoan; urgency=medium
+
+  * Override newly added gcc-9 flags:
+    -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    NOTE: Overriding those flags is a possible security
+    asked for info on the gcc-9 issue bug tracker:
+    https://github.com/squid-cache/squid/pull/413#issuecomment-511314076
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 15 Jul 2019 10:21:47 +0200
+
+squid (4.6-2ubuntu2) eoan; urgency=medium
+
+  * Fix gcc-9 build issues with upstream merged patch
+
+ -- Gianfranco Costamagna <[e-mail]>  Sun, 14 Jul 2019 14:41:16 +0200
+
+squid (4.6-2ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Added Applied-Upstream header]
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+  * Dropped:
+    - d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+      at boot. Thanks to Luigi Gangitano <[e-mail]> (LP #1816006)
+      [Fixed in 4.5-2]
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+      [Fixed upstream]
+    - Add disabled by default AppArmor profile.
+      [Added by Debian in 4.6-2]
+    - d/usr.sbin.squid: fix the apparmor profile (LP #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+      [Fixed in 4.6-2]
+
+ -- Andreas Hasenack <[e-mail]>  Sat, 18 May 2019 14:39:09 -0300
+
 squid (4.6-2) unstable; urgency=high
 
   [ Andreas Hasenack <[e-mail]> ]
@@ -76,6 +210,57 @@ squid (4.5-1) unstable; urgency=medium
 
  -- Luigi Gangitano <[e-mail]>  Wed, 20 Feb 2019 11:57:15 +0100
 
+squid (4.4-1ubuntu2) disco; urgency=medium
+
+  * d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+    at boot. Thanks to Luigi Gangitano <[e-mail]> (LP: #1816006)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 27 Feb 2019 08:54:45 -0300
+
+squid (4.4-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - Add disabled by default AppArmor profile.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+  * Drop:
+    - d/rules: enable cdbs parallel build
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix apparmor profile filename
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+      [Fixed in 4.2-1]
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+      [Fixed in 4.2-1]
+  * Added changes:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - d/usr.sbin.squid: fix the apparmor profile (LP: #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 19 Nov 2018 10:51:18 -0200
+
 squid (4.4-1) unstable; urgency=high
 
   * Urgency high due to security fixes
@@ -140,6 +325,85 @@ squid (4.2-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Wed, 22 Aug 2018 13:57:15 +0200
 
+squid (4.1-1ubuntu3) cosmic; urgency=medium
+
+  * d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+    Thanks to Vitaly Lavrov <[e-mail]>. (LP: #1794553)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 09 Oct 2018 14:00:36 -0300
+
+squid (4.1-1ubuntu2) cosmic; urgency=medium
+
+  * d/usr.sbin.squid: Update apparmor profile to grant read access to squid
+    binary (LP: #1792728)
+
+ -- Simon Deziel <[e-mail]>  Sat, 15 Sep 2018 13:55:32 -0400
+
+squid (4.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merged with Debian unstable (LP: #1780944, LP: #1097032, LP: #16669).
+    Remaining changes:
+    - Use snakeoil certificates.
+      [Updated to use the correct config setting names]
+    - Add an example refresh pattern for debs.
+      [Improved the refresh patterns based on the configuration from
+       squid-deb-proxy package]
+    - Add disabled by default AppArmor profile.
+      [Updated to include the ssl_certs abstraction and suggestions on how to
+       deal with the snakeoil private key and other keys in /etc/ssl.]
+  * Dropped changes:
+    - Add additional dep8 tests.
+      [Adopted in 4.0.21-1~exp5, albeit a stripped down version]
+    - Correct attribution and add explanatory note in d/NEWS.debian.
+      [That particular upgrade path has happened long ago.]
+    - Drop wrong short-circuiting of various invocations; we always want to
+      call the debhelper block.
+      [This was for the transitional squid3 package, and that transition has
+       already happened.]
+    - Revert "Set pidfile for systemd's sysv-generator" from Debian.
+      [Not needed anymore since we have a native systemd service file
+       and no longer rely on the generator.]
+    - Enable autoreconf. This is no longer required for the security updates,
+      but is needed for the seddery of test-suite/Makefile.am in
+      d/t/upstream-test-suite.
+      [Replaced by patch 0003-installed-binary-for-debian-ci.patch]
+    - Adjust seddery for upstream test squid binary location.
+      [sed no longer necessary since patch,
+       0003-installed-binary-for-debian-ci.patch, will be dropped
+       entirely.]
+    - Drop Conflicts/Replaces of squid against squid3. In Ubuntu, the migration
+      happened in Xenial, so no upgrade path still requires this code. This
+      reduces upgrade ordering difficulty.
+      [Again we have a migration, but this time from squid3 to squid, so we
+      need this].
+    - GCC7 FTBFS fixes (LP: #1712668):
+      + d/rules: don't error when hitting the "deprecated" and
+      "format-truncation" gcc7 warnings. Upstream 3.5.27 has fixes for these,
+      but one in Format.cc that affects 32bit builds was deemed too intrusive
+      for the 3.5 stable series and is only in squid 4.x
+      [No longer needed with squid 4.x]
+    - Do not force gcc-6
+      [It was a temporary workaround in Debian that got dropped]
+  * Added changes:
+    - d/rules: enable cdbs parallel build
+    - d/t/test-squid.py: fix apparmor profile filename
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 16 Aug 2018 12:33:17 -0300
+
 squid (4.1-1) unstable; urgency=high
 
   * New Upstream Release (Closes: #896120)
diff --git a/debian/control b/debian/control
index 34d22f3..35ac025 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: squid
 Section: web
 Priority: optional
-Maintainer: Luigi Gangitano <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Luigi Gangitano <[e-mail]>
 Uploaders: Santiago Garcia Mantinan <[e-mail]>
 Homepage: http://www.squid-cache.org
 Standards-Version: 4.4.0
@@ -42,7 +43,7 @@ Description: Transitional package
 Package: squid
 Architecture: any
 Pre-Depends: adduser
-Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl
+Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl, ssl-cert
 Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbind, apparmor
 Recommends: libcap2-bin [linux-any], ca-certificates
 Conflicts: squid3 (<< ${binary:Version})
diff --git a/debian/patches/90-cf.data.ubuntu.patch b/debian/patches/90-cf.data.ubuntu.patch
new file mode 100644
index 0000000..9dfa5b4
--- /dev/null
+++ b/debian/patches/90-cf.data.ubuntu.patch
@@ -0,0 +1,16 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -5859,6 +5862,12 @@ NOCOMMENT_START
+ refresh_pattern ^ftp:		1440	20%	10080
+ refresh_pattern ^gopher:	1440	0%	1440
+ refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
++refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
++refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
++refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++# example pattern for deb packages
++#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
+ refresh_pattern .		0	20%	4320
+ NOCOMMENT_END
+ DOC_END
+
diff --git a/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
new file mode 100644
index 0000000..40b5306
--- /dev/null
+++ b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
@@ -0,0 +1,22 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -3516,6 +3516,19 @@
+ 			reference a PEM file containing both the certificate
+ 			and private key.
+ 	
++	Notes:
++
++	On Debian/Ubuntu systems a default snakeoil certificate is
++	available in /etc/ssl and users can set:
++
++		sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem
++
++	and
++
++		sslkey=/etc/ssl/private/ssl-cert-snakeoil.key
++
++	for testing.
++
+ 	sslcipher=...	The list of valid SSL ciphers to use when connecting
+ 			to this peer.
+ 
diff --git a/debian/patches/more-gcc-9-fixes.patch b/debian/patches/more-gcc-9-fixes.patch
new file mode 100644
index 0000000..4bd2c91
--- /dev/null
+++ b/debian/patches/more-gcc-9-fixes.patch
@@ -0,0 +1,56 @@
+From fb8cded9380893d02e3eacf125f66802cde45c4d Mon Sep 17 00:00:00 2001
+From: Amos Jeffries <[e-mail]>
+Date: Thu, 18 Jul 2019 14:26:20 +1200
+Subject: [PATCH] Bug 4969: GCC-9 build failure: stringop-truncation and others
+
+GCC-9 with Squid use of -Werror makes these warning hard
+errors which can no longer be ignored. We are thus forced
+to alter this third-party code when built for Squid.
+
+Truncation of these strings is fine. Rather than suppress
+GCC warnings switch to xstrncpy() which has similar
+behaviour but guarantees c-string terminator exists within
+the copied range limit (removing need for two -1 hacks).
+
+This change will add terminators on path and device_type
+values in the rare case of overly long configured values.
+It is not clear what ancient Domain Controllers would do
+when handed un-terminated c-string in those cases, but is
+unlikely to be good.
+---
+ lib/smblib/smblib-util.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/lib/smblib/smblib-util.c b/lib/smblib/smblib-util.c
+index 10e6220b7f..fcff357eed 100644
+--- a/lib/smblib/smblib-util.c
++++ b/lib/smblib/smblib-util.c
+@@ -401,7 +401,7 @@ int SMB_Negotiate(SMB_Handle_Type Con_Handle, const char *Prots[])
+ 
+         p = (SMB_Hdr(pkt) + SMB_negrLM_buf_offset + Con_Handle -> Encrypt_Key_Len);
+ 
+-        strncpy(p, Con_Handle -> Svr_PDom, sizeof(Con_Handle -> Svr_PDom) - 1);
++        xstrncpy(p, Con_Handle -> Svr_PDom, sizeof(Con_Handle -> Svr_PDom));
+ 
+         break;
+ 
+@@ -424,7 +424,7 @@ int SMB_Negotiate(SMB_Handle_Type Con_Handle, const char *Prots[])
+ 
+         p = (SMB_Hdr(pkt) + SMB_negrLM_buf_offset + Con_Handle -> Encrypt_Key_Len);
+ 
+-        strncpy(p, Con_Handle -> Svr_PDom, sizeof(Con_Handle -> Svr_PDom) - 1);
++        xstrncpy(p, Con_Handle -> Svr_PDom, sizeof(Con_Handle -> Svr_PDom));
+ 
+         break;
+ 
+@@ -538,8 +538,8 @@ SMB_Tree_Handle SMB_TreeConnect(SMB_Handle_Type Con_Handle,
+ 
+     tree -> next = tree -> prev = NULL;
+     tree -> con = Con_Handle;
+-    strncpy(tree -> path, path, sizeof(tree -> path));
+-    strncpy(tree -> device_type, device, sizeof(tree -> device_type));
++    xstrncpy(tree -> path, path, sizeof(tree -> path));
++    xstrncpy(tree -> device_type, device, sizeof(tree -> device_type));
+ 
+     /* Now plug in the values ... */
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 6bff1ed..9847088 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,6 @@
 0001-Default-configuration-file-for-debian.patch
 0002-Change-default-file-locations-for-debian.patch
 0003-installed-binary-for-debian-ci.patch
+90-cf.data.ubuntu.patch
+99-ubuntu-ssl-cert-snakeoil.patch
+more-gcc-9-fixes.patch
diff --git a/debian/rules b/debian/rules
index 1bf39d7..fac4ec7 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,12 +3,17 @@
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 export DEB_CFLAGS_MAINT_APPEND = -Wall
 
-DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed -latomic
+DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
 ifneq (,$(filter $(DEB_HOST_ARCH), armel m68k mips mipsel powerpc powerpcspe sh4))
 	DEB_LDFLAGS_MAINT_APPEND += -latomic
 endif
 export DEB_LDFLAGS_MAINT_APPEND
-
+# On ppc64el, dpkg-buildflags sets -O3 instead of the usual
+# -O2. This makes gcc emit a format-truncation error on
+# pconn.cc. See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH),ppc64el)
+  export DEB_CXXFLAGS_MAINT_APPEND = -Wno-format-truncation
+endif
 export DEB_BUILD_PARALLEL = yes
 include /usr/share/dpkg/buildflags.mk
 -include /usr/share/dpkg/buildtools.mk
diff --git a/debian/tests/test-squid.py b/debian/tests/test-squid.py
index 98136d1..e7a8044 100644
--- a/debian/tests/test-squid.py
+++ b/debian/tests/test-squid.py
@@ -183,35 +183,40 @@ Welcome to the world of Gopher and enjoy!
     def test_zz_apparmor(self):
         '''Test apparmor'''
 
-        # if 'apparmor-utils' was not installed before 'squid' package
-        # then dh_apparmor tool will not install the profile
-        if os.path.exists(self.aa_abs_profile):
-            # Currently while we have a profile, it is shipped disabled by default.
-            # Verify that.
-            ret, report = check_apparmor(self.aa_abs_profile, is_running=False)
-            expected = 1
-            result = 'Got exit code %d, expected %d\n' % (ret, expected)
-            self.assertEquals(ret, expected, result + report)
+        # Currently while we have a profile, it is shipped disabled by default.
+        # Verify that.
+        ret, report = check_apparmor(self.aa_abs_profile, is_running=False)
+        expected = 1
+        result = 'Got exit code %d, expected %d\n' % (ret, expected)
+        self.assertEquals(ret, expected, result + report)
 
-            # Verify it is syntactically correct
-            ret, report = cmd(['apparmor_parser', '-p', self.aa_abs_profile])
-            expected = 0
-            result = 'Got exit code %d, expected %d\n' % (ret, expected)
-            self.assertEquals(ret, expected, result + report)
+        # Verify it is syntactically correct
+        ret, report = cmd(['apparmor_parser', '-p', self.aa_abs_profile])
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (ret, expected)
+        self.assertEquals(ret, expected, result + report)
+
+        # The remaining tests try to actually load a profile
+        # skip them if securityfs isn't mounted (i.e., we are in a lxc container)
+        ret, _ = _aa_status()
+        # from the manpage:
+        # 3   if the apparmor control files aren't available under /sys/kernel/security/.
+        if ret == 3:
+            return True
 
-            # Verify it loads ok
-            ret, report = cmd(['aa-enforce', self.aa_abs_profile])
-            expected = 0
-            result = 'Got exit code %d, expected %d\n' % (ret, expected)
-            self.assertEquals(ret, expected, result + report)
+        # Verify it loads ok
+        ret, report = cmd(['aa-enforce', self.aa_abs_profile])
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (ret, expected)
+        self.assertEquals(ret, expected, result + report)
 
-            self._stop()
-            self._start()
+        self._stop()
+        self._start()
 
-            ret, report = check_apparmor(self.aa_abs_profile, is_running=True)
-            expected = 1
-            result = 'Got exit code %d, expected %d\n' % (ret, expected)
-            self.assertEquals(ret, expected, result + report)
+        ret, report = check_apparmor(self.aa_abs_profile, is_running=True)
+        expected = 1
+        result = 'Got exit code %d, expected %d\n' % (ret, expected)
+        self.assertEquals(ret, expected, result + report)
 
 
 # http://www.chiark.greenend.org.uk/ucgi/~cjwatson/blosxom/2009-07-02-python-sigpipe.html
diff --git a/debian/usr.sbin.squid b/debian/usr.sbin.squid
index 6f5c814..3a26150 100644
--- a/debian/usr.sbin.squid
+++ b/debian/usr.sbin.squid
@@ -48,6 +48,39 @@
   # squid-langpack
   /usr/share/squid-langpack/** r,
 
+  # maas-proxy
+  /var/lib/maas/maas-proxy.conf r,
+  /var/log/maas/proxy/** rw,
+  /var/spool/maas-proxy/ r,
+  /var/spool/maas-proxy/** rwk,
+
+  # squid-deb-proxy
+  /etc/squid-deb-proxy/** r,
+  /{,var/}run/squid-deb-proxy.pid rwk,
+  /var/cache/squid-deb-proxy/ r,
+  /var/cache/squid-deb-proxy/** rwk,
+  /var/log/squid-deb-proxy/* rw,
+
+  # squidguard
+  /usr/bin/squidGuard Cx -> squidguard,
+  profile squidguard {
+    #include <abstractions/base>
+
+    /etc/squid/squidGuard.conf r,
+    /var/log/squid{,3}/squidGuard.log w,
+    /var/lib/squidguard/** rw,
+
+    # squidguard by default uses /var/log/squid as its logdir, however, we
+    # don't want it to access squid's logs, only its own. Explicitly deny
+    # access to squid's files but allow all others since the user may specify
+    # anything for the squidGurad 'log' directive.
+    /var/log/squid{,3}/* rw,
+    audit deny /var/log/squid{,3}/{access,cache,store}.log* rw,
+
+    # Site-specific additions and overrides. See local/README for details.
+    #include <local/usr.sbin.squid>
+  }
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.squid>
 }