Merge ~danilogondolfo/ubuntu/+source/curl:merge_lunar_7.88.1_1 into ubuntu/+source/curl:debian/sid

[Danilo Egea Gondolfo]

[Simon Quigley (tsimonq2)]

Looks to be sponsored already, thanks!

review: Approve

Unmerged commits

7b80a18... by Danilo Egea Gondolfo on 2023-02-22

Update changelog

985ce9f... by Danilo Egea Gondolfo on 2023-02-22

Drop patch for CVEs fixed upsteam

 - debian/patches/CVE-2023-23914_5-1.patch
 - debian/patches/CVE-2023-23914_5-2.patch
 - debian/patches/CVE-2023-23914_5-3.patch
 - debian/patches/CVE-2023-23914_5-4.patch
 - debian/patches/CVE-2023-23914_5-5.patch
 - debian/patches/CVE-2023-23916.patch

92e3abf... by Danilo Egea Gondolfo on 2023-02-22

Merge branch 'ubuntu/devel' into merge_lunar_7.88.1_1

3827db7... by Marc Deslauriers on 2023-02-17

7.87.0-2ubuntu2 (patches unapplied)

Imported using git-ubuntu import.

ace56a5... by Gianfranco Costamagna on 2023-02-01

7.87.0-2ubuntu1 (patches unapplied)

Imported using git-ubuntu import.

diff --git a/debian/changelog b/debian/changelog
index 98efe4f..d2b0a15 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,19 @@
+curl (7.88.1-1ubuntu1) lunar; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    + Drop patches for CVEs fixed upsteam.
+      - debian/patches/CVE-2023-23914_5-1.patch
+      - debian/patches/CVE-2023-23914_5-2.patch
+      - debian/patches/CVE-2023-23914_5-3.patch
+      - debian/patches/CVE-2023-23914_5-4.patch
+      - debian/patches/CVE-2023-23914_5-5.patch
+      - debian/patches/CVE-2023-23916.patch
+    + Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Wed, 22 Feb 2023 17:14:26 +0000
+
 curl (7.88.1-1) unstable; urgency=medium
 
   * New upstream version 7.88.1
@@ -12,6 +28,41 @@ curl (7.88.1-1) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Mon, 20 Feb 2023 22:35:53 +0000
 
+curl (7.87.0-2ubuntu2) lunar; urgency=medium
+
+  * SECURITY UPDATE: multiple HSTS issues
+    - debian/patches/CVE-2023-23914_5-1.patch: add sharing of HSTS cache
+      among handles in docs/libcurl/opts/CURLSHOPT_SHARE.3,
+      docs/libcurl/symbols-in-versions, include/curl/curl.h, lib/hsts.c,
+      lib/hsts.h, lib/setopt.c, lib/share.c, lib/share.h, lib/transfer.c,
+      lib/url.c, lib/urldata.h.
+    - debian/patches/CVE-2023-23914_5-2.patch: share HSTS between handles
+      in src/tool_operate.c.
+    - debian/patches/CVE-2023-23914_5-3.patch: handle adding the same host
+      name again in lib/hsts.c.
+    - debian/patches/CVE-2023-23914_5-4.patch: support crlf="yes" for
+      verify/proxy in tests/FILEFORMAT.md, tests/runtests.pl.
+    - debian/patches/CVE-2023-23914_5-5.patch: verify hsts with two URLs in
+      tests/data/Makefile.inc, tests/data/test446.
+    - CVE-2023-23914
+    - CVE-2023-23915
+  * SECURITY UPDATE: HTTP multi-header compression denial of service
+    - debian/patches/CVE-2023-23916.patch: do not reset stage counter for
+      each header in lib/content_encoding.c, lib/urldata.h,
+      tests/data/Makefile.inc, tests/data/test387, tests/data/test418.
+    - CVE-2023-23916
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 17 Feb 2023 08:19:10 -0500
+
+curl (7.87.0-2ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 01 Feb 2023 11:24:47 +0100
+
 curl (7.87.0-2) unstable; urgency=medium
 
   * d/patches: Add new upstream patch to fix regression in setopt/getinfo
@@ -20,6 +71,14 @@ curl (7.87.0-2) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Sun, 15 Jan 2023 21:12:09 +0000
 
+curl (7.87.0-1ubuntu1) lunar; urgency=medium
+
+  * Don't build-depend on python3-impacket on i386 so we can drop it 
+    (and its dependencies) from the i386 partial port.  It's only used for
+    the tests, which do not block the build in any case.
+
+ -- Steve Langasek <[e-mail]>  Sun, 08 Jan 2023 00:40:54 +0000
+
 curl (7.87.0-1) unstable; urgency=medium
 
   * New upstream version 7.87.0
diff --git a/debian/control b/debian/control
index d2bd703..b1efa30 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: curl
 Section: web
 Priority: optional
-Maintainer: Alessandro Ghedini <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Alessandro Ghedini <[e-mail]>
 Uploaders: Samuel Henrique <[e-mail]>,
            Sergio Durigan Junior <[e-mail]>
 Build-Depends:
@@ -27,7 +28,7 @@ Build-Depends:
  libzstd-dev,
  openssh-server <!nocheck>,
  python3:native <!nocheck>,
- python3-impacket <!nocheck>,
+ python3-impacket [!i386] <!nocheck>,
  quilt,
  stunnel4 <!nocheck>,
  zlib1g-dev
diff --git a/debian/rules b/debian/rules
index 7bf6124..a1e6f80 100755
--- a/debian/rules
+++ b/debian/rules
@@ -5,6 +5,7 @@ export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 
 DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
 DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
+DEB_HOST_ARCH ?= $(shell dpkg-architecture -qDEB_HOST_ARCH)
 
 CONFIGURE_ARGS = -- --disable-dependency-tracking		\
 	--disable-symbol-hiding --enable-versioned-symbols	\