Merge ~danilogondolfo/ubuntu/+source/curl:merge-lp2045886-noble-2 into ubuntu/+source/curl:debian/sid

[Danilo Egea Gondolfo]

PPA https://launchpad.net/~danilogondolfo/+archive/ubuntu/curl/

Autopkgtests

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/amd64/c/curl/20240102_122843_9ee06@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/arm64/c/curl/20240102_123245_77bd4@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/armhf/c/curl/20240102_122811_77bd4@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/ppc64el/c/curl/20240102_123001_f4777@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/s390x/c/curl/20240102_124207_33e33@/log.gz

The last one shows an error in the end but it's due to infrastructure issues, the tests passed.

[Simon Quigley (tsimonq2)]

review: Approve

Unmerged commits

596ed45... by Danilo Egea Gondolfo on 2024-01-02

 Changelog

Also, add a missing : to the previous entry.

9b8a5e9... by Danilo Egea Gondolfo on 2024-01-02

update-maintainer

107ccae... by Danilo Egea Gondolfo on 2024-01-02

reconstruct-changelog

d2124b5... by Danilo Egea Gondolfo on 2024-01-02

merge-changelogs

4d0b94f... by Danilo Egea Gondolfo on 2023-11-01

debian/control

Don't build-depend on python3-impacket on i386 so we can drop it
(and its dependencies) from the i386 partial port. It's only used for
the tests, which do not block the build in any case.

diff --git a/debian/changelog b/debian/changelog
index 6a1a6b8..119ef87 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+curl (8.5.0-2ubuntu1) noble; urgency=medium
+
+  * Merge with Debian unstable (LP: #2045886). Remaining changes:
+    - debian/control: Don't build-depend on python3-impacket on i386
+      so we can drop it (and its dependencies) from the i386 partial port.
+      It's only used for the tests, which do not block the build in any case.
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Tue, 02 Jan 2024 09:32:27 +0000
+
 curl (8.5.0-2) unstable; urgency=medium
 
   * d/p/openldap_fix_an_LDAP_crash.patch: New patch to fix ldap segfault
@@ -25,6 +34,22 @@ curl (8.5.0-1) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Wed, 06 Dec 2023 20:15:49 +0000
 
+curl (8.4.0-2ubuntu1) noble; urgency=medium
+
+  * Merge from Debian unstable (LP: #2039798). Remaining changes:
+    - debian/control: Don't build-depend on python3-impacket on i386
+      so we can drop it (and its dependencies) from the i386 partial port.
+      It's only used for the tests, which do not block the build in any case.
+  * Drop patches for CVEs fixed upstream:
+    - debian/patches/CVE-2023-38039.patch
+    - debian/patches/CVE-2023-38545.patch
+    - debian/patches/CVE-2023-38546.patch
+  * Drop delta merged in Debian:
+    - debian/tests/control
+    - debian/tests/curl-ldapi-test
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Wed, 01 Nov 2023 12:06:23 +0000
+
 curl (8.4.0-2) unstable; urgency=medium
 
   * d/rules: set CURL_PATCHSTAMP to package's version, so it shows up in
@@ -84,6 +109,46 @@ curl (8.2.1-2) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Fri, 25 Aug 2023 20:05:02 +0100
 
+curl (8.2.1-1ubuntu3.1) mantic-security; urgency=medium
+
+  * SECURITY UPDATE: SOCKS5 heap buffer overflow
+    - debian/patches/CVE-2023-38545.patch: return error if hostname too
+      long for remote resolve in lib/socks.c, tests/data/Makefile.inc,
+      tests/data/test728.
+    - CVE-2023-38545
+  * SECURITY UPDATE: cookie injection with none file
+    - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields
+      in lib/cookie.c, lib/cookie.h, lib/easy.c.
+    - CVE-2023-38546
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 03 Oct 2023 20:03:05 -0400
+
+curl (8.2.1-1ubuntu3) mantic; urgency=medium
+
+  * SECURITY UPDATE: HTTP headers eat all memory
+    - debian/patches/CVE-2023-38039.patch: return error when receiving too
+      large header set in lib/c-hyper.c, lib/cf-h1-proxy.c, lib/http.c,
+      lib/http.h, lib/pingpong.c, lib/urldata.h.
+    - CVE-2023-38039
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 11 Sep 2023 09:05:17 -0400
+
+curl (8.2.1-1ubuntu2) mantic; urgency=medium
+
+  * d/t/control, d/t/curl-ldapi-test: move test-command to an actual
+    test script and add a retry logic (LP: #2030911)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 09 Aug 2023 17:10:40 -0300
+
+curl (8.2.1-1ubuntu1) mantic; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Sat, 05 Aug 2023 16:06:26 +0200
+
 curl (8.2.1-1) unstable; urgency=medium
 
   [ Samuel Henrique ]
@@ -124,6 +189,15 @@ curl (7.88.1-11) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Fri, 28 Jul 2023 21:11:25 +0100
 
+curl (7.88.1-10ubuntu1) mantic; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 19 May 2023 08:46:54 +0200
+
 curl (7.88.1-10) unstable; urgency=medium
 
   * Add new patches to fix CVEs (closes: #1036239):
@@ -136,6 +210,15 @@ curl (7.88.1-10) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Thu, 18 May 2023 23:43:40 +0100
 
+curl (7.88.1-9ubuntu1) mantic; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Tue, 02 May 2023 08:47:52 +0200
+
 curl (7.88.1-9) unstable; urgency=medium
 
   [ Sergio Durigan Junior ]
@@ -150,6 +233,15 @@ curl (7.88.1-9) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Sat, 15 Apr 2023 20:03:44 +0100
 
+curl (7.88.1-8ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 27 Mar 2023 07:50:29 +0200
+
 curl (7.88.1-8) unstable; urgency=medium
 
   [ Samuel Henrique ]
@@ -163,6 +255,15 @@ curl (7.88.1-8) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Sun, 26 Mar 2023 11:36:24 +0100
 
+curl (7.88.1-7ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 22 Mar 2023 11:51:25 +0100
+
 curl (7.88.1-7) unstable; urgency=medium
 
   * Bump Standards-Version to 4.6.2
@@ -178,6 +279,15 @@ curl (7.88.1-7) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Tue, 21 Mar 2023 22:39:05 +0000
 
+curl (7.88.1-6ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 13 Mar 2023 10:10:19 +0100
+
 curl (7.88.1-6) unstable; urgency=medium
 
   * d/rules: Ignore test results from tests that fail on IPv6-only builders
@@ -230,6 +340,22 @@ curl (7.88.1-2) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Fri, 03 Mar 2023 08:28:19 +0000
 
+curl (7.88.1-1ubuntu1) lunar; urgency=medium
+
+  * Merge from Debian unstable (LP: #2008123). Remaining changes:
+    + Drop patches for CVEs fixed upsteam.
+      - debian/patches/CVE-2023-23914_5-1.patch
+      - debian/patches/CVE-2023-23914_5-2.patch
+      - debian/patches/CVE-2023-23914_5-3.patch
+      - debian/patches/CVE-2023-23914_5-4.patch
+      - debian/patches/CVE-2023-23914_5-5.patch
+      - debian/patches/CVE-2023-23916.patch
+    + Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Wed, 22 Feb 2023 17:14:26 +0000
+
 curl (7.88.1-1) unstable; urgency=medium
 
   * New upstream version 7.88.1
@@ -244,6 +370,41 @@ curl (7.88.1-1) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Mon, 20 Feb 2023 22:35:53 +0000
 
+curl (7.87.0-2ubuntu2) lunar; urgency=medium
+
+  * SECURITY UPDATE: multiple HSTS issues
+    - debian/patches/CVE-2023-23914_5-1.patch: add sharing of HSTS cache
+      among handles in docs/libcurl/opts/CURLSHOPT_SHARE.3,
+      docs/libcurl/symbols-in-versions, include/curl/curl.h, lib/hsts.c,
+      lib/hsts.h, lib/setopt.c, lib/share.c, lib/share.h, lib/transfer.c,
+      lib/url.c, lib/urldata.h.
+    - debian/patches/CVE-2023-23914_5-2.patch: share HSTS between handles
+      in src/tool_operate.c.
+    - debian/patches/CVE-2023-23914_5-3.patch: handle adding the same host
+      name again in lib/hsts.c.
+    - debian/patches/CVE-2023-23914_5-4.patch: support crlf="yes" for
+      verify/proxy in tests/FILEFORMAT.md, tests/runtests.pl.
+    - debian/patches/CVE-2023-23914_5-5.patch: verify hsts with two URLs in
+      tests/data/Makefile.inc, tests/data/test446.
+    - CVE-2023-23914
+    - CVE-2023-23915
+  * SECURITY UPDATE: HTTP multi-header compression denial of service
+    - debian/patches/CVE-2023-23916.patch: do not reset stage counter for
+      each header in lib/content_encoding.c, lib/urldata.h,
+      tests/data/Makefile.inc, tests/data/test387, tests/data/test418.
+    - CVE-2023-23916
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 17 Feb 2023 08:19:10 -0500
+
+curl (7.87.0-2ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 01 Feb 2023 11:24:47 +0100
+
 curl (7.87.0-2) unstable; urgency=medium
 
   * d/patches: Add new upstream patch to fix regression in setopt/getinfo
@@ -252,6 +413,14 @@ curl (7.87.0-2) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Sun, 15 Jan 2023 21:12:09 +0000
 
+curl (7.87.0-1ubuntu1) lunar; urgency=medium
+
+  * Don't build-depend on python3-impacket on i386 so we can drop it 
+    (and its dependencies) from the i386 partial port.  It's only used for
+    the tests, which do not block the build in any case.
+
+ -- Steve Langasek <[e-mail]>  Sun, 08 Jan 2023 00:40:54 +0000
+
 curl (7.87.0-1) unstable; urgency=medium
 
   * New upstream version 7.87.0
diff --git a/debian/control b/debian/control
index 953ffb4..caf606a 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: curl
 Section: web
 Priority: optional
-Maintainer: Debian Curl Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Curl Maintainers <[e-mail]>
 Uploaders: Carlos Henrique Lima Melara <[e-mail]>,
            Samuel Henrique <[e-mail]>,
            Sergio Durigan Junior <[e-mail]>
@@ -28,7 +29,7 @@ Build-Depends:
  locales-all <!nocheck>,
  openssh-server <!nocheck>,
  python3:native <!nocheck>,
- python3-impacket <!nocheck>,
+ python3-impacket [!i386] <!nocheck>,
  gnutls-bin [amd64 arm64 armel armhf i386 mips64el mipsel s390x powerpc ppc64 riscv64] <!nocheck>,
  quilt,
  stunnel4 <!nocheck>,