Merge ~paelzer/ubuntu/+source/dovecot:merge-cosmic-2.3.1-transitional into ubuntu/+source/dovecot:debian/experimental

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Pushed extra tags:
 * [new tag] lp1771524/deconstruct/1%2.2.33.2-1ubuntu4 -> lp1771524/deconstruct/1%2.2.33.2-1ubuntu4
 * [new tag] lp1771524/new/debian -> lp1771524/new/debian
 * [new tag] lp1771524/old/ubuntu -> lp1771524/old/ubuntu
 * [new tag] lp1771524/logical/1%2.2.33.2-1ubuntu4 -> lp1771524/logical/1%2.2.33.2-1ubuntu4
 * [new tag] lp1771524/old/debian -> lp1771524/old/debian
 * [new tag] lp1771524/reconstruct/1%2.2.33.2-1ubuntu4 -> lp1771524/reconstruct/1%2.2.33.2-1ubuntu4

Please do realize this is intentionally against experimental!

Also many details in bug 1771524
And this is preliminary waiting for answers on https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896674

[Christian Ehrhardt  (paelzer)]

Reconsidered autopkgtests (details in the related merge bug) and force-pushed a reduced set of changes.

a5911d4... by Christian Ehrhardt  on 2018-05-17

- d/p/dovecot-2.3.1-fix-pam.patch: fix pam auth in 2.3.1 systemd service

Signed-off-by: Christian Ehrhardt <email address hidden>

6782c64... by Christian Ehrhardt  on 2018-05-17

changelog: fix pam auth in 2.3.1 systemd service

Signed-off-by: Christian Ehrhardt <email address hidden>

[Christian Ehrhardt  (paelzer)]

Fixed issues around pam login that I found in tests, new commit for that pushed to this MP

[Christian Ehrhardt  (paelzer)]

With so much in flight, lets un-mark for-review until I know better from Debian.
Also 2.3.1 has plenty of issues it seems, might need to wait for a later 2.3.x

I'll propose a 2.2 based MP soon as an alternative for now.

[Christian Ehrhardt  (paelzer)]

We are doing this from scratch to 2.3.2.1 and starting from the much cleaned up latest 2.2 I have put into Cosmic.

Unmerged commits

6782c64... by Christian Ehrhardt  on 2018-05-17

changelog: fix pam auth in 2.3.1 systemd service

Signed-off-by: Christian Ehrhardt <email address hidden>

a5911d4... by Christian Ehrhardt  on 2018-05-17

- d/p/dovecot-2.3.1-fix-pam.patch: fix pam auth in 2.3.1 systemd service

Signed-off-by: Christian Ehrhardt <email address hidden>

3b2b469... by Christian Ehrhardt  on 2018-05-16

changelog: carry mail-stack-delivery as empty transitional package

Signed-off-by: Christian Ehrhardt <email address hidden>

23490bd... by Christian Ehrhardt  on 2018-05-16

carry mail-stack-delivery as empty transitional package

Signed-off-by: Christian Ehrhardt <email address hidden>

a111ea1... by Christian Ehrhardt  on 2018-05-16

changelog: merge as 1:2.3.1-1ubuntu1

Signed-off-by: Christian Ehrhardt <email address hidden>

88f8f48... by Christian Ehrhardt  on 2018-05-16

update-maintainer

6a1cf21... by Christian Ehrhardt  on 2018-05-16

merge-changelogs

diff --git a/debian/changelog b/debian/changelog
index 2d7d644..0c0acc9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,56 @@
+dovecot (1:2.3.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1771524). Remaining changes:
+  * Dropped Changes (now upstream)
+    - SECURITY UPDATE: rfc822_parse_domain Information Leak Vulnerability
+    - SECURITY UPDATE: TLS SNI config lookups DoS
+    - SECURITY UPDATE: Memory leak that can cause crash due to memory exhaustion
+  * Dropped Changes (no more needed after 18.04)
+    - handle conffile removal of /etc/init/dovecot.conf (due to dropping
+      upstart).
+  * Dropped Changes (no more needed)
+    - Drop build dependency on libstemmer-dev (universe) - this is now in main
+    - Disable dovecot-lucene plugin as it had various issues and is deprecated
+      in favor of solr anyway (LP 1524526) - no more failing in Cosmic.
+    - Add updated autopkgtest to debian/tests/* (stop these test being an
+      outdated redundancy to git+ssh://git.launchpad.net/qa-regression-testing)
+      This also avoids these tests being flaky to stop migration (LP: #1638865)
+  * Dropped Changes (mail-stack-delivery)
+    It was decided to no more carry mail-stack-delivery as a package in favor
+    to out-of-package solutions. It became less useful due to one of the
+    biggest benefit (auto-ssl setup) being part of the base setup now.
+    - Add mail-stack-delivery
+      - add package in d/rules, d/control
+      - add d/*mail-stack-delivery* maintainer scripts and default conf
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.README.Debian clarified use of configuration files
+    - d/mail-stack-delivery.postinst: Use ssl key/cert paths now set up by
+      dovecot-core; transition for such configs formerly set up by
+      mail-stack-delivery to use the new default ssl config (if user had no
+      conffile change or choses new defaults).
+    - d/mail-stack-delivery.postinst: if moving dovecot to the new defaults on
+      upgrade, also move the related postfix key/cert entries.
+    - debian/99-mail-stack-delivery.conf: do not explicitly enable protocols
+      as all installed are auto-included from the base config now.
+    - adapt autopkgtests to match new version.
+    - d/control: for the ssl transition to work we need to ensure dovecot-core
+      is complete before upgrading mail-stack-delivery, so add a Pre-Depends.
+    - d/mail-stack-delivery.postinst: add SSL_CERT/SSL_KEY detection to
+      postconf section (was formerly initialized at the now dropped key setup)
+    - d/mail-stack-delivery.postinst: fix SSL_CERT/SSL_KEY detection to only
+      read non-comments from the right keywords and to strip common bad-chars
+    - d/mail-stack-delivery.postinst: stop modifying mandatory tls config,
+      recent upstream has sane defaults now
+    - debian/99-mail-stack-delivery.conf: drop explicit ssl_cipher_list,
+      recent upstream has sane defaults now
+  * Added Changes:
+    - carry mail-stack-delivery as empty transitional package
+      (can be dropped >20.04)
+    - d/p/dovecot-2.3.1-fix-pam.patch: fix pam auth in 2.3.1 systemd service
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 16 May 2018 14:40:19 +0200
+
 dovecot (1:2.3.1-1) experimental; urgency=medium
 
   * [d07381b] New upstream version 2.3.1
@@ -97,6 +150,77 @@ dovecot (1:2.2.34-1) unstable; urgency=medium
 
  -- Apollon Oikonomopoulos <[e-mail]>  Thu, 01 Mar 2018 10:55:49 +0200
 
+dovecot (1:2.2.33.2-1ubuntu4) bionic; urgency=medium
+
+  * SECURITY UPDATE: rfc822_parse_domain Information Leak Vulnerability
+    - debian/patches/CVE-2017-14461/*.patch: upstream parsing fixes.
+    - CVE-2017-14461
+  * SECURITY UPDATE: TLS SNI config lookups DoS
+    - debian/patches/CVE-2017-15130/*.patch: upstream config filtering fix.
+    - CVE-2017-15130
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 26 Feb 2018 12:34:24 -0500
+
+dovecot (1:2.2.33.2-1ubuntu3) bionic; urgency=medium
+
+  * SECURITY UPDATE: Memory leak that can cause crash due to memory exhaustion
+    - debian/patches/CVE-2017-15132.patch: fix memory leak in
+      auth_client_request_abort() in src/lib-auth/auth-client-request.c.
+    - debian/patches/CVE-2017-15132-additional.patch: remove request after
+      abort in src/lib-auth/auth-client-request.c,
+      src/lib-auth/auth-server-connection.c,
+      src/lib-auth/auth-serser-connection.h.
+    - CVE-2017-15132
+
+ -- Leonidas S. Barbosa <[e-mail]>  Fri, 23 Feb 2018 09:49:11 -0500 
+
+dovecot (1:2.2.33.2-1ubuntu2) bionic; urgency=high
+
+  * No change rebuild against openssl1.1.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 06 Feb 2018 12:41:35 +0000
+
+dovecot (1:2.2.33.2-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Add updated autopkgtest to debian/tests/*.
+    - Drop build dependency on libstemmer-dev (universe)
+    - Add mail-stack-delivery
+      - add package in d/rules, d/control
+      - add d/*mail-stack-delivery* maintainer scripts and default conf
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.README.Debian clarified use of configuration files
+    - handle conffile removal of /etc/init/dovecot.conf (due to dropping
+      upstart). Can be removed once no upgrade path from <yakkety is left.
+    - Disable dovecot-lucene plugin as it had various issues and is deprecated
+      in favor of solr anyway (LP 1524526).
+  * Dropped changes (in Debian):
+    - Use Snakeoil SSL certificates by default
+      - d/control: Depend on ssl-cert
+  * Added changes:
+    - d/mail-stack-delivery.postinst: Use ssl key/cert paths now set up by
+      dovecot-core; transition for such configs formerly set up by
+      mail-stack-delivery to use the new default ssl config (if user had no
+      conffile change or choses new defaults).
+    - d/mail-stack-delivery.postinst: if moving dovecot to the new defaults on
+      upgrade, also move the related postfix key/cert entries.
+    - debian/99-mail-stack-delivery.conf: do not explicitly enable protocols
+      as all installed are auto-included from the base config now.
+    - adapt autopkgtests to match new version.
+    - d/control: for the ssl transition to work we need to ensure dovecot-core
+      is complete before upgrading mail-stack-delivery, so add a Pre-Depends.
+    - d/mail-stack-delivery.postinst: add SSL_CERT/SSL_KEY detection to
+      postconf section (was formerly initialized at the now dropped key setup)
+    - d/mail-stack-delivery.postinst: fix SSL_CERT/SSL_KEY detection to only
+      read non-comments from the right keywords and to strip common bad-chars
+    - d/mail-stack-delivery.postinst: stop modifying mandatory tls config,
+      recent upstream has sane defaults now
+    - debian/99-mail-stack-delivery.conf: drop explicit ssl_cipher_list,
+      recent upstream has sane defaults now
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 16 Aug 2017 16:50:29 +0200
+
 dovecot (1:2.2.33.2-1) unstable; urgency=medium
 
   * [8216f38] New upstream version 2.2.33.2
@@ -183,6 +307,28 @@ dovecot (1:2.2.30.2-1) unstable; urgency=medium
 
  -- Apollon Oikonomopoulos <[e-mail]>  Thu, 22 Jun 2017 22:22:59 +0300
 
+dovecot (1:2.2.27-3ubuntu1) artful; urgency=medium
+
+  * Merge with Debian; Remaining Changes:
+    + Add updated autopkgtest to debian/tests/*.
+    + Drop build dependency on libstemmer-dev (universe)
+    + Use Snakeoil SSL certificates by default
+      - d/control: Depend on ssl-cert
+    + Add mail-stack-delivery
+      - add package in d/rules, d/control
+      - add d/*mail-stack-delivery* maintainer scripts and default conf
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.README.Debian clarified use of configuration files
+    + Disable dovecot-lucene plugin as it had various issues, has universe
+      dependencies and is deprecated in favor of solr anyway.
+    + handle conffile removal of /etc/init/dovecot.conf (due to dropping
+      upstart). Can be removed once no upgrade path from <yakkety is left.
+  * Dropped changes:
+    - SECURITY UPDATE (CVE-2017-2669): DoS via crafted username (is in Debian)
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 28 Apr 2017 11:12:48 +0200
+
 dovecot (1:2.2.27-3) unstable; urgency=high
 
   * [117285a] Remove /etc/dovecot/README (Closes: #849290)
@@ -191,6 +337,38 @@ dovecot (1:2.2.27-3) unstable; urgency=high
 
  -- Apollon Oikonomopoulos <[e-mail]>  Tue, 11 Apr 2017 00:46:54 +0300
 
+dovecot (1:2.2.27-2ubuntu2) zesty; urgency=medium
+
+  * SECURITY UPDATE: DoS via crafted username
+    - debian/patches/CVE-2017-2669.patch: do not double-expand key in
+      passdb dict when authenticating in src/auth/db-dict.c.
+    - CVE-2017-2669
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 07 Apr 2017 13:31:02 -0400
+
+dovecot (1:2.2.27-2ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian; Remaining Changes:
+    + Add updated autopkgtest to debian/tests/*.
+    + Drop build dependency on libstemmer-dev (universe)
+    + Use Snakeoil SSL certificates by default
+      - d/control: Depend on ssl-cert
+    + Add mail-stack-delivery
+      - add package in d/rules, d/control
+      - add d/*mail-stack-delivery* maintainer scripts and default conf
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.README.Debian clarified use of configuration files
+    + Disable dovecot-lucene plugin as it had various issues, has universe
+      dependencies and is deprecated in favor of solr anyway.
+    + handle conffile removal of /etc/init/dovecot.conf (due to dropping
+      upstart). Can be removed once no upgrade path from <yakkety is left.
+  * Dropped changes:
+    + Fix FTBFS of dovecot 2.2.25 in Ubuntu due to being incompatible with
+      -Bsymbolic-functions linker flag (in Debian).
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 09 Feb 2017 15:24:55 +0100
+
 dovecot (1:2.2.27-2) unstable; urgency=medium
 
   * [30586e3] Fix SHA3 on big-endian architectures.
@@ -252,6 +430,47 @@ dovecot (1:2.2.26.0-1) unstable; urgency=medium
 
  -- Apollon Oikonomopoulos <[e-mail]>  Thu, 07 Jul 2016 10:17:58 +0200
 
+dovecot (1:2.2.25-1ubuntu2) zesty; urgency=medium
+
+  * Update "general" dep8 test with various cleanups, bugfixes and conversion
+    to Python 3. Since it now uses the "service" wrapper, the test must
+    additionally depend on init-system-helpers.
+
+ -- Robie Basak <[e-mail]>  Tue, 08 Nov 2016 13:37:08 +0000
+
+dovecot (1:2.2.25-1ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian (LP: #1633220); Remaining Changes:
+    + Add updated autopkgtest to debian/tests/*.
+    + Drop build dependency on libstemmer-dev (universe)
+    + Use Snakeoil SSL certificates by default
+      - d/control: Depend on ssl-cert
+    + Add mail-stack-delivery
+      - add package in d/rules, d/control
+      - add d/*mail-stack-delivery* maintainer scripts and default conf
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.README.Debian clarified use of configuration files
+    + Disable dovecot-lucene plugin as it had various issues, has universe
+      dependencies and is deprecated in favor of solr anyway.
+    + handle conffile removal of /etc/init/dovecot.conf (due to dropping
+      upstart). Can be removed once no upgrade path from <yakkety is left.
+  * Added changes:
+    + Fix FTBFS of dovecot 2.2.25 in Ubuntu due to being incompatible with
+      -Bsymbolic-functions linker flag (LP: #1636781).
+  * Dropped Changes as they got accepted in Debian:
+    + add lsb base dependency to ensure debian/dovecot-core.dovecot.init is
+      working correctly
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Remove lintian override for drac
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 25 Oct 2016 13:12:40 +0200
+
 dovecot (1:2.2.25-1) unstable; urgency=medium
 
   * [cc29a81] Imported Upstream version 2.2.25
@@ -265,6 +484,47 @@ dovecot (1:2.2.25-1) unstable; urgency=medium
 
  -- Jaldhar H. Vyas <[e-mail]>  Fri, 01 Jul 2016 17:07:03 -0400
 
+dovecot (1:2.2.24-1ubuntu1) yakkety; urgency=medium
+
+  * Merge with Debian; Remaining Changes:
+    + Add autopkgtest to debian/tests/*.
+    + Drop build dependency on libstemmer-dev (universe)
+    + Use Snakeoil SSL certificates by default
+      - d/control: Depend on ssl-cert
+    + add lsb base dependency to ensure debian/dovecot-core.dovecot.init is
+      working correctly
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Remove lintian override for drac
+    + Add mail-stack-delivery
+      - add package in d/rules, d/control
+      - add d/*mail-stack-delivery* maintainer scripts and default conf
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+  * Added Changes:
+    - Disable dovecot-lucene plugin as it had various issues, has universe
+      dependencies and is deprecated in favor of solr anyway (LP: #1524526).
+    - Fixup the autopkgtests we add to work with recent dovecot versions
+    - d/mail-stack-delivery.README.Debian clarified use of configuration files
+    - handle conffile removal of /etc/init/dovecot.conf (due to dropping
+      upstart). Can be removed once no upgrade path from <yakkety is left.
+  * Dropped Changes:
+    - Add upstart job (that means we no more add it now)
+    - no more needed upgrade handling of mail-stack-delivery related to
+      2.1.7-7 and 1.2.9-1ubuntu8 (both out of scope of any possible
+      paths now)
+    - d/dovecot-core.dirs: Added usr/share/doc/dovecot-core (was only left
+      in changelog)
+    - ntpdate Recommends (was missing in former Changelog, now superseded
+      by timesyncd which is available by default)
+    - adding of d/docs for dh_installdocs
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 21 Jun 2016 16:31:29 +0200
+
 dovecot (1:2.2.24-1) unstable; urgency=medium
 
   * [26020b6] Imported Upstream version 2.2.24 (Closes: #818652)
@@ -281,6 +541,61 @@ dovecot (1:2.2.23-1) unstable; urgency=medium
 
  -- Apollon Oikonomopoulos <[e-mail]>  Tue, 12 Apr 2016 17:30:03 +0300
 
+dovecot (1:2.2.22-1ubuntu4) xenial; urgency=medium
+
+  * Urgh. Previous upload added a runtime dependency on libstemmer0d to
+    dovecot-core that I missed. Revert it, and reopen LP: 1524526.
+
+ -- Christopher James Halse Rogers <[e-mail]>  Thu, 21 Apr 2016 09:59:28 +1000
+
+dovecot (1:2.2.22-1ubuntu3) xenial; urgency=medium
+
+  * Re-add build dependency on libstemmer-dev
+    - In universe, but only adds runtime dependencies to packages already in
+      universe.
+    - Fixes crash with missing symbol when enabling fts-lucene plugin
+      (LP: #1524526)
+
+ -- Christopher James Halse Rogers <[e-mail]>  Wed, 20 Apr 2016 12:44:08 +1000
+
+dovecot (1:2.2.22-1ubuntu2) xenial; urgency=medium
+
+  * Rebuild against libmysqlclient20.
+
+ -- Robie Basak <[e-mail]>  Tue, 05 Apr 2016 12:19:25 +0000
+
+dovecot (1:2.2.22-1ubuntu1) xenial; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    + Add mail-stack-delivery package:
+      - Update d/rules
+      - d/control: convert existing dovecot-postfix package to a dummy
+        package and add new mail-stack-delivery package.
+      - Update maintainer scripts.
+      - Rename d/dovecot-postfix.* to debian/mail-stack-delivery.*
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.prerm: Added to handle downgrades.
+    + Use Snakeoil SSL certificates by default:
+      - d/control: Depend on ssl-cert.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + d/dovecot-core.dirs: Added usr/share/doc/dovecot-core
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Add upstart job:
+      - d/rules, d/dovecot-core.dovecot.upstart, d/control,
+        d/dovecot-core.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        d/dovecot-pop3d.{postinst, postrm, prerm}.
+        d/mail-stack-deliver.postinst: Convert init script to upstart.
+    + d/control: Drop dovecot-postfix package as its no longer required.
+    + Drop build dependency on libstemmer-dev (universe).
+
+ -- Matthias Klose <[e-mail]>  Mon, 21 Mar 2016 19:44:11 +0100
+
 dovecot (1:2.2.22-1) unstable; urgency=medium
 
   [ Jaldhar H. Vyas ]
@@ -342,6 +657,40 @@ dovecot (1:2.2.19-1) UNRELEASED; urgency=medium
 
  -- Jaldhar H. Vyas <[e-mail]>  Sun, 13 Dec 2015 09:41:56 -0500
 
+dovecot (1:2.2.18-2ubuntu2) wily; urgency=medium
+
+  * Merge with Debian (after 552 days); remaining changes:
+    + Add mail-stack-delivery package:
+      - Update d/rules
+      - d/control: convert existing dovecot-postfix package to a dummy
+        package and add new mail-stack-delivery package.
+      - Update maintainer scripts.
+      - Rename d/dovecot-postfix.* to debian/mail-stack-delivery.*
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.prerm: Added to handle downgrades.
+    + Use Snakeoil SSL certificates by default:
+      - d/control: Depend on ssl-cert.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + d/dovecot-core.dirs: Added usr/share/doc/dovecot-core
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Add upstart job:
+      - d/rules, d/dovecot-core.dovecot.upstart, d/control,
+        d/dovecot-core.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        d/dovecot-pop3d.{postinst, postrm, prerm}.
+        d/mail-stack-deliver.postinst: Convert init script to upstart.
+    + d/control: Drop dovecot-postfix package as its no longer required.
+    + Rename init.d script to work with the dh_installinit --name option, so
+      that it comes back.
+  * Drop build dependency on libstemmer-dev (universe).
+
+ -- Matthias Klose <[e-mail]>  Mon, 14 Sep 2015 13:58:42 +0200
+
 dovecot (1:2.2.18-2) unstable; urgency=high
 
   * [3f3bf71] Updated pigeonhole patch to 0.4.8 (Closes: #792669)
@@ -523,6 +872,76 @@ dovecot (1:2.2.10-1) unstable; urgency=low
 
  -- Jaldhar H. Vyas <[e-mail]>  Thu, 06 Mar 2014 02:51:34 -0500
 
+dovecot (1:2.2.9-1ubuntu5) utopic; urgency=medium
+
+  * No-change rebuild against current debhelper to drop unnecessary upstart
+    dependency. (LP: #1351306)
+
+ -- Martin Pitt <[e-mail]>  Wed, 03 Sep 2014 09:50:41 +0200
+
+dovecot (1:2.2.9-1ubuntu4) utopic; urgency=medium
+
+  * Rename init.d script to work with the dh_installinit --name option, so
+    that it comes back. (LP: #1323274)
+
+ -- Martin Pitt <[e-mail]>  Mon, 26 May 2014 14:24:43 +0200
+
+dovecot (1:2.2.9-1ubuntu3) utopic; urgency=medium
+
+  * SECURITY UPDATE: denial of service via SSL connection exhaustion
+    - debian/patches/CVE-2014-3430.patch: properly close connections in
+      src/login-common/client-common.c,
+      src/login-common/ssl-proxy-openssl.c,
+      src/login-common/ssl-proxy.h.
+    - CVE-2014-3430
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 15 May 2014 10:19:29 -0400
+
+dovecot (1:2.2.9-1ubuntu2) trusty; urgency=medium
+
+  * d/dovecot-core.config: Drop db_input for ssl-cert-exists; this message
+    not actually an error, is documented in the README.Debian, and blocks
+    automated upgrades (LP: #1278897).
+
+ -- James Page <[e-mail]>  Fri, 07 Mar 2014 12:42:58 +0000
+
+dovecot (1:2.2.9-1ubuntu1) trusty; urgency=medium
+
+  * Merge from Debian unstable, remaining changes:
+    + Add mail-stack-delivery package:
+      - Update d/rules
+      - d/control: convert existing dovecot-postfix package to a dummy
+        package and add new mail-stack-delivery package.
+      - Update maintainer scripts.
+      - Rename d/dovecot-postfix.* to debian/mail-stack-delivery.*
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.prerm: Added to handle downgrades.
+    + Use Snakeoil SSL certificates by default:
+      - d/control: Depend on ssl-cert.
+      - d/dovecot-core.postinst: Relax grep for SSL_* a bit.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + d/dovecot-core.dirs: Added usr/share/doc/dovecot-core
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Add upstart job:
+      - d/rules, d/dovecot-core.dovecot.upstart, d/control,
+        d/dovecot-core.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        d/dovecot-pop3d.{postinst, postrm, prerm}.
+        d/mail-stack-deliver.postinst: Convert init script to upstart.
+    + Use the autotools-dev dh addon to update config.guess/config.sub for
+      arm64.
+  * Dropped changes, included in Debian:
+    - Update Dovecot name to reflect distribution in login greeting.
+    - Update Drac plugin for >= 2.0.0 support.
+  * d/control: Drop dovecot-postfix package as its no longer required.
+
+ -- James Page <[e-mail]>  Wed, 08 Jan 2014 09:35:49 +0000
+
 dovecot (1:2.2.9-1) unstable; urgency=low
 
   [ Jaldhar H. Vyas ]
@@ -604,6 +1023,78 @@ dovecot (1:2.1.7-8) experimental; urgency=low
 
  -- Jaldhar H. Vyas <[e-mail]>  Thu, 13 Jun 2013 16:14:21 -0400
 
+dovecot (1:2.1.7-7ubuntu3) saucy; urgency=low
+
+  * Use the autotools-dev dh addon to update config.guess/config.sub for
+    arm64.
+
+ -- Colin Watson <[e-mail]>  Thu, 10 Oct 2013 11:55:27 +0100
+
+dovecot (1:2.1.7-7ubuntu2) saucy; urgency=low
+
+  * debian/patches/dovecot_name.patch: updated Dovecot name to reflect 
+    distribution in login greeting
+  * debian/control: added lsb-release as build-dependency
+  * debian/rules: added autoconf in config-stamp
+
+ -- Yolanda Robla <[e-mail]>  Wed, 26 Jun 2013 08:34:42 +0200
+
+dovecot (1:2.1.7-7ubuntu1) raring; urgency=low
+
+  [ James Page ]
+  * Merge from Debian unstable (LP: #1117613, #1075456), remaining changes:
+    + Add mail-stack-delivery package:
+      - Update d/rules
+      - d/control: convert existing dovecot-postfix package to a dummy
+        package and add new mail-stack-delivery package.
+      - Update maintainer scripts.
+      - Rename d/dovecot-postfix.* to debian/mail-stack-delivery.*
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.prerm: Added to handle downgrades.
+    + Use Snakeoil SSL certificates by default:
+      - d/control: Depend on ssl-cert.
+      - d/dovecot-core.postinst: Relax grep for SSL_* a bit.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + d/dovecot-core.dirs: Added usr/share/doc/dovecot-core
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Add upstart job:
+      - d/rules, d/dovecot-core.dovecot.upstart, d/control,
+        d/dovecot-core.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        d/dovecot-pop3d.{postinst, postrm, prerm}.
+        d/mail-stack-deliver.postinst: Convert init script to upstart.
+    + d/control: Added Pre-Depends: dpkg (>= 1.15.6) to dovecot-dbg to support
+      xz compression in Ubuntu.
+    + d/control: Demote dovecot-common Recommends: to Suggests: to prevent
+      install of extra packages on upgrade.
+    + d/patches/dovecot-drac.patch: Updated with version for dovecot >= 2.0.0.
+  * Dropped changes, included in Debian:
+    + d/{control,rules}: enable PIE hardening.
+    + d/control: Drop B-D on systemd.
+  * d/p/mail-stack-delivery.postinst: Updated to ensure that configured SSL
+    cert and key locations are used when configuring postfix, sorted out
+    formatting.
+  * d/p/dovecot-core.postinst: Create compat links to old style, existing
+    SSL cert and key if found.
+  * d/rules: Don't pass hardening flags for DRAC plugin.
+  * d/dovecot-{pop3d,imapd}.prerm: Re-sync with Debian.
+  * d/dovecot-core.lintian-overrides: Drop override for DRAC plugin as not
+    required in Ubuntu.
+  * d/01-mail-stack-delivery: Renamed 99-mail-stack-delivery to ensure that
+    the mail-stack-delivery configuration overrides configuration options
+    set elsewhere, updated with new cert/key file locations.
+
+  [ Ante Karamatic ]
+  * Change configuration file for LDA on new installs and upgrades
+    (LP: #671065).
+
+ -- James Page <[e-mail]>  Mon, 11 Feb 2013 12:41:24 +0000
+
 dovecot (1:2.1.7-7) unstable; urgency=high
 
   * If you are upgrading from stable or earlier versions of this package
@@ -699,6 +1190,53 @@ dovecot (1:2.1.7-2) unstable; urgency=low
 
  -- Jaldhar H. Vyas <[e-mail]>  Thu, 21 Jun 2012 23:54:47 -0400
 
+dovecot (1:2.1.7-1ubuntu2) quantal; urgency=low
+
+  * d/dovecot-core.dovecot.upstart: Respawn to handle unexpected but
+    recoverable problems. (LP: #718188)
+
+ -- Clint Byrum <[e-mail]>  Thu, 09 Aug 2012 12:22:52 -0700
+
+dovecot (1:2.1.7-1ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable, remaining changes:
+    + Add mail-stack-delivery package:
+      - Update d/rules
+      - d/control: convert existing dovecot-postfix package to a dummy
+        package and add new mail-stack-delivery package.
+      - Update maintainer scripts.
+      - Rename d/dovecot-postfix.* to debian/mail-stack-delivery.*
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.prerm: Added to handle downgrades.
+    + Use Snakeoil SSL certificates by default:
+      - d/control: Depend on ssl-cert.
+      - d/dovecot-core.postinst: Relax grep for SSL_* a bit.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + d/{control,rules}: enable PIE hardening.
+    + d/dovecot-core.dirs: Added usr/share/doc/dovecot-core
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Add upstart job:
+      - d/rules, d/dovecot-core.dovecot.upstart, d/control,
+        d/dovecot-core.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        d/dovecot-pop3d.{postinst, postrm, prerm}.
+        d/mail-stack-deliver.postinst: Convert init script to upstart.
+    + d/control: Added Pre-Depends: dpkg (>= 1.15.6) to dovecot-dbg to support
+      xz compression in Ubuntu.
+    + d/control: Demote dovecot-common Recommends: to Suggests: to prevent
+      install of extra packages on upgrade.
+    + d/patches/dovecot-drac.patch: Updated with version for dovecot >= 2.0.0.
+    + d/control: Drop B-D on systemd.
+  * Dropped changes:
+    + d/patches/fix-racey-restart.patch: part of 2.1.x, no longer required.
+
+ -- James Page <[e-mail]>  Mon, 11 Jun 2012 11:11:54 +0100
+
 dovecot (1:2.1.7-1) unstable; urgency=low
 
   * [7668742] Imported upstream 2.1.7 (Closes: #663243)
@@ -737,6 +1275,49 @@ dovecot (1:2.1.1-1) experimental; urgency=low
 
  -- Micah Anderson <[e-mail]>  Tue, 13 Mar 2012 23:08:06 -0400
 
+dovecot (1:2.0.19-0ubuntu1) precise; urgency=low
+
+  * New upstream release (LP: #970782).
+  * Merge from Debian testing, remaining changes:
+    + Add mail-stack-delivery package:
+      - Update d/rules
+      - d/control: convert existing dovecot-postfix package to a dummy
+        package and add new mail-stack-delivery package.
+      - Update maintainer scripts.
+      - Rename d/dovecot-postfix.* to debian/mail-stack-delivery.*
+      - d/mail-stack-delivery.preinst: Move previously installed backups and
+        config files to a new package namespace.
+      - d/mail-stack-delivery.prerm: Added to handle downgrades.
+    + Use Snakeoil SSL certificates by default:
+      - d/control: Depend on ssl-cert.
+      - d/dovecot-core.postinst: Relax grep for SSL_* a bit.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + d/{control,rules}: enable PIE hardening.
+    + d/dovecot-core.dirs: Added usr/share/doc/dovecot-core
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Add upstart job:
+      - d/rules, d/dovecot-core.dovecot.upstart, d/control,
+        d/dovecot-core.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        d/dovecot-pop3d.{postinst, postrm, prerm}.
+        d/mail-stack-deliver.postinst:
+        Convert init script to upstart.
+    + d/patches/fix-racey-restart.patch: Backported patch from current
+      development release which ensures all child processes terminate prior
+      to the main dovecot process.
+    + debian/patches/CVE-2011-4318.patch: Dropped - applied upstream
+    + d/control: Added Pre-Depends: dpkg (>= 1.15.6) to dovecot-dbg to support
+      xz compression in Ubuntu.
+    + d/control: Demote dovecot-common Recommends: to Suggests: to prevent
+      install of extra packages on upgrade.
+  * d/patches/dovecot-drac.patch: Updated with version for dovecot >= 2.0.0.
+
+ -- James Page <[e-mail]>  Wed, 04 Apr 2012 14:56:38 +0100
+
 dovecot (1:2.0.18-1) unstable; urgency=low
 
   * [85ae320] Imported Upstream version 2.0.18
@@ -750,6 +1331,78 @@ dovecot (1:2.0.18-1) unstable; urgency=low
 
  -- Jaldhar H. Vyas <[e-mail]>  Fri, 09 Mar 2012 00:55:13 -0500
 
+dovecot (1:2.0.15-1ubuntu5) precise; urgency=low
+
+  * SECURITY UPDATE: Incorrect cert Common Name verification when proxying
+    - debian/patches/CVE-2011-4318.patch: correctly validate Common Name
+      when a hostname is specified in src/login-common/{login-proxy.c,
+      ssl-proxy.*,ssl-proxy-openssl.c}.
+    - CVE-2011-4318
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 08 Dec 2011 14:34:36 -0500
+
+dovecot (1:2.0.15-1ubuntu4) precise; urgency=low
+
+  * No-change rebuild to drop spurious libsfgcc1 dependency on armhf.
+
+ -- Adam Conrad <[e-mail]>  Fri, 02 Dec 2011 17:39:55 -0700
+
+dovecot (1:2.0.15-1ubuntu3) precise; urgency=low
+
+  * Rebuild for libmysqlclient transition.
+
+ -- Clint Byrum <[e-mail]>  Wed, 23 Nov 2011 16:38:01 -0800
+
+dovecot (1:2.0.15-1ubuntu2) precise; urgency=low
+
+  * Resolve issue with intermittent restart failures (LP: #873390):
+    - d/patches/fix-racey-restart.patch: Backported patch from current 
+      development release which ensures all child processes terminate prior
+      to the main dovecot process. 
+
+ -- James Page <[e-mail]>  Fri, 11 Nov 2011 14:38:41 +0000
+
+dovecot (1:2.0.15-1ubuntu1) precise; urgency=low
+
+  * Merge from Debian Testing, remaining changes:
+    + Add mail-stack-delivery package:
+      - Update d/rules
+      - d/control: convert existing dovecot-postfix package to a dummy
+        package and add new mail-stack-delivery package.
+      - Update maintainer scripts.
+      - Rename d/dovecot-postfix.* to debian/mail-stack-delivery.*
+      - d/mail-stack-delivery.preinst: Move previously installed backups and 
+        config files to a new package namespace.
+      - d/mail-stack-delivery.prerm: Added to handle downgrades.
+    + Use Snakeoil SSL certificates by default:
+      - d/control: Depend on ssl-cert.
+      - d/dovecot-core.postinst: Relax grep for SSL_* a bit.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - d/dovecot-core.ufw.profile: new ufw profile.
+      - d/rules: install profile in dovecot-core.
+      - d/control: dovecot-core - suggest ufw.
+    + d/{control,rules}: enable PIE hardening.
+    + d/dovecot-core.dirs: Added usr/share/doc/dovecot-core
+    + Add apport hook:
+      - d/rules, d/source_dovecot.py
+    + Add upstart job:
+      - d/rules, d/dovecot-core.dovecot.upstart, d/control,
+        d/dovecot-core.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        d/dovecot-pop3d.{postinst, postrm, prerm}. 
+        d/mail-stack-deliver.postinst:
+        Convert init script to upstart.
+  * d/01-mail-stack-delivery.conf: Add postfix->dovecot auth listener
+    to mail-stack-delivery configuration (LP: #874135).
+  * d/mail-stack-delivery.{postinst,postrm}: Restart dovecot to pickup/drop
+    mail-stack-delivery configuration (LP: #870244).
+  * d/control: Added Pre-Depends: dpkg (>= 1.15.6) to dovecot-dbg to support
+    xz compression in Ubuntu.
+  * d/control: Demote dovecot-common Recommends: to Suggests: to prevent
+    install of extra packages on upgrade.
+
+ -- James Page <[e-mail]>  Wed, 19 Oct 2011 15:54:40 +0100
+
 dovecot (1:2.0.15-1) unstable; urgency=low
 
   * [a22575a] New upstream version 2.0.15: (Closes: #642045)
@@ -844,6 +1497,60 @@ dovecot (1:2.0.13-1.1) unstable; urgency=low
 
  -- Luk Claes <[e-mail]>  Sat, 18 Jun 2011 12:31:28 +0200
 
+dovecot (1:2.0.13-1ubuntu3) oneiric; urgency=medium
+
+  [ Ben Howard ]
+  * debian/dovecot-common.dovecot.upstart: changed start to runlevel [2345]
+    (LP: #820685)
+
+  [ James Page ]
+  * Make mail-stack-delivery work with new version of dovecot (LP: #860336):
+    - debian/control: Added dovecot-managesieved to mail-stack-delivery Depends.
+    - debian/01-mail-stack-delivery.conf: Renamed mangesieve protocol -> sieve. 
+      Tidied up obsolete and changed configuration stanzas.
+    - debian/mail-stack-delivery.postinst: drop -n flag from dovecot deliver 
+      command in postfix configuration.
+
+ -- Ben Howard <[e-mail]>  Mon, 19 Sep 2011 14:44:56 -0600
+
+dovecot (1:2.0.13-1ubuntu2) oneiric; urgency=low
+
+  * debian/dovecot-common.postinst: fix ssl cert typos that prevent
+    certs from being generated (LP: #792557)
+
+ -- Steve Beattie <[e-mail]>  Fri, 03 Jun 2011 14:02:53 -0700
+
+dovecot (1:2.0.13-1ubuntu1) oneiric; urgency=low
+
+  * Merge from Debian Unstable, remaining changes: 
+    + Add mail-stack-delivery as per server-maverick-mail-integration spec:
+      - Update debian/rules
+      - Convert existing package to a dummy package and new binary in debian/control.
+      - Update maintainer scripts.
+      - Move previously installed backups and config files to a new package namespace in preinst.
+      - Add new debian/mail-stack-delivery.prerm to handle downgrades.
+      - Rename debian/dovecot-postfix.* to debian/mail-stack-delivery.*
+    + Use Snakeoil SSL certifications by default:
+      - debian/control: Depend on ssl-cert.
+      - debian/dovecot-common.postinst: Relax grep for SSL_* a bit.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - Create debian/dovecot-common.ufw.profile.
+      - debian/rules: install profile
+      - debian/control: suggest ufw.
+    + debian/{control,rules}: enable PIE hardening.
+    + debian/dovecot-common.dirs: Added usr/share/doc/dovecot-common
+    + Add apport hook:
+      - debian/rules, debian/source_dovecot.py
+    + Add upstart job:
+      - debian/rules, debian/dovecot-common.dovecot.upstart, debian/control,
+        debian/dovecot-common.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        debian/dovecot-pop3d.{postinst, postrm, prerm}. mail-stack-deliver.postinst:
+        Convert init script to upstart. Apart of the server-maverick-upstart-conversion
+        specification.
+
+ -- Chuck Short <[e-mail]>  Wed, 01 Jun 2011 13:32:07 -0400
+
 dovecot (1:2.0.13-1) unstable; urgency=high
 
   [ Marco Nenciarini ]
@@ -868,6 +1575,37 @@ dovecot (1:2.0.13-1) unstable; urgency=high
 
  -- Marco Nenciarini <[e-mail]>  Sat, 21 May 2011 23:58:06 +0200
 
+dovecot (1:2.0.12-1ubuntu1) oneiric; urgency=low
+
+  * Merge from Debian Unstable, remaining changes are:
+    + Add mail-stack-delivery as per server-maverick-mail-integration spec:
+      - Update debian/rules
+      - Convert existing package to a dummy package and new binary in debian/control.
+      - Update maintainer scripts.
+      - Move previously installed backups and config files to a new package namespace in preinst.
+      - Add new debian/mail-stack-delivery.prerm to handle downgrades.
+      - Rename debian/dovecot-postfix.* to debian/mail-stack-delivery.*
+    + Use Snakeoil SSL certifications by default:
+      - debian/control: Depend on ssl-cert.
+      - debian/dovecot-common.postinst: Relax grep for SSL_* a bit.
+    + Add autopkgtest to debian/tests/*.
+    + Add ufw integration:
+      - Create debian/dovecot-common.ufw.profile.
+      - debian/rules: install profile
+      - debian/control: suggest ufw.
+    + debian/{control,rules}: enable PIE hardening.
+    + debian/dovecot-common.dirs: Added usr/share/doc/dovecot-common
+    + Add apport hook:
+      - debian/rules, debian/source_dovecot.py
+    + Add upstart job:
+      - debian/rules, debian/dovecot-common.dovecot.upstart, debian/control,
+        debian/dovecot-common.dirs, dovecot-imapd.{postrm, postinst, prerm},
+        debian/dovecot-pop3d.{postinst, postrm, prerm}. mail-stack-deliver.postinst:
+        Convert init script to upstart. Apart of the server-maverick-upstart-conversion
+        specification.
+
+ -- Chuck Short <[e-mail]>  Mon, 16 May 2011 10:18:41 -0400
+
 dovecot (1:2.0.12-1) unstable; urgency=low
 
   [ Jaldhar H. Vyas ]
diff --git a/debian/control b/debian/control
index be6e998..c87ffe8 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: dovecot
 Section: mail
 Priority: optional
-Maintainer: Dovecot Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Dovecot Maintainers <[e-mail]>
 Uploaders: Jaldhar H. Vyas <[e-mail]>,
            Jelmer Vernooij <[e-mail]>,
            Apollon Oikonomopoulos <[e-mail]>
@@ -293,3 +294,11 @@ Description: secure POP3/IMAP server - Lua authentication plugin
  .
  This package contains an authentication plugin allowing password and user
  databases to be implemented in Lua.
+
+Package: mail-stack-delivery
+Depends: dovecot-core, ${misc:Depends}
+Architecture: all
+Priority: optional
+Section: oldlibs
+Description: transitional package
+ This is a transitional package. It can safely be removed.
diff --git a/debian/patches/dovecot-2.3.1-fix-pam.patch b/debian/patches/dovecot-2.3.1-fix-pam.patch
new file mode 100644
index 0000000..a8a6ed0
--- /dev/null
+++ b/debian/patches/dovecot-2.3.1-fix-pam.patch
@@ -0,0 +1,37 @@
+From 3a3d9c77c243bc1097039cb70a0029e0c108efbb Mon Sep 17 00:00:00 2001
+From: "Helmut K. C. Tessarek" <[e-mail]>
+Date: Tue, 3 Apr 2018 22:03:19 -0400
+Subject: [PATCH] fix login via PAM
+
+After upgrading to 2.3, PAM authentication stopped working:
+
+Error in audit.log:
+  PAM audit_log_acct_message() failed: Operation not permitted
+Error in dovecot.log:
+  auth-worker(*REMOVED*): Info: pam(*REMOVED*): pam_authenticate() failed: System error
+
+Removing NoNewPrivileges=true and adding CAP_AUDIT_WRITE to CapabilityBoundingSet fixes this error.
+
+Forwarded: no (backport from not yet accepted PR)
+Origin: upstream, https://github.com/dovecot/core/pull/71/commits/3a3d9c77c243bc1097039cb70a0029e0c108efbb
+Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1564348
+Last-Update: 2018-05-17
+---
+ dovecot.service.in | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/dovecot.service.in b/dovecot.service.in
+index 5fe382a12f..e665b1b6cb 100644
+--- a/dovecot.service.in
++++ b/dovecot.service.in
+@@ -20,9 +20,7 @@ PrivateTmp=true
+ NonBlocking=yes
+ ProtectSystem=full
+ PrivateDevices=true
+-# disable this if you want to use apparmor plugin
+-NoNewPrivileges=true
+-CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_IPC_LOCK CAP_KILL CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE
++CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_IPC_LOCK CAP_KILL CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_AUDIT_WRITE
+ 
+ # You can add environment variables with e.g.:
+ #Environment='CORE_OUTOFMEM=1'
diff --git a/debian/patches/series b/debian/patches/series
index 63e9233..6fca31b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -9,3 +9,4 @@ dovecot_name.patch
 ssl-dh-params-location.patch
 murmur3-big-endian.patch
 debian-changes
+dovecot-2.3.1-fix-pam.patch