Merge ~ahasenack/ubuntu/+source/squid:groovy-squid-411-merge into ubuntu/+source/squid:debian/sid

[Andreas Hasenack]

Merge with debian updating the version to 4.11. One delta dropped, fixed upstream via a configure check now.

PPA building at https://launchpad.net/~ahasenack/+archive/ubuntu/squid-411

I'll run dep8 tests manually.

[Andreas Hasenack (ahasenack)]

Squid is failing to start due to this apparmor deny:
[ 7271.822230] audit: type=1400 audit(1588602033.905:516): apparmor="DENIED" operation="open" namespace="root//lxd-autopkgtest-lxd-sljvrl_<var-snap-lxd-common-lxd>" profile="/usr/sbin/squid" name="/proc/sys/kernel/random/boot_id" pid=289530 comm="squid" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000

which results in:
2020/05/04 14:20:34 kid1| WARNING: failed to send start-up notification to systemd
    sd_notify() error: (13) Permission denied

and
# time systemctl start squid
Job for squid.service failed because a timeout was exceeded.
See "systemctl status squid.service" and "journalctl -xe" for details.

real 2m6.317s
user 0m0.014s
sys 0m0.011s

[Andreas Hasenack (ahasenack)]

squid 4.11 needs this apparmor fix: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1872564

Unmerged commits

295e295... by Andreas Hasenack on 2020-05-04

update-maintainer

3ad585a... by Andreas Hasenack on 2020-05-04

reconstruct-changelog

641b60e... by Andreas Hasenack on 2020-05-04

merge-changelogs

c194989... by Andreas Hasenack on 2020-05-04

  * Dropped:
    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
      deprecated in glibc 2.30 (LP #1843325)
      [Fixed upstream]

421f449... by Andreas Hasenack on 2020-02-25

    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
      -O2 and that triggers a format-truncation error on pcon.cc. See
      See https://bugs.squid-cache.org/show_bug.cgi?id=4875

4341d25... by Andreas Hasenack on 2020-02-25

    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file

9e916eb... by Andreas Hasenack on 2020-02-25

    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for debs.

0e01664... by Andreas Hasenack on 2020-02-25

    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
      squidguard

6e86b18... by Luigi Gangitano on 2020-04-24

Import patches-unapplied version 4.11-2 to debian/sid

Imported using git-ubuntu import.

Changelog parent: e470747ee20ca1acfeda911b9cb864d2581468ac

New changelog entries:
  [ Amos Jeffries <email address hidden> ]
  * Add libsystemd-dev dependency on Linux (Closes: 958708)
    - fixes systemd timeout failure during install
  [ Luigi Gangitano <email address hidden> ]
  * debian/rules
    - Removed --as-needed flag

e470747... by Luigi Gangitano on 2020-04-23

Import patches-unapplied version 4.11-1 to debian/sid

Imported using git-ubuntu import.

Changelog parent: ff469a97f1208dbb63c40f7478b11f6d23804613

New changelog entries:
  * Urgency high due to security fixes
  [ Amos Jeffries <email address hidden> ]
  * New Upstream Release (Closes: #957840, #929574, #910337)
    - Fixes security issue SQUID-2019:12 (CVE-2019-12519, CVE-2019-12521)
    - Fixes security issue SQUID-2020:4 (CVE-2020-11945)
  * debian/squid3.{maintscript,postinst,postrm,preinst,rc}
    - Remove unused and obsolete scripts
  * debian/squid.{postrm,preinst}
    - Remove obsolete script logic
  * debian/squid-common.postinst
    - Remove obsolete script
  * debian/changelog
    - Add missing historic CVE references
  * debian/patches/
    - Add upstream fix for missing Debug::Extra in systemd builds

diff --git a/debian/changelog b/debian/changelog
index 7ed2f2a..b66a61b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+squid (4.11-2ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
+        to the default config file
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+  * Dropped:
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 04 May 2020 10:02:31 -0300
+
 squid (4.11-2) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -36,6 +57,49 @@ squid (4.11-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Thu, 23 Apr 2020 19:34:54 +0200
 
+squid (4.10-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
+        to the default config file
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+  * Dropped:
+    - d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
+      no longer available in Focal (LP: #1858827)
+      [In 4.10-1, undocumented]
+    - d/t/test-squid.py, d/t/squid: switch to python3
+      [In 4.10-1, undocumented]
+    - d/t/control: depend on python3-minimal
+      [In 4.10-1, undocumented]
+    - SECURITY UPDATE: info disclosure via FTP server
+      + debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
+        src/clients/FtpGateway.cc.
+      + CVE-2019-12528
+      [Fixed upstream]
+    - SECURITY UPDATE: incorrect input validation and buffer management
+      + debian/patches/CVE-2020-84xx.patch: fix request URL generation in
+        reverse proxy configurations in src/client_side.cc.
+      + CVE-2020-8449
+      + CVE-2020-8450
+      [Fixed upstream]
+    - SECURITY UPDATE: DoS in NTLM authentication
+      + debian/patches/CVE-2020-8517.patch: improved username handling in
+        src/acl/external/LM_group/ext_lm_group_acl.cc.
+      + CVE-2020-8517
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 25 Feb 2020 15:37:55 -0300
+
 squid (4.10-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -57,6 +121,70 @@ squid (4.10-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Tue, 10 Feb 2020 14:12:54 +0100
 
+squid (4.9-2ubuntu4) focal; urgency=medium
+
+  * SECURITY UPDATE: info disclosure via FTP server
+    - debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
+      src/clients/FtpGateway.cc.
+    - CVE-2019-12528
+  * SECURITY UPDATE: incorrect input validation and buffer management
+    - debian/patches/CVE-2020-84xx.patch: fix request URL generation in
+      reverse proxy configurations in src/client_side.cc.
+    - CVE-2020-8449
+    - CVE-2020-8450
+  * SECURITY UPDATE: DoS in NTLM authentication
+    - debian/patches/CVE-2020-8517.patch: improved username handling in
+      src/acl/external/LM_group/ext_lm_group_acl.cc.
+    - CVE-2020-8517
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 19 Feb 2020 12:43:05 -0500
+
+squid (4.9-2ubuntu3) focal; urgency=medium
+
+  * No-change rebuild with fixed binutils on arm64.
+
+ -- Matthias Klose <[e-mail]>  Sat, 08 Feb 2020 11:20:19 +0000
+
+squid (4.9-2ubuntu2) focal; urgency=medium
+
+  * d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
+    no longer available in Focal (LP: #1858827)
+  * d/t/test-squid.py, d/t/squid: switch to python3
+  * d/t/control: depend on python3-minimal
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 08 Jan 2020 15:52:32 -0300
+
+squid (4.9-2ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+  * Dropped:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+      [Fixed upstream]
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+      [Fixed upstream]
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c. (LP #1835831)
+      [Fixed upstream]
+    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
+      mounted
+      [Fixed upstream]
+
+ -- Lucas Kanashiro <[e-mail]>  Thu, 14 Nov 2019 16:33:10 -0300
+
 squid (4.9-2) unstable; urgency=medium
 
   [ Andreas Hasenack <[e-mail]> ]
@@ -113,6 +241,73 @@ squid (4.9-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Sun, 10 Nov 2019 20:28:15 +0100
 
+squid (4.8-1ubuntu3) focal; urgency=medium
+
+  * No-change rebuild against libnettle7
+
+ -- Steve Langasek <[e-mail]>  Thu, 31 Oct 2019 22:15:39 +0000
+
+squid (4.8-1ubuntu2) eoan; urgency=medium
+
+  * d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+    deprecated in glibc 2.30 (LP: #1843325)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 09 Sep 2019 17:31:45 -0300
+
+squid (4.8-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c. (LP #1835831)
+  * Dropped:
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Fixed upstream]
+    - debian/patches/413.patch: Fix gcc-9 build issues with upstream merged
+      patch
+      [Fixed upstream]
+    - SECURITY UPDATE: incorrect digest auth parameter parsing
+      + debian/patches/CVE-2019-12525.patch: check length in
+        src/auth/digest/Config.cc.
+      + CVE-2019-12525
+      [Fixed upstream]
+    - SECURITY UPDATE: buffer overflow in basic auth decoding
+      + debian/patches/CVE-2019-12527.patch: switch to SBuf in
+        src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+        src/clients/FtpGateway.cc.
+      + CVE-2019-12527
+      [Fixed upstream]
+    - SECURITY UPDATE: basic auth uudecode length issue
+      + debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+        base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+        include/uudecode.h, lib/uudecode.c.
+      + CVE-2019-12529
+      [Fixed upstream]
+    - SECURITY UPDATE: XSS issues in cachemgr.cgi
+      + debian/patches/CVE-2019-13345.patch: properly escape values in
+        tools/cachemgr.cc.
+      + CVE-2019-13345
+      [Fixed upstream]
+  * Added:
+    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
+      mounted
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 24 Jul 2019 16:38:59 -0300
+
 squid (4.8-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -131,6 +326,86 @@ squid (4.8-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Thu, 18 Jul 2019 22:28:15 +0200
 
+squid (4.6-2ubuntu4) eoan; urgency=medium
+
+  * Fix gcc-9 issues (LP: #1835831)
+    - Remove -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c.
+  * SECURITY UPDATE: incorrect digest auth parameter parsing
+    - debian/patches/CVE-2019-12525.patch: check length in
+      src/auth/digest/Config.cc.
+    - CVE-2019-12525
+  * SECURITY UPDATE: buffer overflow in basic auth decoding
+    - debian/patches/CVE-2019-12527.patch: switch to SBuf in
+      src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+      src/clients/FtpGateway.cc.
+    - CVE-2019-12527
+  * SECURITY UPDATE: basic auth uudecode length issue
+    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+      include/uudecode.h, lib/uudecode.c.
+    - CVE-2019-12529
+  * SECURITY UPDATE: XSS issues in cachemgr.cgi
+    - debian/patches/CVE-2019-13345.patch: properly escape values in
+      tools/cachemgr.cc.
+    - CVE-2019-13345
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 19 Jul 2019 08:01:58 -0400
+
+squid (4.6-2ubuntu3) eoan; urgency=medium
+
+  * Override newly added gcc-9 flags:
+    -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    NOTE: Overriding those flags is a possible security
+    asked for info on the gcc-9 issue bug tracker:
+    https://github.com/squid-cache/squid/pull/413#issuecomment-511314076
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 15 Jul 2019 10:21:47 +0200
+
+squid (4.6-2ubuntu2) eoan; urgency=medium
+
+  * Fix gcc-9 build issues with upstream merged patch
+
+ -- Gianfranco Costamagna <[e-mail]>  Sun, 14 Jul 2019 14:41:16 +0200
+
+squid (4.6-2ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Added Applied-Upstream header]
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+  * Dropped:
+    - d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+      at boot. Thanks to Luigi Gangitano <[e-mail]> (LP #1816006)
+      [Fixed in 4.5-2]
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+      [Fixed upstream]
+    - Add disabled by default AppArmor profile.
+      [Added by Debian in 4.6-2]
+    - d/usr.sbin.squid: fix the apparmor profile (LP #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+      [Fixed in 4.6-2]
+
+ -- Andreas Hasenack <[e-mail]>  Sat, 18 May 2019 14:39:09 -0300
+
 squid (4.6-2) unstable; urgency=high
 
   [ Andreas Hasenack <[e-mail]> ]
@@ -191,6 +466,57 @@ squid (4.5-1) unstable; urgency=medium
 
  -- Luigi Gangitano <[e-mail]>  Wed, 20 Feb 2019 11:57:15 +0100
 
+squid (4.4-1ubuntu2) disco; urgency=medium
+
+  * d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+    at boot. Thanks to Luigi Gangitano <[e-mail]> (LP: #1816006)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 27 Feb 2019 08:54:45 -0300
+
+squid (4.4-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - Add disabled by default AppArmor profile.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+  * Drop:
+    - d/rules: enable cdbs parallel build
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix apparmor profile filename
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+      [Fixed in 4.2-1]
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+      [Fixed in 4.2-1]
+  * Added changes:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - d/usr.sbin.squid: fix the apparmor profile (LP: #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 19 Nov 2018 10:51:18 -0200
+
 squid (4.4-1) unstable; urgency=high
 
   * Urgency high due to security fixes
@@ -255,6 +581,85 @@ squid (4.2-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Wed, 22 Aug 2018 13:57:15 +0200
 
+squid (4.1-1ubuntu3) cosmic; urgency=medium
+
+  * d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+    Thanks to Vitaly Lavrov <[e-mail]>. (LP: #1794553)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 09 Oct 2018 14:00:36 -0300
+
+squid (4.1-1ubuntu2) cosmic; urgency=medium
+
+  * d/usr.sbin.squid: Update apparmor profile to grant read access to squid
+    binary (LP: #1792728)
+
+ -- Simon Deziel <[e-mail]>  Sat, 15 Sep 2018 13:55:32 -0400
+
+squid (4.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merged with Debian unstable (LP: #1780944, LP: #1097032, LP: #16669).
+    Remaining changes:
+    - Use snakeoil certificates.
+      [Updated to use the correct config setting names]
+    - Add an example refresh pattern for debs.
+      [Improved the refresh patterns based on the configuration from
+       squid-deb-proxy package]
+    - Add disabled by default AppArmor profile.
+      [Updated to include the ssl_certs abstraction and suggestions on how to
+       deal with the snakeoil private key and other keys in /etc/ssl.]
+  * Dropped changes:
+    - Add additional dep8 tests.
+      [Adopted in 4.0.21-1~exp5, albeit a stripped down version]
+    - Correct attribution and add explanatory note in d/NEWS.debian.
+      [That particular upgrade path has happened long ago.]
+    - Drop wrong short-circuiting of various invocations; we always want to
+      call the debhelper block.
+      [This was for the transitional squid3 package, and that transition has
+       already happened.]
+    - Revert "Set pidfile for systemd's sysv-generator" from Debian.
+      [Not needed anymore since we have a native systemd service file
+       and no longer rely on the generator.]
+    - Enable autoreconf. This is no longer required for the security updates,
+      but is needed for the seddery of test-suite/Makefile.am in
+      d/t/upstream-test-suite.
+      [Replaced by patch 0003-installed-binary-for-debian-ci.patch]
+    - Adjust seddery for upstream test squid binary location.
+      [sed no longer necessary since patch,
+       0003-installed-binary-for-debian-ci.patch, will be dropped
+       entirely.]
+    - Drop Conflicts/Replaces of squid against squid3. In Ubuntu, the migration
+      happened in Xenial, so no upgrade path still requires this code. This
+      reduces upgrade ordering difficulty.
+      [Again we have a migration, but this time from squid3 to squid, so we
+      need this].
+    - GCC7 FTBFS fixes (LP: #1712668):
+      + d/rules: don't error when hitting the "deprecated" and
+      "format-truncation" gcc7 warnings. Upstream 3.5.27 has fixes for these,
+      but one in Format.cc that affects 32bit builds was deemed too intrusive
+      for the 3.5 stable series and is only in squid 4.x
+      [No longer needed with squid 4.x]
+    - Do not force gcc-6
+      [It was a temporary workaround in Debian that got dropped]
+  * Added changes:
+    - d/rules: enable cdbs parallel build
+    - d/t/test-squid.py: fix apparmor profile filename
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 16 Aug 2018 12:33:17 -0300
+
 squid (4.1-1) unstable; urgency=high
 
   * New Upstream Release (Closes: #896120)
diff --git a/debian/control b/debian/control
index 76e396e..4e90675 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: squid
 Section: web
 Priority: optional
-Maintainer: Luigi Gangitano <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Luigi Gangitano <[e-mail]>
 Uploaders: Santiago Garcia Mantinan <[e-mail]>
 Homepage: http://www.squid-cache.org
 Standards-Version: 4.5.0
@@ -31,7 +32,7 @@ Build-Depends: ed, libltdl-dev, pkg-config
 Package: squid
 Architecture: any
 Pre-Depends: adduser
-Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl
+Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl, ssl-cert
 Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbind, apparmor
 Recommends: libcap2-bin [linux-any], ca-certificates
 Provides: squid3
diff --git a/debian/patches/90-cf.data.ubuntu.patch b/debian/patches/90-cf.data.ubuntu.patch
new file mode 100644
index 0000000..9dfa5b4
--- /dev/null
+++ b/debian/patches/90-cf.data.ubuntu.patch
@@ -0,0 +1,16 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -5859,6 +5862,12 @@ NOCOMMENT_START
+ refresh_pattern ^ftp:		1440	20%	10080
+ refresh_pattern ^gopher:	1440	0%	1440
+ refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
++refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
++refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
++refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++# example pattern for deb packages
++#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
+ refresh_pattern .		0	20%	4320
+ NOCOMMENT_END
+ DOC_END
+
diff --git a/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
new file mode 100644
index 0000000..40b5306
--- /dev/null
+++ b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
@@ -0,0 +1,22 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -3516,6 +3516,19 @@
+ 			reference a PEM file containing both the certificate
+ 			and private key.
+ 	
++	Notes:
++
++	On Debian/Ubuntu systems a default snakeoil certificate is
++	available in /etc/ssl and users can set:
++
++		sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem
++
++	and
++
++		sslkey=/etc/ssl/private/ssl-cert-snakeoil.key
++
++	for testing.
++
+ 	sslcipher=...	The list of valid SSL ciphers to use when connecting
+ 			to this peer.
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 3d19dd9..2f4d2e6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,3 +2,5 @@
 0002-Change-default-file-locations-for-debian.patch
 0003-installed-binary-for-debian-ci.patch
 0004-upstream-bug5041.patch
+90-cf.data.ubuntu.patch
+99-ubuntu-ssl-cert-snakeoil.patch
diff --git a/debian/rules b/debian/rules
index cdcbc24..86cb59e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -7,7 +7,12 @@ ifneq (,$(filter $(DEB_HOST_ARCH), armel m68k mips mipsel powerpc powerpcspe sh4
 	DEB_LDFLAGS_MAINT_APPEND += -latomic
 endif
 export DEB_LDFLAGS_MAINT_APPEND
-
+# On ppc64el, dpkg-buildflags sets -O3 instead of the usual
+# -O2. This makes gcc emit a format-truncation error on
+# pconn.cc. See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH),ppc64el)
+  export DEB_CXXFLAGS_MAINT_APPEND = -Wno-format-truncation
+endif
 export DEB_BUILD_PARALLEL = yes
 include /usr/share/dpkg/buildflags.mk
 -include /usr/share/dpkg/buildtools.mk
diff --git a/debian/usr.sbin.squid b/debian/usr.sbin.squid
index 6f5c814..3a26150 100644
--- a/debian/usr.sbin.squid
+++ b/debian/usr.sbin.squid
@@ -48,6 +48,39 @@
   # squid-langpack
   /usr/share/squid-langpack/** r,
 
+  # maas-proxy
+  /var/lib/maas/maas-proxy.conf r,
+  /var/log/maas/proxy/** rw,
+  /var/spool/maas-proxy/ r,
+  /var/spool/maas-proxy/** rwk,
+
+  # squid-deb-proxy
+  /etc/squid-deb-proxy/** r,
+  /{,var/}run/squid-deb-proxy.pid rwk,
+  /var/cache/squid-deb-proxy/ r,
+  /var/cache/squid-deb-proxy/** rwk,
+  /var/log/squid-deb-proxy/* rw,
+
+  # squidguard
+  /usr/bin/squidGuard Cx -> squidguard,
+  profile squidguard {
+    #include <abstractions/base>
+
+    /etc/squid/squidGuard.conf r,
+    /var/log/squid{,3}/squidGuard.log w,
+    /var/lib/squidguard/** rw,
+
+    # squidguard by default uses /var/log/squid as its logdir, however, we
+    # don't want it to access squid's logs, only its own. Explicitly deny
+    # access to squid's files but allow all others since the user may specify
+    # anything for the squidGurad 'log' directive.
+    /var/log/squid{,3}/* rw,
+    audit deny /var/log/squid{,3}/{access,cache,store}.log* rw,
+
+    # Site-specific additions and overrides. See local/README for details.
+    #include <local/usr.sbin.squid>
+  }
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.squid>
 }