Merge ~sergiodj/ubuntu/+source/openldap:merge-2.6.3-lunar into ubuntu/+source/openldap:debian/experimental

[Sergio Durigan Junior]

This is the merge of OpenLDAP 2.6.3 from Debian experimental. This merge will kick-off the OpenLDAP transition as well.

I've been maintaining OpenLDAP 2.6.x on Debian for a while now, so the only extra delta that we've been carrying (the addition of certain B-Ds needed for testing SASL/GSSAPI) had also been incorporated in Debian and therefore could be removed with this merge.

There's a bileto ticket with its corresponding PPA here:

https://bileto.ubuntu.com/#/ticket/4959
https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4959/+packages

The package is currently building as I write this, and I intend to mass-upload its reverse dependencies to the same PPA in order to test the transition beforehand. I will also update this MP with the dep8 test results once I have them.

Upstream OpenLDAP is going to release 2.6.4 soon-ish, but I'd like to start the transition ASAP so I'm going ahead with 2.6.3. I can always merge 2.6.4 when it comes out.

[Bryce Harrington (bryce)]

Looks good. Packaging changes correct; delta carried forward looks ok; logical split is good.

The Maintainer fix looks like it could go to Debian, and was suggested in debb #960448, but was omitted from the fix for some reason that's not clear. Perhaps it would be worth re-opening that bug, or filing a new one, to get clarification? Not a biggie and shouldn't hold this MP up from landing, guessing it just slipped through the cracks and would be good to get resolved some time.

I didn't verify the autopkgtests, but presumably since you're using bileto you're already checking them.

review: Approve

[Sergio Durigan Junior (sergiodj)]

Thanks, Bryce.

Indeed, the maintainer fix is a bit confusing: it's marked as fixed in Debian but for some reason it isn't there. I will double check what happened; if all goes well, it's one less delta for us.

There are a few FTBFSes that happened during the mass revdep rebuild, but they're all unrelated to openldap. Nevertheless, I'm taking a closer look at them and making sure they won't cause any unforeseen problems.

I will go ahead and upload the package to -proposed soon, in order to start the transition.

Thanks again.

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
new file mode 100644
index 0000000..6a247aa
--- /dev/null
+++ b/debian/apparmor-profile
@@ -0,0 +1,61 @@
+# vim:syntax=apparmor
+# Last Modified: Fri Jun  6 13:51:00 2020
+# Author: Jamie Strandboge <[e-mail]>
+
+#include <tunables/global>
+
+/usr/sbin/slapd {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+  #include <abstractions/p11-kit>
+
+  #include <abstractions/ssl_keys>
+  #include <abstractions/ssl_certs>
+
+  /etc/sasldb2 r,
+
+  capability dac_override,
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+
+  /etc/gai.conf r,
+  /etc/hosts.allow r,
+  /etc/hosts.deny r,
+
+  # ldap files
+  /etc/ldap/** kr,
+  /etc/ldap/slapd.d/** rw,
+
+  # kerberos/gssapi
+  /dev/tty rw,
+  /etc/gss/mech.d/   r,
+  /etc/gss/mech.d/* kr,
+  /etc/krb5.keytab kr,
+  /etc/krb5/user/*/client.keytab kr,
+  owner /tmp/krb5cc_* rwk,
+  owner /var/tmp/krb5_*.rcache2 rwk,
+  /var/tmp/ rw,
+  /var/tmp/** rw,
+
+  # the databases and logs
+  /var/lib/ldap/ r,
+  /var/lib/ldap/** rwk,
+
+  # lock file
+  /var/lib/ldap/alock kw,
+
+  # pid files and sockets
+  /{,var/}run/slapd/* w,
+  /{,var/}run/slapd/ldapi rw,
+  /{,var/}run/nslcd/socket rw,
+  /{,var/}run/saslauthd/mux rw,
+
+  /usr/lib/ldap/ r,
+  /usr/lib/ldap/* mr,
+
+  /usr/sbin/slapd mr,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.slapd>
+}
diff --git a/debian/changelog b/debian/changelog
index b17e37b..8c309b7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,28 @@
+openldap (2.6.3+dfsg-1~exp1ubuntu1) lunar; urgency=medium
+
+  * Merge with Debian unstable (LP: #1993426). Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+  * Drop changes:
+    - Enable SASL/GSSAPI tests. (LP #1976508)
+      + d/control: Update B-D to include required dependencies needed to run
+        SASL/GSSAPI tests during build time, and mark them "!nocheck".
+      Thanks: Andreas Hasenack <[e-mail]>
+      [ Incorporated by Debian. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 18 Nov 2022 16:07:45 -0500
+
 openldap (2.6.3+dfsg-1~exp1) experimental; urgency=medium
 
   * d/rules: Remove get-orig-source, now unnecessary.
@@ -47,6 +72,94 @@ openldap (2.6.2+dfsg-1~exp1) experimental; urgency=medium
 
  -- Sergio Durigan Junior <[e-mail]>  Fri, 20 May 2022 17:41:04 -0400
 
+openldap (2.5.13+dfsg-1ubuntu2) lunar; urgency=medium
+
+  * Rebuild against new perlapi-5.36.
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 04 Nov 2022 16:50:13 +0100
+
+openldap (2.5.13+dfsg-1ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1983618). Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+    - Enable SASL/GSSAPI tests. (LP #1976508)
+      + d/control: Update B-D to include required dependencies needed to run
+        SASL/GSSAPI tests during build time, and mark them "!nocheck".
+      Thanks: Andreas Hasenack <[e-mail]>
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 20 Sep 2022 15:30:47 -0400
+
+openldap (2.5.12+dfsg-2ubuntu2) kinetic; urgency=medium
+
+  * Enable SASL/GSSAPI tests. (LP: #1976508)
+    - d/control: Update B-D to include required dependencies needed to run
+      SASL/GSSAPI tests during build time, and mark them "!nocheck".
+    Thanks: Andreas Hasenack <[e-mail]>
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 25 Aug 2022 16:20:08 -0400
+
+openldap (2.5.12+dfsg-2ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1971305). Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 06 Jun 2022 15:34:48 -0400
+
+openldap (2.5.11+dfsg-1~exp1ubuntu3) jammy; urgency=medium
+
+  * No-change rebuild to update maintainer scripts, see LP: 1959054
+
+ -- Dave Jones <[e-mail]>  Wed, 16 Feb 2022 17:15:26 +0000
+
+openldap (2.5.11+dfsg-1~exp1ubuntu2) jammy; urgency=medium
+
+  * No-change rebuild for the perl update.
+
+ -- Matthias Klose <[e-mail]>  Mon, 07 Feb 2022 07:51:42 +0100
+
+openldap (2.5.11+dfsg-1~exp1ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946883). Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 25 Jan 2022 17:06:12 -0500
+
 openldap (2.5.11+dfsg-1~exp1) experimental; urgency=medium
 
   * New upstream release.
@@ -78,6 +191,25 @@ openldap (2.5.7+dfsg-1~exp1) experimental; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Mon, 30 Aug 2021 18:54:25 -0700
 
+openldap (2.5.6+dfsg-1~exp1ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 17 Aug 2021 14:06:00 -0400
+
 openldap (2.5.6+dfsg-1~exp1) experimental; urgency=medium
 
   [ Ryan Tandy ]
@@ -112,6 +244,59 @@ openldap (2.5.6+dfsg-1~exp1) experimental; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Mon, 16 Aug 2021 18:32:29 -0700
 
+openldap (2.5.5+dfsg-1~exp1ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+  * Dropped changes:
+    - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
+      + d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      + d/configure.options: Configure with --with-gssapi
+      + d/control: Added heimdal-dev as a build depend
+      + d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+      + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
+      This should be dropped when the soname changes.
+      [ Dropped as planned after soname bump due to 2.5.5 update. ]
+    - Enable nss overlay:
+      + d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      + d/slapd.install: install nssov overlay
+      + d/slapd.manpages: install slapo-nssov(5) man page
+      + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+        Debian bug #919136, we also have to patch the nssov makefile
+        accordingly and thus update this patch.
+      [ Dropped as planned after soname bump due to 2.5.5 update. ]
+    - Add support for CLDAP (UDP) support, back then required by
+      likewise-open (first enabled in 2.4.17-1ubuntu2):
+      + d/rules: Enable -DLDAP_CONNECTIONLESS
+      + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
+      This should be dropped when the soname changes.
+      [ Dropped as planned after soname bump due to 2.5.5 update. ]
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
+      of test timing issue.
+      [ Dropped because the latest update improved the testcase and
+        there is no FTBFS on riscv64 anymore. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 15 Jun 2021 17:20:34 -0400
+
 openldap (2.5.5+dfsg-1~exp1) experimental; urgency=medium
 
   * New upstream release.
@@ -217,6 +402,53 @@ openldap (2.4.57+dfsg-3) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sat, 15 May 2021 16:03:34 -0700
 
+openldap (2.4.57+dfsg-2ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
+      + d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      + d/configure.options: Configure with --with-gssapi
+      + d/control: Added heimdal-dev as a build depend
+      + d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+      + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
+      This should be dropped when the soname changes.
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      + d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      + d/slapd.install: install nssov overlay
+      + d/slapd.manpages: install slapo-nssov(5) man page
+      + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+        Debian bug #919136, we also have to patch the nssov makefile
+        accordingly and thus update this patch.
+    - d/{rules,slapd.py}: Add apport hook.
+    - Add support for CLDAP (UDP) support, back then required by
+      likewise-open (first enabled in 2.4.17-1ubuntu2):
+      + d/rules: Enable -DLDAP_CONNECTIONLESS
+      + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
+      This should be dropped when the soname changes.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
+      of test timing issue.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 18 Feb 2021 10:15:38 -0500
+
 openldap (2.4.57+dfsg-2) unstable; urgency=medium
 
   * Fix slapd assertion failure in Certificate List Exact Assertion validation
@@ -246,6 +478,65 @@ openldap (2.4.57+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sat, 23 Jan 2021 08:57:07 -0800
 
+openldap (2.4.56+dfsg-1ubuntu2) hirsute; urgency=medium
+
+  * debian/apparmor-profile: add AppArmor rule for locking replay cache.
+    In Hirsute, a change (presumably in src:krb5) has caused slapd to be
+    denied by AppArmor for locking /var/tmp/krb5_*.rcache2. This is
+    acceptable, so add it to the AppArmor profile. This fixes the dep8
+    test in src:krb5 that uses slapd for testing.
+
+ -- Robie Basak <[e-mail]>  Tue, 26 Jan 2021 13:02:40 +0000
+
+openldap (2.4.56+dfsg-1ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
+      + d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      + d/configure.options: Configure with --with-gssapi
+      + d/control: Added heimdal-dev as a build depend
+      + d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+      + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
+      This should be dropped when the soname changes.
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      + d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      + d/slapd.install: install nssov overlay
+      + d/slapd.manpages: install slapo-nssov(5) man page
+      + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+        Debian bug #919136, we also have to patch the nssov makefile
+        accordingly and thus update this patch.
+    - d/{rules,slapd.py}: Add apport hook.
+    - Add support for CLDAP (UDP) support, back then required by
+      likewise-open (first enabled in 2.4.17-1ubuntu2):
+      + d/rules: Enable -DLDAP_CONNECTIONLESS
+      + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
+      This should be dropped when the soname changes.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
+      of test timing issue.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+  * d/apparmor-profile: use abstractions/ssl_keys instead of manual rules,
+    allows letsencrypt to work. Thanks to Paul McEnery (LP: #1909748)
+
+ -- Paride Legovini <[e-mail]>  Mon, 04 Jan 2021 16:18:57 +0100
+
 openldap (2.4.56+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -272,12 +563,151 @@ openldap (2.4.54+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 18 Oct 2020 16:03:46 +0000
 
+openldap (2.4.53+dfsg-1ubuntu5) hirsute; urgency=medium
+
+  * SECURITY UPDATE: assertion failure in Certificate List syntax
+    validation
+    - debian/patches/CVE-2020-25709.patch: properly handle error in
+      servers/slapd/schema_init.c.
+    - CVE-2020-25709
+  * SECURITY UPDATE: assertion failure in CSN normalization with invalid
+    input
+    - debian/patches/CVE-2020-25710.patch: properly handle error in
+      servers/slapd/schema_init.c.
+    - CVE-2020-25710
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 17 Nov 2020 09:41:47 -0500
+
+openldap (2.4.53+dfsg-1ubuntu4) hirsute; urgency=medium
+
+  * SECURITY UPDATE: DoS via NULL pointer dereference
+    - debian/patches/CVE-2020-25692.patch: skip normalization if there's no
+      equality rule in servers/slapd/modrdn.c.
+    - CVE-2020-25692
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 09 Nov 2020 14:02:02 -0500
+
+openldap (2.4.53+dfsg-1ubuntu3) hirsute; urgency=medium
+
+  * No-change rebuild for the perl update.
+
+ -- Matthias Klose <[e-mail]>  Mon, 09 Nov 2020 12:53:38 +0100
+
+openldap (2.4.53+dfsg-1ubuntu2) hirsute; urgency=medium
+
+  * No-change rebuild for the perl update.
+
+ -- Matthias Klose <[e-mail]>  Mon, 09 Nov 2020 10:51:32 +0100
+
+openldap (2.4.53+dfsg-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1894838). Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
+      + d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      + d/configure.options: Configure with --with-gssapi
+      + d/control: Added heimdal-dev as a build depend
+      + d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+      + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
+      This should be dropped when the soname changes.
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      + d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      + d/slapd.install: install nssov overlay
+      + d/slapd.manpages: install slapo-nssov(5) man page
+      + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+        Debian bug #919136, we also have to patch the nssov makefile
+        accordingly and thus update this patch.
+    - d/{rules,slapd.py}: Add apport hook.
+    - Add support for CLDAP (UDP) support, back then required by
+      likewise-open (first enabled in 2.4.17-1ubuntu2):
+      + d/rules: Enable -DLDAP_CONNECTIONLESS
+      + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
+      This should be dropped when the soname changes.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
+      of test timing issue.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 08 Sep 2020 09:36:58 -0300
+
 openldap (2.4.53+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
 
  -- Ryan Tandy <[e-mail]>  Mon, 07 Sep 2020 09:47:28 -0700
 
+openldap (2.4.51+dfsg-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
+      + d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      + d/configure.options: Configure with --with-gssapi
+      + d/control: Added heimdal-dev as a build depend
+      + d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+      + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
+      This should be dropped when the soname changes.
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      + d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      + d/slapd.install: install nssov overlay
+      + d/slapd.manpages: install slapo-nssov(5) man page
+      + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+        Debian bug #919136, we also have to patch the nssov makefile
+        accordingly and thus update this patch.
+    - d/{rules,slapd.py}: Add apport hook.
+    - Add support for CLDAP (UDP) support, back then required by
+      likewise-open (first enabled in 2.4.17-1ubuntu2):
+      + d/rules: Enable -DLDAP_CONNECTIONLESS
+      + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
+      This should be dropped when the soname changes.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
+      of test timing issue.
+    - d/rules: better regexp to match the Maintainer tag in d/control,
+      needed in the Ubuntu case because of XSBC-Original-Maintainer
+      (Closes #960448, LP #1875697)
+  * Dropped:
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+      [In 2.4.51+dfsg-1]
+    - d/slapd.scripts-common:
+      + add slapcat_opts to local variables.
+      + Fix backup directory naming for multiple reconfiguration.
+      [In 2.4.51+dfsg-1]
+    - debian/patches/set-maintainer-name: our d/rules change needs to
+      be kept, but this patch is in 2.4.51+dfsg-1.
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 26 Aug 2020 11:03:24 -0300
+
 openldap (2.4.51+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -323,6 +753,85 @@ openldap (2.4.51+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 23 Aug 2020 11:09:57 -0700
 
+openldap (2.4.50+dfsg-1ubuntu3) groovy; urgency=medium
+
+  * No change rebuild against new libnettle8 and libhogweed6 ABI.
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 29 Jun 2020 22:31:30 +0100
+
+openldap (2.4.50+dfsg-1ubuntu2) groovy; urgency=medium
+
+  * d/apparmor-profile: Update apparmor profile to grant access to
+    the saslauthd socket, so that SASL authentication works. (LP: #1557157)
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 12 Jun 2020 18:20:42 -0400
+
+openldap (2.4.50+dfsg-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      + d/apparmor-profile: add AppArmor profile
+      + d/rules: use dh_apparmor
+      + d/control: Build-Depends on dh-apparmor
+      + d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support (first added in 2.4.18-0ubuntu2):
+      + d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      + d/configure.options: Configure with --with-gssapi
+      + d/control: Added heimdal-dev as a build depend
+      + d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+      + d/libldap-2.4-2.symbols: add symbols for GSSAPI support
+      This should be dropped when the soname changes.
+    - Enable ufw support:
+      + d/control: suggest ufw.
+      + d/rules: install ufw profile.
+      + d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      + d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      + d/slapd.install:
+        - install nssov overlay
+      + d/slapd.manpages:
+        - install slapo-nssov(5) man page
+      + d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+        Debian bug #919136, we also have to patch the nssov makefile
+        accordingly and thus update this patch.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.scripts-common:
+      + add slapcat_opts to local variables.
+      + Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - Add support for CLDAP (UDP) support, back then required by
+      likewise-open (first enabled in 2.4.17-1ubuntu2):
+      + d/rules: Enable -DLDAP_CONNECTIONLESS
+      + d/libldap-2.4-2.symbols: add symbols for CLDAP (UDP)
+      This should be dropped when the soname changes.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because
+      of test timing issue.
+  * Dropped:
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+      [Not worth keeping a delta for, as having olcRootDN doesn't hurt]
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [Debian now shows the full package version]
+    - SECURITY UPDATE: denial of service via nested search filters
+      + debian/patches/CVE-2020-12243.patch: limit depth of nested
+        filters in servers/slapd/filter.c.
+      [Fixed upstream]
+  * Added:
+    - d/rules, debian/patches/set-maintainer-name: Extract maintainer
+      address dynamically from debian/control. Thanks to Ryan Tandy
+      <[e-mail]> (Closes: #960448, LP: #1875697)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 01 Jun 2020 09:19:58 -0300
+
 openldap (2.4.50+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -365,6 +874,69 @@ openldap (2.4.49+dfsg-3) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sat, 04 Apr 2020 10:43:56 -0700
 
+openldap (2.4.49+dfsg-2ubuntu2) groovy; urgency=medium
+
+  * SECURITY UPDATE: denial of service via nested search filters
+    - debian/patches/CVE-2020-12243.patch: limit depth of nested filters in
+      servers/slapd/filter.c.
+    - debian/patches/fix_test_timing.patch: fix FTBFS on riscv64 because of
+      test timing issue.
+    - CVE-2020-12243
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 01 May 2020 13:09:12 -0400
+
+openldap (2.4.49+dfsg-2ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable (LP: #1866303). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+        [Dropped the ldap_gssapi_bind_s() hunk as that is already
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 06 Mar 2020 11:39:12 -0300
+
 openldap (2.4.49+dfsg-2) unstable; urgency=medium
 
   * slapd.README.Debian: Document the initial setup performed by slapd's
@@ -376,6 +948,62 @@ openldap (2.4.49+dfsg-2) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 05 Mar 2020 12:59:46 -0800
 
+openldap (2.4.49+dfsg-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+        [Dropped the ldap_gssapi_bind_s() hunk as that is already
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+  * Dropped:
+    - d/control: slapd can depend on perl:any since it only uses perl for
+      some maintainer and helper scripts.
+      [In 2.4.49+dfsg-1]
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 10 Feb 2020 12:13:47 -0300
+
 openldap (2.4.49+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -404,6 +1032,102 @@ openldap (2.4.49+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 06 Feb 2020 10:08:12 -0800
 
+openldap (2.4.48+dfsg-1ubuntu4) focal; urgency=medium
+
+  * d/control: slapd can depend on perl:any since it only uses perl for
+    some maintainer and helper scripts. The perl backend links against
+    the correct architecture perl libraries already. Can be dropped
+    after https://salsa.debian.org/openldap-team/openldap/commit/794c736
+    is in a Debian upload.
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 06 Jan 2020 16:46:11 -0300
+
+openldap (2.4.48+dfsg-1ubuntu3) focal; urgency=medium
+
+  * No-change rebuild against libnettle7
+
+ -- Steve Langasek <[e-mail]>  Thu, 31 Oct 2019 22:13:44 +0000
+
+openldap (2.4.48+dfsg-1ubuntu2) focal; urgency=medium
+
+  * No-change rebuild for the perl update.
+
+ -- Matthias Klose <[e-mail]>  Fri, 18 Oct 2019 19:37:23 +0000
+
+openldap (2.4.48+dfsg-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+  * Dropped:
+    - Fix sysv-generator unit file by customizing parameters (LP #1821343)
+      + d/slapd-remain-after-exit.conf: Override RemainAfterExit to allow
+        correct systemctl status for slapd daemon.
+      + d/slapd.install: place override file in correct location.
+      [Included in 2.4.48+dfsg-1]
+    - SECURITY UPDATE: rootDN proxyauthz not restricted to its own databases
+      + debian/patches/CVE-2019-13057-1.patch: add restriction to
+        servers/slapd/saslauthz.c.
+      + debian/patches/CVE-2019-13057-2.patch: add tests to
+        tests/data/idassert.out, tests/data/slapd-idassert.conf,
+        tests/data/test-idassert1.ldif, tests/scripts/test028-idassert.
+      + debian/patches/CVE-2019-13057-3.patch: fix typo in
+        tests/scripts/test028-idassert.
+      + debian/patches/CVE-2019-13057-4.patch: fix typo in
+        tests/scripts/test028-idassert.
+      + CVE-2019-13057
+      [Fixed upstream]
+    - SECURITY UPDATE: SASL SSF not initialized per connection
+      + debian/patches/CVE-2019-13565.patch: zero out sasl_ssf in
+        connection_init in servers/slapd/connection.c.
+      + CVE-2019-13565
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 31 Jul 2019 18:01:14 -0300
+
 openldap (2.4.48+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -431,6 +1155,87 @@ openldap (2.4.48+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 25 Jul 2019 08:32:00 -0700
 
+openldap (2.4.47+dfsg-3ubuntu3) eoan; urgency=medium
+
+  * SECURITY UPDATE: rootDN proxyauthz not restricted to its own databases
+    - debian/patches/CVE-2019-13057-1.patch: add restriction to
+      servers/slapd/saslauthz.c.
+    - debian/patches/CVE-2019-13057-2.patch: add tests to
+      tests/data/idassert.out, tests/data/slapd-idassert.conf,
+      tests/data/test-idassert1.ldif, tests/scripts/test028-idassert.
+    - debian/patches/CVE-2019-13057-3.patch: fix typo in
+      tests/scripts/test028-idassert.
+    - debian/patches/CVE-2019-13057-4.patch: fix typo in
+      tests/scripts/test028-idassert.
+    - CVE-2019-13057
+  * SECURITY UPDATE: SASL SSF not initialized per connection
+    - debian/patches/CVE-2019-13565.patch: zero out sasl_ssf in
+      connection_init in servers/slapd/connection.c.
+    - CVE-2019-13565
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 26 Jul 2019 13:21:00 -0400
+
+openldap (2.4.47+dfsg-3ubuntu2) disco; urgency=medium
+
+  * Fix sysv-generator unit file by customizing parameters (LP: #1821343)
+    - d/slapd-remain-after-exit.conf: Override RemainAfterExit to allow
+      correct systemctl status for slapd daemon.
+    - d/slapd.install: place override file in correct location.
+
+ -- Heitor Alves de Siqueira <[e-mail]>  Mon, 08 Apr 2019 12:39:12 -0300
+
+openldap (2.4.47+dfsg-3ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+  * Added changes:
+    - d/p/contrib-makefiles: given the change in 2.4.47+dfsg-3 regarding
+      Debian bug #919136, we also have to patch the nssov makefile
+      accordingly and thus update this patch.
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 11 Feb 2019 09:20:47 -0200
+
 openldap (2.4.47+dfsg-3) unstable; urgency=medium
 
   * Restore patches to contrib Makefiles to set CFLAGS, CPPFLAGS, and LDFLAGS
@@ -446,6 +1251,63 @@ openldap (2.4.47+dfsg-3) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sat, 02 Feb 2019 10:30:10 -0800
 
+openldap (2.4.47+dfsg-2ubuntu1) disco; urgency=medium
+
+  * Merge from Debian unstable (LP: #1811630).  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/rules:
+        - add nssov to CONTRIB_MODULES
+        - add sysconfdir to CONTRIB_MAKEVARS
+      - d/slapd.install:
+        - install nssov overlay
+      - d/slapd.manpages:
+        - install slapo-nssov(5) man page
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+  * Update nssov build and packaging for Debian changes:
+    - Drop patch nssov-build
+    - d/rules:
+      - add nssov to CONTRIB_MODULES
+      - add sysconfdir to CONTRIB_MAKEVARS
+    - d/slapd.install:
+      - install nssov overlay
+    - d/slapd.manpages:
+      - install slapo-nssov(5) man page
+
+ -- Ryan Tandy <[e-mail]>  Sun, 13 Jan 2019 04:47:09 +0000
+
 openldap (2.4.47+dfsg-2) unstable; urgency=medium
 
   * Reintroduce slapi-dev binary package. (Closes: #711469)
@@ -483,6 +1345,63 @@ openldap (2.4.47+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 23 Dec 2018 12:50:40 -0800
 
+openldap (2.4.46+dfsg-5ubuntu3) disco; urgency=medium
+
+  * d/apparmor-profile: update apparmor profile to allow reading of
+    files needed when slapd is behaving as a kerberos/gssapi client
+    and acquiring its own ticket. (LP: #1783183)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 09 Nov 2018 21:29:51 -0200
+
+openldap (2.4.46+dfsg-5ubuntu2) disco; urgency=medium
+
+  * No-change rebuild for the perl 5.28 transition.
+
+ -- Adam Conrad <[e-mail]>  Fri, 02 Nov 2018 18:14:37 -0600
+
+openldap (2.4.46+dfsg-5ubuntu1) cosmic; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 09 May 2018 13:44:37 +0200
+
 openldap (2.4.46+dfsg-5) unstable; urgency=medium
 
   * Restore slapd-smbk5pwd now that libldap is installable in unstable.
@@ -502,6 +1421,49 @@ openldap (2.4.46+dfsg-3) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Fri, 04 May 2018 07:36:58 -0700
 
+openldap (2.4.46+dfsg-2ubuntu1) cosmic; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 04 May 2018 10:19:24 +0200
+
 openldap (2.4.46+dfsg-2) unstable; urgency=medium
 
   * Remove version constraint from libldap-2.4-2 dependency on libldap-common.
@@ -531,6 +1493,49 @@ openldap (2.4.46+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 03 May 2018 07:03:30 -0700
 
+openldap (2.4.45+dfsg-1ubuntu1) artful; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 28 Jul 2017 14:49:07 +0200
+
 openldap (2.4.45+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -572,6 +1577,49 @@ openldap (2.4.45+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Thu, 27 Jul 2017 18:04:41 -0700
 
+openldap (2.4.44+dfsg-8ubuntu1) artful; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 17 Jul 2017 10:58:24 +0200
+
 openldap (2.4.44+dfsg-8) unstable; urgency=medium
 
   * Disable test060-mt-hot on ppc64el temporarily to avoid failing tests until
@@ -582,6 +1630,52 @@ openldap (2.4.44+dfsg-8) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 16 Jul 2017 12:57:41 -0700
 
+openldap (2.4.44+dfsg-7ubuntu1) artful; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Tue, 27 Jun 2017 10:21:41 +0200
+
 openldap (2.4.44+dfsg-7) unstable; urgency=medium
 
   * Relax the dependency of libldap-2.4-2 on libldap-common to also permit
@@ -589,6 +1683,52 @@ openldap (2.4.44+dfsg-7) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Tue, 27 Jun 2017 18:53:12 -0700
 
+openldap (2.4.44+dfsg-6ubuntu1) artful; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Gianfranco Costamagna <[e-mail]>  Tue, 27 Jun 2017 10:21:41 +0200
+
 openldap (2.4.44+dfsg-6) unstable; urgency=medium
 
   * Update the list of non-translatable strings for the
@@ -597,6 +1737,54 @@ openldap (2.4.44+dfsg-6) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Mon, 26 Jun 2017 19:42:02 -0700
 
+openldap (2.4.44+dfsg-5ubuntu1) artful; urgency=medium
+
+   * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    [ undocumented in prior merge, added in 2.4.41+dfsg-1ubuntu1 ]
+    - Fix use after free with GnuTLS. (LP #1557248)
+
+ -- Gianfranco Costamagna <[e-mail]>  Sun, 28 May 2017 22:43:50 +0200
+
 openldap (2.4.44+dfsg-5) unstable; urgency=medium
 
   * debian/patches/ITS-8644-wait-for-slapd-to-start-in-test064.patch: Fix an
@@ -608,6 +1796,54 @@ openldap (2.4.44+dfsg-5) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 28 May 2017 09:59:46 -0700
 
+openldap (2.4.44+dfsg-4ubuntu1) artful; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    [ undocumented in prior merge, added in 2.4.41+dfsg-1ubuntu1 ]
+    - Fix use after free with GnuTLS. (LP #1557248)
+
+ -- Gianfranco Costamagna <[e-mail]>  Sat, 22 Apr 2017 14:28:54 +0200
+
 openldap (2.4.44+dfsg-4) unstable; urgency=medium
 
   * Improve the slapd/ppolicy_schema_needs_update debconf template. Thanks to
@@ -654,6 +1890,67 @@ openldap (2.4.44+dfsg-4) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 16 Apr 2017 20:10:43 -0700
 
+openldap (2.4.44+dfsg-3ubuntu2) zesty; urgency=medium
+
+  * d/rules: Fix typo in previous upload.
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 10 Feb 2017 12:17:02 -0800
+
+openldap (2.4.44+dfsg-3ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian unstable (LP: #1663702, LP: #1654416). Remaining
+    changes
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+      - d/rules:
+        - Explicitly add -I/usr/include/heimdal to CFLAGS.
+        - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    [ d/rules modification mentioned above was dropped in
+      2.4.23-6ubuntu1, re-adding it ]
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+      [ Refreshed patch ]
+    - d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+      - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+      - GSSAPI support was enabled in 2.4.18-0ubuntu2
+    [ undocumented in prior merge, added in 2.4.41+dfsg-1ubuntu1 ]
+    - Fix use after free with GnuTLS. (LP #1557248)
+  * Drop:
+    - d/slapd.scripts-common:
+      + Remove unused variable new_conf.
+    [ configure_v2_protocol_support function removed in 2.4.44+dfsg-1 ]
+    - d/b/config.log: add config.log
+    [ previously undocumented, stray change ]
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 10 Feb 2017 11:38:57 -0800
+
 openldap (2.4.44+dfsg-3) unstable; urgency=medium
 
   * Apply upstream patch to fix FTBFS on kFreeBSD. (Closes: #845394)
@@ -726,6 +2023,73 @@ openldap (2.4.44+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Mon, 14 Nov 2016 18:59:30 -0800
 
+openldap (2.4.42+dfsg-2ubuntu5) zesty; urgency=medium
+
+  * No-change rebuild for perl 5.24 transition
+
+ -- Iain Lane <[e-mail]>  Mon, 24 Oct 2016 10:37:13 +0100
+
+openldap (2.4.42+dfsg-2ubuntu4) yakkety; urgency=medium
+
+  * Fix use after free with GnuTLS. (LP: #1557248)
+
+ -- Maciej Puzio <[e-mail]>  Fri, 25 Mar 2016 15:24:25 -0500
+
+openldap (2.4.42+dfsg-2ubuntu3) xenial; urgency=medium
+
+  * Fix building with gssapi suppport:
+    - Explicitly add -I/usr/include/heimdal to CFLAGS.
+    - Explicitly add -I/usr/lib/<multiarch>/heimdal to LDFLAGS.
+
+ -- Matthias Klose <[e-mail]>  Thu, 18 Feb 2016 09:17:27 +0100
+
+openldap (2.4.42+dfsg-2ubuntu2) xenial; urgency=medium
+
+  * No-change rebuild for gnutls transition.
+
+ -- Matthias Klose <[e-mail]>  Wed, 17 Feb 2016 22:27:04 +0000
+
+openldap (2.4.42+dfsg-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian testing (LP: #1532648). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+  * Drop CVE-2015-6908.patch, included in Debian.
+  * Remove DEB_HOST_ARCH from debian/rules: left over from when mdb was 
+    disabled on ppc64el, no longer used, and missed in the previous merge.
+
+ -- Ryan Tandy <[e-mail]>  Sun, 10 Jan 2016 15:50:53 -0800
+
 openldap (2.4.42+dfsg-2) unstable; urgency=medium
 
   [ Ryan Tandy ]
@@ -793,6 +2157,71 @@ openldap (2.4.42+dfsg-1) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Fri, 21 Aug 2015 13:07:51 -0700
 
+openldap (2.4.41+dfsg-1ubuntu3) xenial; urgency=medium
+
+  * Rebuild for Perl 5.22.1.
+
+ -- Colin Watson <[e-mail]>  Fri, 18 Dec 2015 15:10:17 +0000
+
+openldap (2.4.41+dfsg-1ubuntu2) wily; urgency=medium
+
+  * SECURITY UPDATE: denial of service via crafted BER data
+    - debian/patches/CVE-2015-6908.patch: remove obsolete assert in
+      libraries/liblber/io.c.
+    - CVE-2015-6908
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 14 Sep 2015 10:25:04 -0400
+
+openldap (2.4.41+dfsg-1ubuntu1) wily; urgency=medium
+
+  * Merge from Debian testing (LP: #1471831). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+  * Dropped changes:
+    - Fix cpp calls for GCC 5: fixed upstream (ITS#8056)
+  * Upstream fixes:
+    - slapd crash with auditlog overlay and large (~27KB) attribute values
+      (ITS#8003) (LP: #1461276)
+    - nssov updated to support recent nss-pam-ldapd client libraries
+      (ITS#8097) (LP: #1393306)
+  * Update d/patches/nssov-build for upstream changes.
+  * Tweak d/patches/gssapi.diff to apply without fuzz.
+  * d/libldap-2.4-2.symbols: Add symbols not present in Debian.
+    - CLDAP (UDP) was added in 2.4.17-1ubuntu2
+    - GSSAPI support was enabled in 2.4.18-0ubuntu2
+
+ -- Ryan Tandy <[e-mail]>  Fri, 24 Jul 2015 14:12:06 -0700
+
 openldap (2.4.41+dfsg-1) unstable; urgency=medium
 
   * New upstream release.
@@ -812,6 +2241,62 @@ openldap (2.4.40+dfsg-2) unstable; urgency=medium
 
  -- Ryan Tandy <[e-mail]>  Sun, 28 Jun 2015 20:40:37 -0700
 
+openldap (2.4.40+dfsg-1ubuntu2) wily; urgency=medium
+
+  * No-change rebuild for the libnettle6 transition.
+
+ -- Adam Conrad <[e-mail]>  Sun, 14 Jun 2015 03:58:30 -0600
+
+openldap (2.4.40+dfsg-1ubuntu1) wily; urgency=low
+
+  * Merge from Debian testing (LP: #1395098, LP: #1316124). Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added heimdal-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common:
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - Show distribution in version:
+      - d/control: added lsb-release
+      - d/patches/fix-ldap-distribution.patch: show distribution in version
+  * Drop patches included upstream:
+    - d/patches/0001-ITS-7430-GnuTLS-Avoid-use-of-deprecated-function.patch
+    - d/patches/bdb-deadlock.patch
+    - d/patches/its-7354-fix-delta-sync-mmr.diff
+  * Drop hardening-wrapper as Debian now sets PIE and bindnow flags.
+  * debian/patches/nssov-build: Adjust for upstream changes.
+  * debian/apparmor-profile:
+    - Change 'r' to 'rw' for ldapi and nslcd sockets, required for apparmor
+      kernel ABI v7 (utopic and later). (LP: #1392018)
+    - Reduce permissions on /run/nslcd to just the nslcd socket.
+  * Enable the mdb backend again on ppc64el, fixed upstream in ITS#7713.
+    (LP: #1293250)
+
+ -- Ryan Tandy <[e-mail]>  Mon, 25 May 2015 19:49:21 -0700
+
 openldap (2.4.40+dfsg-1) unstable; urgency=medium
 
   * Remove inetorgperson.schema from the upstream source. Replace it with a
@@ -1000,6 +2485,187 @@ openldap (2.4.39-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Mon, 17 Mar 2014 15:27:31 -0700
 
+openldap (2.4.31-1+nmu2ubuntu12) vivid; urgency=medium
+
+  * Fix cpp calls for GCC 5.
+
+ -- Matthias Klose <[e-mail]>  Fri, 06 Mar 2015 13:23:29 +0100
+
+openldap (2.4.31-1+nmu2ubuntu11) utopic; urgency=medium
+
+  * debian/apparmor-profile:
+    - allow p11-kit abstraction
+    - allow read of /etc/gss/mech.d/*
+
+ -- Jamie Strandboge <[e-mail]>  Tue, 02 Sep 2014 15:29:05 -0500
+
+openldap (2.4.31-1+nmu2ubuntu10) utopic; urgency=medium
+
+  * Rebuild for Perl 5.20.0.
+
+ -- Colin Watson <[e-mail]>  Thu, 21 Aug 2014 13:29:20 +0100
+
+openldap (2.4.31-1+nmu2ubuntu9) utopic; urgency=medium
+
+  * Cherry-pick upstream patch for compat with recent GNUTLS.
+  * Build-depend on libgnutls28-dev.
+  * Build-depend on libgcrypt20-dev.
+
+ -- Dimitri John Ledkov <[e-mail]>  Fri, 08 Aug 2014 11:01:56 +0100
+
+openldap (2.4.31-1+nmu2ubuntu8) trusty; urgency=medium
+
+  * Bump database_format_changed value to 2.4.31-1+nmu2ubuntu5 for db5.3.
+
+ -- Adam Conrad <[e-mail]>  Mon, 17 Mar 2014 12:50:18 -0600
+
+openldap (2.4.31-1+nmu2ubuntu7) trusty; urgency=medium
+
+  * Disable mdb backend on ppc64el due to test-suite failures.
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 17 Mar 2014 16:32:29 +0000
+
+openldap (2.4.31-1+nmu2ubuntu6) trusty; urgency=low
+
+  * Fix segfault issue with master-master syncrepl (LP: #1287730):
+    - d/patches/its-7354-fix-delta-sync-mmr.diff: Cherry picked
+      patch from upstream VCS.
+
+ -- Pierre Fersing <[e-mail]>  Tue, 04 Mar 2014 16:04:57 +0100
+
+openldap (2.4.31-1+nmu2ubuntu5) trusty; urgency=low
+
+  * Build-depend on libdb5.3-dev, instead of libdb5.1-dev.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Mon, 04 Nov 2013 08:04:30 +0000
+
+openldap (2.4.31-1+nmu2ubuntu4) trusty; urgency=low
+
+  * Rebuild for Perl 5.18.
+
+ -- Colin Watson <[e-mail]>  Tue, 22 Oct 2013 12:16:39 +0100
+
+openldap (2.4.31-1+nmu2ubuntu3) saucy; urgency=low
+
+  * Update build/config.guess and build/config.sub at build time; this was
+    not done automatically because the top-level configure.in does not use
+    Automake.
+
+ -- Colin Watson <[e-mail]>  Tue, 08 Oct 2013 17:24:59 +0100
+
+openldap (2.4.31-1+nmu2ubuntu2) saucy; urgency=low
+
+  * debian/control: added lsb-release
+  * debian/patches/fix-ldap-distribution.patch: show distribution in version
+
+ -- Yolanda Robla <[e-mail]>  Mon, 08 Jul 2013 16:53:09 +0200
+
+openldap (2.4.31-1+nmu2ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+      - d/slapd.dirs: add etc/apparmor.d/force-complain
+    - Enable GSSAPI support:
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added libkrb5-dev as a build depend
+    - Enable ufw support:
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay:
+      - d/{patches/nssov-build,/rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook.
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common: 
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open
+    - d/{control,rules}: enable PIE hardening
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 30 May 2013 13:03:25 -0400
+
+openldap (2.4.31-1+nmu2) unstable; urgency=high
+
+  * Non-maintainer upload.
+  * No-change rebuild in a clean environment
+
+ -- Jonathan Wiltshire <[e-mail]>  Tue, 23 Apr 2013 13:10:00 +0100
+
+openldap (2.4.31-1+nmu1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Avoid deadlocks in back-bdb that truncate slapcat output (closes: #673038).
+
+ -- Michael Gilbert <[e-mail]>  Tue, 16 Apr 2013 03:35:31 +0000
+
+openldap (2.4.31-1ubuntu2) quantal-proposed; urgency=low
+
+  * debian/slapd.py: Add AppArmor info and logs to apport hook.
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 20 Aug 2012 08:46:02 -0400
+
+openldap (2.4.31-1ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Enable AppArmor support:
+      - d/apparmor-profile: add AppArmor profile
+      - d/rules: use dh_apparmor
+      - d/control: Build-Depends on dh-apparmor
+      - d/slapd.README.Debian: add note about AppArmor
+      - d/slapd.dirs: add etc/apparmor.d/force-complain
+    - Enable GSSAPI support (LP: #495418):
+      - d/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+        - Add --with-gssapi support
+        - Make guess_service_principal() more robust when determining
+          principal
+      - d/configure.options: Configure with --with-gssapi
+      - d/control: Added libkrb5-dev as a build depend
+    - Enable ufw support (LP: #423246):
+      - d/control: suggest ufw.
+      - d/rules: install ufw profile.
+      - d/slapd.ufw.profile: add ufw profile.
+    - Enable nss overlay (LP: #675391):
+      - d/{patches/nssov-build,/rules}: Apply, build and package the
+        nss overlay.
+    - d/{rules,slapd.py}: Add apport hook. (LP: #610544)
+    - d/slapd.init.ldif: don't set olcRootDN since it's not defined in
+      either the default DIT nor via an Authn mapping.
+    - d/slapd.scripts-common: 
+      - add slapcat_opts to local variables.
+      - Remove unused variable new_conf.
+      - Fix backup directory naming for multiple reconfiguration.
+    - d/{slapd.default,slapd.README.Debian}: use the new configuration style.
+    - d/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+      in the openldap library, as required by Likewise-Open (LP: #390579)
+    - d/{control,rules}: enable PIE hardening
+  * Dropped changes:
+    - d/patches/its-7107-fix-Operation-init-on-reuse.diff: Included in upstream release.
+    - d/patches/CVE-2011-4079: Included in upstream release.
+    - d/patches/service-operational-before-detach: Included in upstream release.
+    - d/schema/extra/misc.ldif: Included upstream.
+    - d/{rules,schema/extra}: Fix configure and clean rules to support
+      extra schemas shipped as part of the debian/schema/ directory; no longer required.
+    - Included in Debian:
+      + Document cn=config in README file.
+      + Install a default DIT; actually a minimal configuration.
+      + d/patches/heimdal-fix.
+  * General tidy of d/patches to remove obsolete patches being held in Ubuntu delta.
+
+ -- James Page <[e-mail]>  Fri, 20 Jul 2012 13:48:32 +0100
+
 openldap (2.4.31-1) unstable; urgency=low
 
   * New upstream release.
@@ -1026,6 +2692,121 @@ openldap (2.4.31-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Wed, 27 Jun 2012 03:27:34 +0000
 
+openldap (2.4.28-1.1ubuntu6) quantal; urgency=low
+
+  * Fix issue with intermittent connection issues when using LDAPv3
+    protocol (LP: #1023025):
+    - d/patches/its-7107-fix-Operation-init-on-reuse.diff: Cherry picked
+      patch from upstream VCS which ensures objects are initialized before
+      re-use.
+
+ -- Pierre Fersing <[e-mail]>  Thu, 19 Jul 2012 14:05:09 +0100
+
+openldap (2.4.28-1.1ubuntu5) quantal; urgency=low
+
+  * debian/rules: Add smbk5pwd build.
+  * debian/control: Add slapd-smbk5pwd binary package.
+  * debian/patches/heimdal-fix: adapt parameters of 
+    hdb_generate_key_set_password() to heimdal 1.6~git20120311
+    (patch from Debian #664930).
+
+ -- Jorge Salamero Sanz <[e-mail]>  Wed, 18 Jul 2012 09:30:28 -0400
+
+openldap (2.4.28-1.1ubuntu4) precise; urgency=low
+
+  * debian/control: Build-Depends on dh-apparmor (LP: #948481)
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 05 Apr 2012 09:34:37 -0500
+
+openldap (2.4.28-1.1ubuntu3) precise; urgency=low
+
+  * Add its-7176-only-poll-sockets-for-write-as-needed.diff
+    (LP: #932823).
+
+ -- Timo Aaltonen <[e-mail]>  Tue, 21 Feb 2012 15:36:29 +0200
+
+openldap (2.4.28-1.1ubuntu2) precise; urgency=low
+
+  * Remove debian/patches/CVE-2011-4079; it's already in this upstream
+    version. Fixes FTBFS.
+
+ -- Daniel T Chen <[e-mail]>  Wed, 25 Jan 2012 17:26:17 -0500
+
+openldap (2.4.28-1.1ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+     + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+       neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+      + debian/patches/CVE-2011-4079: fix off by one error in postalAddressNormalize()
+        (CVE-2011-4079)
+
+
+ -- Chuck Short <[e-mail]>  Mon, 23 Jan 2012 10:01:13 -0500
+
+openldap (2.4.28-1.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Disable the mdb backend on non-Linux, it looks like it doesn't work with
+    linuxthreads (closes: #654824).
+
+ -- Julien Cristau <[e-mail]>  Mon, 16 Jan 2012 19:45:42 +0100
+
 openldap (2.4.28-1) unstable; urgency=low
 
   * New upstream release.
@@ -1053,6 +2834,72 @@ openldap (2.4.28-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Thu, 05 Jan 2012 06:07:11 +0000
 
+openldap (2.4.25-4ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+     + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+       neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+      + debian/patches/CVE-2011-4079: fix off by one error in postalAddressNormalize()
+        (CVE-2011-4079)
+
+ -- Chuck Short <[e-mail]>  Tue, 22 Nov 2011 06:17:49 +0000
+
 openldap (2.4.25-4) unstable; urgency=low
 
   * Drop explicit depends on libdb4.8, since we're now linking against
@@ -1086,6 +2933,85 @@ openldap (2.4.25-4) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 18 Oct 2011 01:08:34 +0000
 
+openldap (2.4.25-3ubuntu3) precise; urgency=low
+
+  * Rebuild for Perl 5.14.
+
+ -- Colin Watson <[e-mail]>  Tue, 15 Nov 2011 20:50:09 +0000
+
+openldap (2.4.25-3ubuntu2) precise; urgency=low
+
+  * SECURITY UPDATE: potential denial of service (LP: #884163)
+    - debian/patches/CVE-2011-4079: fix off by one error in
+      postalAddressNormalize()
+    - CVE-2011-4079
+
+ -- Jamie Strandboge <[e-mail]>  Mon, 14 Nov 2011 13:59:56 -0600
+
+openldap (2.4.25-3ubuntu1) precise; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+     + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+       neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+
+ -- Chuck Short <[e-mail]>  Wed, 19 Oct 2011 20:53:08 +0000
+
 openldap (2.4.25-3) unstable; urgency=low
 
   * Brown paper bag: really fix the .links.in handling, so we don't generate
@@ -1108,6 +3034,92 @@ openldap (2.4.25-2) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Sun, 14 Aug 2011 23:17:09 -0700
 
+openldap (2.4.25-1.1ubuntu4) oneiric; urgency=low
+
+  * Brown paper bag: really fix the .links.in handling, so we don't generate
+    broken /usr/lib/${DEB_HOST_MULTIARCH} dirs.
+
+ -- Steve Langasek <[e-mail]>  Mon, 15 Aug 2011 09:43:29 +0000
+
+openldap (2.4.25-1.1ubuntu3) oneiric; urgency=low
+
+  * Cherry-pick multiarch support from Debian (LP: #826601):
+    - Bump to compat level 7, so we don't have to spell out debian/tmp in
+      every single .install file
+    - Build for multiarch.
+
+ -- Steve Langasek <[e-mail]>  Mon, 15 Aug 2011 02:23:43 -0700
+
+openldap (2.4.25-1.1ubuntu2) oneiric; urgency=low
+
+  * debian/apparmor-profile: Allow /var/run and /run. (LP: #810270)
+
+ -- Martin Pitt <[e-mail]>  Thu, 14 Jul 2011 15:18:02 +0200
+
+openldap (2.4.25-1.1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+      + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+        neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+
+ -- Chuck Short <[e-mail]>  Sun, 05 Jun 2011 17:38:40 +0100
+
 openldap (2.4.25-1.1) unstable; urgency=low
 
   * Non-maintainer upload to fix RC bug.
@@ -1115,6 +3127,75 @@ openldap (2.4.25-1.1) unstable; urgency=low
 
  -- Thijs Kinkhorst <[e-mail]>  Tue, 31 May 2011 11:57:29 +0200
 
+openldap (2.4.25-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+      + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+        neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+      + Install nss overlay (LP: #675391):
+        - debian/rules: run install target for nssov module.
+        - debian/patches/nssov-build: fix patch to install schema in /etc/ldap/schema
+      + debian/patches/gssapi.diff:
+        - Update patch so that likewise-open is usuable again. (LP: #661547)
+      + debian/patches/service-operational-before-detach: New patch replacing old one
+        of the same name as previous could cause database corruption based on upstream commits.
+        (LP: #727973)
+       + Dropped:
+         - debian/patches/gold: Use the debian version instead
+         - debian/patches/CVE-2011-1024: Fixed upstream
+         - debian/patches/CVE-2011-1025: Fixed upstream
+         - debian/patches/CVE-2011-1081: Fixed upstream 
+
+ -- Chuck Short <[e-mail]>  Sun, 08 May 2011 16:34:09 +0100
+
 openldap (2.4.25-1) unstable; urgency=low
 
   * New upstream version (Closes: #617606, #618904, #606815, #608813)
@@ -1146,6 +3227,116 @@ openldap (2.4.23-7) unstable; urgency=low
 
  -- Matthijs Mohlmann <[e-mail]>  Sat, 06 Nov 2010 12:13:01 +0100
 
+openldap (2.4.23-6ubuntu7) oneiric; urgency=low
+
+  * Rebuild for Perl 5.12.
+
+ -- Colin Watson <[e-mail]>  Sun, 08 May 2011 13:40:28 +0100
+
+openldap (2.4.23-6ubuntu6) natty; urgency=low
+
+  * SECURITY UPDATE: fix successful anonymous bind via chain overlay when
+    using forwarded authentication failures
+    - debian/patches/CVE-2011-1024
+    - CVE-2011-1024
+  * SECURITY UPDATE: verify password when authenticating to rootdn and using ndb
+    backend. Note: Ubuntu is not compiled with --enable-ndb by default
+    - debian/patches/CVE-2011-1025
+    - CVE-2011-1025
+  * SECURITY UPDATE: fix DoS when processing unauthenticated modrdn requests
+    and requestDN is empty
+    - debian/patches/CVE-2011-1081
+    - CVE-2011-1081
+    - LP: #742104
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 07 Apr 2011 11:36:53 -0500
+
+openldap (2.4.23-6ubuntu5) natty; urgency=low
+
+  * debian/patches/service-operational-before-detach: New patch replacing
+    old one of same name as previous could cause database corruption, 
+    based on upstream commits. (LP: #727973)
+
+ -- Dave Walker (Daviey) <[e-mail]>  Wed, 02 Mar 2011 20:33:08 +0000
+
+openldap (2.4.23-6ubuntu4) natty; urgency=low
+
+  * Fix FTBFS with ld.gold.
+
+ -- Matthias Klose <[e-mail]>  Wed, 19 Jan 2011 07:39:49 +0100
+
+openldap (2.4.23-6ubuntu3) natty; urgency=low
+
+  * debian/patches/gssapi.diff:
+    Update patch so that likewise-open is usable again (LP: #661547)
+
+ -- Thierry Carrez (ttx) <[e-mail]>  Fri, 26 Nov 2010 15:50:11 +0100
+
+openldap (2.4.23-6ubuntu2) natty; urgency=low
+
+  * Install nss overlay (LP: #675391):
+    - debian/rules: run install target for nssov module.
+    - debian/patches/nssov-build: fix patch to install schema in
+      /etc/ldap/schema.
+
+ -- Mathias Gug <[e-mail]>  Wed, 17 Nov 2010 18:16:42 -0500
+
+openldap (2.4.23-6ubuntu1) natty; urgency=low
+
+  * Merge from Debian unstable:
+    - Install a default DIT (LP: #442498).
+    - Document cn=config in README file (LP: #370784).
+    - remaining changes:
+      + AppArmor support:
+        - debian/apparmor-profile: add AppArmor profile
+        - use dh_apparmor:
+          - debian/rules: use dh_apparmor
+          - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+        - updated debian/slapd.README.Debian for note on AppArmor
+        - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      + Enable GSSAPI support (LP: #495418):
+        - debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+          - Add --with-gssapi support
+          - Make guess_service_principal() more robust when determining
+            principal
+        - debian/patches/series: apply gssapi.diff patch.
+        - debian/configure.options: Configure with --with-gssapi
+        - debian/control: Added libkrb5-dev as a build depend
+      + debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+        in the openldap library, as required by Likewise-Open (LP: #390579)
+      + Don't build smbk5pwd overlay since it uses heimdal instead of krb5:
+        - debian/control: 
+          - remove build-dependency on heimdal-dev.
+          - remove slapd-smbk5pwd binary package.
+        - debian/rules: don't build smbk5pwd slapd module.
+      + debian/{control,rules}: enable PIE hardening
+      + ufw support (LP: #423246):
+        - debian/control: suggest ufw.
+        - debian/rules: install ufw profile.
+        - debian/slapd.ufw.profile: add ufw profile.
+      + Enable nssoverlay:
+        - debian/patches/nssov-build, debian/series, debian/rules: 
+          Apply, build and package the nss overlay.
+        - debian/schema/extra/misc.ldif: add ldif file for the misc schema
+          which defines rfc822MailMember (required by the nss overlay).
+      + debian/rules, debian/schema/extra/: 
+        Fix configure rule to supports extra schemas shipped as part
+        of the debian/schema/ directory.
+      + debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+      + debian/slapd.init.ldif: don't set olcRootDN since it's not defined in
+        neither the default DIT nor via an Authn mapping.
+      + debian/slapd.scripts-common: adjust minimum version that triggers a
+        database upgrade. Upgrade from maverick shouldn't trigger database
+        upgrade (which would happen with the version used in Debian).
+      + debian/slapd.scripts-common: add slapcat_opts to local variables.
+        Remove unused variable new_conf.
+      + debian/slapd.script-common: Fix package reconfiguration.
+        - Fix backup directory naming for multiple reconfiguration.
+      + debian/slapd.default, debian/slapd.README.Debian: 
+        use the new configuration style.
+
+ -- Mathias Gug <[e-mail]>  Fri, 12 Nov 2010 15:19:07 -0500
+
 openldap (2.4.23-6) unstable; urgency=high
 
   * Check for an empty directory to prevent an rm -f /*. (Closes: #597704)
@@ -1268,6 +3459,80 @@ openldap (2.4.23-1) unstable; urgency=low
 
  -- Matthijs Mohlmann <[e-mail]>  Mon, 12 Jul 2010 13:25:00 +0200
 
+openldap (2.4.23-0ubuntu4) natty; urgency=low
+
+  * debian/slapd.templates: amended typo in slapd/move_old_database 
+    (LP: #666028)
+
+ -- James Page <[e-mail]>  Mon, 08 Nov 2010 10:00:58 +0000
+
+openldap (2.4.23-0ubuntu3.2) maverick-proposed; urgency=low
+
+  * debian/slapd.templates: re-add slapd/move_old_database template as it's
+    used during the package upgrade. Thanks to James Page for pointing it.
+  * debian/slapd.config: restore debconf question slapd/move_old_database.
+
+ -- Mathias Gug <[e-mail]>  Thu, 14 Oct 2010 16:56:38 -0400
+
+openldap (2.4.23-0ubuntu3.1) maverick-proposed; urgency=low
+
+  [ James Page ]
+  * Fixed install/upgrade process to dump/restore databases due 
+    to uplift to libdb4.8-dev (LP: #658227)   
+
+ -- Mathias Gug <[e-mail]>  Thu, 14 Oct 2010 14:50:49 -0400
+
+openldap (2.4.23-0ubuntu3) maverick; urgency=low
+
+  * debian/rules: move dh_apparmor before dh_installinit
+
+ -- Jamie Strandboge <[e-mail]>  Fri, 06 Aug 2010 17:34:21 -0500
+
+openldap (2.4.23-0ubuntu2) maverick; urgency=low
+
+  * convert to using dh_apparmor:
+    - debian/rules, debian/slapd.post{inst,rm}: use dh_apparmor
+    - debian/control: Build-Depends on debhelper 7.4.20ubuntu5
+  * debian/apparmor-profile: use local include
+
+ -- Jamie Strandboge <[e-mail]>  Fri, 06 Aug 2010 15:08:55 -0500
+
+openldap (2.4.23-0ubuntu1) maverick; urgency=low
+
+  * New release, features include:
+    + Fixed libldap to return server's error code (ITS#6569)
+    + Fixed libldap memleaks (ITS#6568)
+    + Fixed liblutil off-by-one with delta (ITS#6541)
+    + Fixed slapd acls with glued databases (ITS#6468)
+    + Fixed slapd syncrepl rid logging (ITS#6533)
+    + Fixed slapd modrdn handling of invalid values (ITS#6570)
+    + Fixed slapd-bdb hasSubordinates computation (ITS#6549)
+    + Fixed slapd-bdb to use memcpy instead for strcpy (ITS#6474)
+    + Fixed slapd-bdb entry cache delete failure (ITS#6577)
+    + Fixed slapd-ldap to return control responses (ITS#6530)
+    + Fixed slapo-ppolicy to use Debug (ITS#6566)
+    + Fixed slapo-refint to zero out freed DN vals (ITS#6572)
+    + Fixed slapo-rwm to use Debug (ITS#6566)
+    + Fixed slapo-sssvlv to use Debug (ITS#6566)
+    + Fixed slapo-syncprov lost deletes in refresh phase (ITS#6555)
+    + Fixed slapo-valsort to use Debug (ITS#6566)
+    + Fixed contrib/nssov network.c missing patch (ITS#6562)
+    + Fixed test043 attribute sorting (ITS#6553)
+    + slapd-config(5) note default rootdn (ITS#6546)
+  * Rebased patches debian/patches/dropped nssov-build
+  * Resynchronize with Debian:
+    + debian/control:
+      - Bump standards-version to 3.9.0
+      - Use libdb4.8-dev (LP: #572489)
+    + Added debian/patches/issue-6534-patch
+    + Added debian/patches/ldap-conf-tls-cacertdir
+  * Add ufw support, thanks to  PatRiehecky (LP: #423246)
+
+   [Adam Sommer]
+   * debian/rules, debian/slapd.py: Add apport hook. (LP: #610544)
+
+ -- Chuck Short <[e-mail]>  Wed, 28 Jul 2010 11:35:16 -0400
+
 openldap (2.4.21-1) unstable; urgency=low
 
   [ Steve Langasek ]
@@ -1299,6 +3564,79 @@ openldap (2.4.21-1) unstable; urgency=low
 
  -- Matthijs Mohlmann <[e-mail]>  Thu, 22 Apr 2010 23:40:30 +0200
 
+openldap (2.4.21-0ubuntu5) lucid; urgency=low
+
+  * Fix local root connection access: replace olcAuthzRegexp mapping to
+    cn=localroot,cn=config with using the SASL dn directly in olcAccess.
+    Makes upgrades much simpler and robust (LP: #563829).
+
+ -- Mathias Gug <[e-mail]>  Fri, 23 Apr 2010 00:23:31 -0400
+
+openldap (2.4.21-0ubuntu4) lucid; urgency=low
+
+  [ Simon Olofsson ]
+  * debian/slapd.postinst:
+    - Show a message after successful migration (LP: #538848)
+
+  [ Jorgen Rosink ]
+  * debian/slapd.init: add simple status checking with LSB compatible exit
+    codes (LP: #562377)
+  * debian/slapd.init.ldif:
+    - remove admin user in default config database (LP: #556176)
+    - in default config, add olcAccess entries giving access to controls
+      available and cn=subschema (LP: #427842)
+
+  [ Scott Moser ]
+  *  debian/slapd.scripts-common: Do not create /nonexistent directory
+     for openldap user's home (LP: #556176)
+  *  debian/slapd.postinst: fix cn=config olcAccess migration (LP: #559070)
+
+ -- Scott Moser <[e-mail]>  Mon, 12 Apr 2010 16:16:47 -0400
+
+openldap (2.4.21-0ubuntu3) lucid; urgency=low
+
+  * debian/slapd.postinst, debian/slapd.scripts-common: Upgrade databases
+    before trying to convert to slapd.d, to avoid upgrade failure from hardy
+    (LP: #536958)
+  * debian/slapd.postinst: Add a {1} numeric index to olcAccess entry in
+    olcDatabase={0}config.ldif to avoid upgrade failures (LP: #538516, #526230)
+
+ -- Thierry Carrez <[e-mail]>  Mon, 29 Mar 2010 13:31:47 +0200
+
+openldap (2.4.21-0ubuntu2) lucid; urgency=low
+
+  * debian/apparmor-profile: Update apparmor profile. (LP: #508190) 
+
+ -- Chuck Short <[e-mail]>  Tue, 09 Mar 2010 13:33:35 -0500
+
+openldap (2.4.21-0ubuntu1) lucid; urgency=low
+
+  * New upstream release.
+  * debian/rules, debian/schema/extra/: 
+    Fix get-orig-source rule to supports extra schemas shipped as part of the
+    debian/schema/ directory.
+
+ -- Mathias Gug <[e-mail]>  Thu, 18 Feb 2010 00:58:13 -0500
+
+openldap (2.4.18-0ubuntu2) lucid; urgency=low
+
+  * debian/patches/gssapi.diff, thanks to Jerry Carter (Likewise):
+    - Add --with-gssapi support
+    - Make guess_service_principal() more robust when determining principal
+  * Enable GSSAPI support (LP: #495418):
+    - debian/configure.options: Configure with --with-gssapi
+    - debian/control: Added libkrb5-dev as a build depend
+
+ -- Thierry Carrez <[e-mail]>  Fri, 11 Dec 2009 11:31:11 +0100
+
+openldap (2.4.18-0ubuntu1) karmic; urgency=low
+
+  * New upstream release: (LP: #419515):
+    + pcache overlay supports disconnected mode.
+  * Fix nss overlay load (LP: #417163).
+
+ -- Mathias Gug <[e-mail]>  Mon, 07 Sep 2009 13:41:10 -0400
+
 openldap (2.4.17-2.1) unstable; urgency=high
 
   * Non-maintainer upload by the Security Team.
@@ -1325,6 +3663,108 @@ openldap (2.4.17-2) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 22 Sep 2009 20:06:34 -0700
 
+openldap (2.4.17-1ubuntu3) karmic; urgency=low
+
+   * Install a minimal slapd configuration instead of creating a default
+     database with a default DIT:
+     + Move openldap user home from /var/lib/ldap to /nonexistent.
+     + Remove all code and templates dealing with the default database and DIT
+       creation.
+     + Add an Authz map from root user (UID=0) to cn=localroot,cn=config and
+       grant all access to the latter in the cn=config database as well as the
+       default backend configuration.
+   * Add cn=localroot,cn=config authz mapping on upgrades.
+
+ -- Mathias Gug <[e-mail]>  Tue, 11 Aug 2009 14:48:56 -0400
+
+openldap (2.4.17-1ubuntu2) karmic; urgency=low
+
+  [ Thierry Carrez ]
+  * debian/rules: Enable -DLDAP_CONNECTIONLESS to build CLDAP (UDP) support
+    in the openldap library, as required by Likewise-Open (LP: #390579)
+
+  [ Mathias Gug ]
+  * debian/patches/its6077-uniqueness-overlay: fixes some issues with the
+    uniqueness overlay.
+  * debian/patches/its6220-writetimeout-directive: fixes a problem with the
+    writetimeout directive being in effect even if it wasn't set, 
+    closing connections incorrectly.
+  * debian/patches/its6222-dncachesize-parameter: fixes the behavior of the
+    dncachesize parameter that was added in RE24, so that if it is set to 
+    "0" (now the default), it has an unlimited DN cache (RE23 always 
+    had an unlimited DN cache).
+
+ -- Mathias Gug <[e-mail]>  Fri, 31 Jul 2009 13:43:46 -0400
+
+openldap (2.4.17-1ubuntu1) karmic; urgency=low
+  
+  [ Steve Langasek ]
+  * Fix up the lintian warnings:
+    - add missing misc-depends on all packages
+    - slapd, libldap-2.4-2-dbg sections changed to 'debug' to match archive
+      overrides
+    - bump Standards-Version to 3.8.2, no changes required.
+
+  [ Mathias Gug ]
+  * Resynchronise with Debian. Remaining changes:
+    - AppArmor support:
+      - debian/apparmor-profile: add AppArmor profile
+      - updated debian/slapd.README.Debian for note on AppArmor
+      - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      - debian/slapd.postrm: remove symlink in force-complain/ on purge
+      - debian/rules: install apparmor profile.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct
+      ownership and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group
+      readable) and /var/run/slapd (world readable).
+    - Enable nssoverlay:
+      - debian/patches/nssov-build, debian/rules: Build and package the nss
+        overlay.
+      - debian/schema/misc.ldif: add ldif file for the misc schema which
+        defines rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of
+      slapd.conf. Migrate slapd.conf file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to
+      the cn=config tree.
+    - debian/slapd.postinst: create /var/run/slapd before updating its
+      permissions.
+    - debian/slapd.init: Correctly set slapd config backend option even if
+      the pidfile is configured in slapd default file.
+  * Dropped:
+    - Merged in Debian:
+      - Update priority of libldap-2.4-2 to match the archive override.
+      - Add the missing ldapexop and ldapurl tools to ldap-utils, as well as
+        the ldapurl(1) manpage.
+      - Bump build-dependency on debhelper to 6 instead of 5, since that's
+        what we're using.
+      - Set the default SLAPD_SERVICES to ldap:/// ldapi:///, instead of using
+        the built-in default of ldap:/// only.
+    - Fixed in upstream release:
+      - debian/patches/fix-ldap_back_entry_get_rwa.patch: fix test-0034
+        failure when built with PIE.
+      - debian/patches/gnutls-enable-v1-ca-certs: Enable V1 CA certs to be
+        trusted.
+    - Update Apparmor profile support: don't support upgrade from pre-hardy
+      systems:
+      - debian/slapd.postinst: Reload AA profile on configuration
+      - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+      - debian/control: Conflicts with apparmor-profiles <<
+        2.1+1075-0ubuntu4 to make sure that if earlier version of
+        apparmor-profiles gets installed it won't overwrite our profile.
+      - follow ApparmorProfileMigration and force apparmor complain mode on
+        some upgrades
+      - debian/slapd.preinst: create symlink for force-complain on
+        pre-feisty upgrades, upgrades where apparmor-profiles profile is
+        unchanged (ie non-enforcing) and upgrades where apparmor profile
+        does not exist.
+    - debian/patches/autogen.sh: no longer needed with karmic libtool.
+      - Call libtoolize with the --install option to install
+        config.{guess,sub} files.
+
+ -- Mathias Gug <[e-mail]>  Thu, 30 Jul 2009 16:42:58 -0400
+
 openldap (2.4.17-1) unstable; urgency=low
 
   * New upstream version.
@@ -1347,6 +3787,153 @@ openldap (2.4.17-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 28 Jul 2009 10:17:15 -0700
 
+openldap (2.4.15-1.1ubuntu1) karmic; urgency=low
+
+  * Resynchronise with Debian. Remaining changes:
+    - AppArmor support:
+      - debian/apparmor-profile: add AppArmor profile
+      - debian/slapd.postinst: Reload AA profile on configuration
+      - updated debian/slapd.README.Debian for note on AppArmor
+      - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+      - debian/control: Conflicts with apparmor-profiles <<
+        2.1+1075-0ubuntu4 to make sure that if earlier version of
+        apparmor-profiles gets installed it won't overwrite our profile.
+      - follow ApparmorProfileMigration and force apparmor complain mode on
+        some upgrades
+      - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      - debian/slapd.preinst: create symlink for force-complain on
+        pre-feisty upgrades, upgrades where apparmor-profiles profile is
+        unchanged (ie non-enforcing) and upgrades where apparmor profile
+        does not exist.
+      - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/autogen.sh:
+      - Call libtoolize with the --install option to install
+        config.{guess,sub} files.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct
+      ownership and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group
+      readable) and /var/run/slapd (world readable).
+    - Enable nssoverlay:
+      - debian/patches/nssov-build, debian/rules: Build and package the nss
+        overlay.
+      - debian/schema/misc.ldif: add ldif file for the misc schema which
+        defines rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of
+      slapd.conf. Migrate slapd.conf file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to
+      the cn=config tree.
+    - Update priority of libldap-2.4-2 to match the archive override.
+    - Add the missing ldapexop and ldapurl tools to ldap-utils, as well as
+      the ldapurl(1) manpage.
+    - Bump build-dependency on debhelper to 6 instead of 5, since that's
+      what we're using.
+    - Set the default SLAPD_SERVICES to ldap:/// ldapi:///, instead of using
+      the built-in default of ldap:/// only.
+    - debian/patches/fix-ldap_back_entry_get_rwa.patch: fix test-0034
+      failure when built with PIE.
+    - debian/patches/gnutls-enable-v1-ca-certs: Enable V1 CA certs to be
+      trusted.
+    - debian/slapd.postinst: create /var/run/slapd before updating its
+      permissions.
+    - debian/slapd.init: Correctly set slapd config backend option even if
+      the pidfile is configured in slapd default file.
+  * Drop patch to avoid the test suite on hppa, as hppa is EOL.
+
+ -- Colin Watson <[e-mail]>  Wed, 24 Jun 2009 10:45:20 +0100
+
+openldap (2.4.15-1.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Change libltdl3-dev Build-Depends to libltdl-dev | libltdl3-dev
+    (Closes: #522965)
+
+ -- Kurt Roeckx <[e-mail]>  Sun, 19 Apr 2009 18:24:32 +0200
+
+openldap (2.4.15-1ubuntu3) jaunty; urgency=low
+
+  * No-change rebuild to fix lpia shared library dependencies.
+
+ -- Colin Watson <[e-mail]>  Thu, 19 Mar 2009 09:52:40 +0000
+
+openldap (2.4.15-1ubuntu2) jaunty; urgency=low
+
+  * debian/slapd.postinst: create /var/run/slapd before updating its
+    permissions (LP: #298928). 
+  * debian/slapd.init: Correclty set slapd config backend option even if the
+    pidfile is configured in slapd default file (LP: #292364).
+  * debian/apparmor-profile: support multiple databases to be stored under
+    /var/lib/ldap/. (LP: #286614).
+
+ -- Mathias Gug <[e-mail]>  Fri, 13 Mar 2009 13:56:12 -0400
+
+openldap (2.4.15-1ubuntu1) jaunty; urgency=low
+
+  [ Steve Langasek ]
+  * Update priority of libldap-2.4-2 to match the archive override.
+  * Add the missing ldapexop and ldapurl tools to ldap-utils, as well as the
+    ldapurl(1) manpage.  Thanks to Peter Marschall for the patch.
+    Closes: #496749.
+  * Bump build-dependency on debhelper to 6 instead of 5, since that's
+    what we're using.  Closes: #498116.
+  * Set the default SLAPD_SERVICES to ldap:/// ldapi:///, instead of using
+    the built-in default of ldap:/// only.
+
+  [ Mathias Gug ]
+  * Merge from debian unstable, remaining changes:
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - AppArmor support:
+      - debian/apparmor-profile: add AppArmor profile
+      - debian/slapd.postinst: Reload AA profile on configuration
+      - updated debian/slapd.README.Debian for note on AppArmor
+      - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+      - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+        to make sure that if earlier version of apparmour-profiles gets
+        installed it won't overwrite our profile.
+      - follow ApparmorProfileMigration and force apparmor compalin mode on 
+        some upgrades (LP: #203529)
+      - debian/slapd.dirs: add etc/apparmor.d/force-complain
+      - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+        upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+        non-enforcing) and upgrades where apparmor profile does not exist.
+      - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/control:
+      - Build-depend on libltdl7-dev rather then libltdl3-dev.
+    - debian/patches/autogen.sh:
+      - Call libtoolize with the --install option to install config.{guess,sub}
+        files.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash (LP: #286063).
+    - Disable the testsuite on hppa. Allows building of packages on this
+      architecture again, once this package is in the archive.
+      LP: #288908.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct ownership
+      and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group readable) and
+      /var/run/slapd (world readable). (LP: #257667).
+    - Enable nssoverlay:
+      - debian/patches/nssov-build, debian/rules: Build and package 
+        the nss overlay.
+      - debian/schema/misc.ldif: add ldif file for the misc schema
+        which defines rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of 
+      slapd.conf. Migrate slapd.conf  file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to the
+      cn=config tree.
+  * Dropped:
+    - debian/patches/corrupt-contextCSN: The contextCSN can get corrupted at
+      times. (ITS: #5947) Fixed in new upstream version 2.4.15.
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now. Implemented in Debian.
+  * debian/patches/fix-ldap_back_entry_get_rwa.patch: fix test-0034 failure
+    when built with PIE.
+  * debian/patches/gnutls-enable-v1-ca-certs: Enable V1 CA certs to be
+    trusted (LP: #305264).
+
+ -- Mathias Gug <[e-mail]>  Fri, 06 Mar 2009 17:34:21 -0500
+
 openldap (2.4.15-1) unstable; urgency=low
 
   * New upstream version
@@ -1364,6 +3951,69 @@ openldap (2.4.15-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Tue, 24 Feb 2009 14:27:35 -0800
 
+openldap (2.4.14-0ubuntu1) jaunty; urgency=low
+
+  [ Steve Langasek ]
+  * New upstream version
+    - Fixes a bug with the pcache overlay not returning cached entries
+      (closes: #497697)
+    - Update evolution-ntlm patch to apply to current Makefiles.
+    - (tentatively) drop gnutls-ciphers, since this bug was reported to be
+      fixed upstream in 2.4.8.  The fix applied in 2.4.8 didn't match the
+      patch from the bug report, so this should be watched for regressions.
+  * Build against db4.7 instead of db4.2 at last!  Closes: #421946.
+  * Build with --disable-ndb, to avoid a misbuild when libmysqlclient is
+    installed in the build environment.
+  * New patch, no-crlcheck-for-gnutls, to fix a build failure when using
+    --with-tls=gnutls.
+
+  [ Mathias Gug ]
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/control:
+      - Build-depend on libltdl7-dev rather then libltdl3-dev.
+    - debian/patches/autogen.sh:
+      - Call libtoolize with the --install option to install config.{guess,sub}
+        files.
+    - Don't use local statement in config script as it fails if /bin/sh
+      points to bash (LP: #286063).
+    - Disable the testsuite on hppa. Allows building of packages on this
+      architecture again, once this package is in the archive.
+      LP: #288908.
+    - debian/slapd.postinst, debian/slapd.script-common: set correct ownership
+      and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group readable) and
+      /var/run/slapd (world readable). (LP: #257667).
+    - debian/patches/nssov-build, debian/rules: 
+      Build and package the nss overlay.
+      debian/schema/misc.ldif: add ldif file for the misc schema, which defines
+      rfc822MailMember (required by the nss overlay).
+    - debian/{control,rules}: enable PIE hardening
+    - Use cn=config as the default configuration backend instead of 
+      slapd.conf. Migrate slapd.conf  file to /etc/ldap/slapd.d/ on upgrade
+      asking the end user to enter a new password to control the access to the
+      cn=config tree.
+  * debian/patches/corrupt-contextCSN: The contextCSN can get corrupted at
+    times. (ITS: #5947)
+
+ -- Mathias Gug <[e-mail]>  Wed, 18 Feb 2009 18:44:00 -0500
+
 openldap (2.4.11-1) unstable; urgency=low
 
   * New upstream version (closes: #499560).
@@ -1386,6 +4036,110 @@ openldap (2.4.11-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Sat, 11 Oct 2008 01:53:55 -0700
 
+openldap (2.4.11-0ubuntu7) jaunty; urgency=low
+
+  * Don't use local statement in config script as it fails if /bin/sh
+    points to bash (LP: #286063).
+
+ -- Mathias Gug <[e-mail]>  Tue, 04 Nov 2008 20:03:46 -0500
+
+openldap (2.4.11-0ubuntu6) intrepid; urgency=low
+
+  * Disable the testsuite on hppa. Allows building of packages on this
+    architecture again, once this package is in the archive.
+    LP: #288908.
+
+ -- Matthias Klose <[e-mail]>  Fri, 24 Oct 2008 23:22:33 +0200
+
+openldap (2.4.11-0ubuntu5) intrepid; urgency=low
+
+  * Don't set admin passwords in ldif files if adminpw is empty. 
+    (LP: #273988 - LP: #276606).  
+
+ -- Mathias Gug <[e-mail]>  Mon, 13 Oct 2008 19:31:15 -0400
+
+openldap (2.4.11-0ubuntu4) intrepid; urgency=low
+
+  * debian/slapd.postinst, debian/slapd.script-common: set correct ownership
+    and permissions on /var/lib/ldap, /etc/ldap/slapd.d (group readable) and
+    /var/run/slapd (world readable). (LP: #257667).
+  * debian/slapd.script-common: 
+    - Fix package reconfiguration:
+      + Remove slapd.d/ directory if it already exists when creating a new 
+        configuration.
+      + Fix backup directory naming for multiple reconfiguration.
+
+ -- Mathias Gug <[e-mail]>  Wed, 24 Sep 2008 21:01:42 -0400
+
+openldap (2.4.11-0ubuntu3) intrepid; urgency=low
+
+  * debian/patches/nssov-build, debian/rules: 
+    Build and package the nss overlay.
+  * debian/schema/misc.ldif: add ldif file for the misc schema, which defines
+    rfc822MailMember (required by the nss overlay).
+
+ -- Mathias Gug <[e-mail]>  Tue, 26 Aug 2008 18:42:54 -0400
+
+openldap (2.4.11-0ubuntu2) intrepid; urgency=low
+
+  * debian/{control,rules}: enable PIE hardening
+
+ -- Kees Cook <[e-mail]>  Wed, 20 Aug 2008 15:47:01 -0700
+
+openldap (2.4.11-0ubuntu1) intrepid; urgency=low
+
+  * New upstream version:
+    - Mainly bug fixes.
+    - New nss slapd overlay (not compiled by default).
+  * Use cn=config as the default configuration backend instead of 
+    slapd.conf. Migrate slapd.conf  file to /etc/ldap/slapd.d/ on upgrade
+    asking the end user to enter a new password to control the access to the
+    cn=config tree.
+
+ -- Mathias Gug <[e-mail]>  Mon, 11 Aug 2008 20:26:05 -0400
+
+openldap (2.4.10-3ubuntu1) intrepid; urgency=low
+
+  [ Mathias Gug ]
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/patches/fix-unique-overlay-assertion.patch: 
+      Fix another assertion error in unique overlay (LP: #243337).
+      Backport from head.
+  * Dropped - implemented in Debian:
+    - debian/patches/fix-gnutls-key-strength.patch:
+      Fix slapd handling of ssf using gnutls. (LP: #244925).
+    - debian/control:
+      Add time as build dependency: needed by make test.
+  * debian/control:
+    - Build-depend on libltdl7-dev rather then libltdl3-dev.
+  * debian/patches/autogen.sh:
+    - Call libtoolize with the --install option to install config.{guess,sub}
+    files.
+
+  [ Jamie Strandboge ]
+  * adjust apparmor profile to allow gssapi (LP: #229252)
+  * adjust apparmor profile to allow cnconfig (LP: #243525) 
+
+ -- Mathias Gug <[e-mail]>  Wed, 30 Jul 2008 19:46:02 -0400
+
 openldap (2.4.10-3) unstable; urgency=low
 
   [ Steve Langasek ]
@@ -1419,6 +4173,40 @@ openldap (2.4.10-3) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Mon, 28 Jul 2008 15:26:06 -0700
 
+openldap (2.4.10-2ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/patches/fix-unique-overlay-assertion.patch: 
+      Fix another assertion error in unique overlay (LP: #243337).
+      Backport from head.
+    - debian/patches/fix-gnutls-key-strength.patch:
+      Fix slapd handling of ssf using gnutls. (LP: #244925).
+    - debian/control:
+      Add time as build dependency: needed by make test.
+  * Dropped - implemented in Debian:
+    - debian/rules:
+      Support debuild nocheck option: don't run tests if nocheck is set.
+
+ -- Mathias Gug <[e-mail]>  Thu, 10 Jul 2008 14:45:49 -0400
+
 openldap (2.4.10-2) unstable; urgency=low
 
   * Support DEB_BUILD_OPTIONS=nocheck to disable running the test suite at
@@ -1433,6 +4221,54 @@ openldap (2.4.10-2) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Sun, 06 Jul 2008 22:03:32 -0700
 
+openldap2.3 (2.4.10-1ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/patches/fix-ucred-libc due to changes how newer glibc handle
+      the ucred struct now.
+    - debian/patches/fix-unique-overlay-assertion.patch: 
+      Fix another assertion error in unique overlay (LP: #243337).
+      Backport from head.
+  * debian/control:
+    - add time as build dependency: needed by make test.
+  * debian/rules:
+    - support debuild nocheck option: don't run tests if nocheck is set.
+  * debian/patches/fix-gnutls-key-strength.patch:
+    - fix slapd handling of ssf using gnutls. (LP: #244925).
+  * Dropped - accepted in Debian:
+    - debian/rules, debian/slapd.links: use hard links to slapd instead of
+      symlinks for slap* so these applications aren't confined by apparmor
+      (LP: #203898)
+  * Dropped - fixed in new upstream release:
+    - debian/patches/fix-assertion-io.patch: Fixes ber_flush2 assertion. 
+      (LP: #215904)
+    - debian/patches/fix-dnpretty-assertion.patch: Fix dnPrettyNormal assertion
+      error. (LP: #234196)
+    - dropped debian/patches/fix-notify-crasher.patch: Fix modify timestamp crashes.
+      (LP: #220724)
+    - debian/patches/fix-syncrepl-oops: Fixes segmentation fault when using
+      syncrepl. (LP: #227178) 
+    - dropped debian/patches/SECURITY_CVE-2008-0658.patch. Already applied 
+      upstream.
+
+ -- Mathias Gug <[e-mail]>  Thu, 03 Jul 2008 14:15:08 -0400
+
 openldap2.3 (2.4.10-1) unstable; urgency=low
 
   [ Steve Langasek ]
@@ -1457,6 +4293,64 @@ openldap2.3 (2.4.10-1) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Mon, 30 Jun 2008 04:28:34 -0700
 
+openldap2.3 (2.4.9-1ubuntu4) intrepid; urgency=low
+
+  * debian/patches/fix-unique-overlay-assertion.patch: 
+    - Fix another assertion error in unique overlay, backported from head.
+      (LP: #243337) Note: This patch will still be needed when moved to 2.4.10 
+
+ -- Chuck Short <[e-mail]>  Mon, 30 Jun 2008 18:49:52 +0000
+
+openldap2.3 (2.4.9-1ubuntu3) intrepid; urgency=low
+
+  * Drop spurious dependency on hiemdal-dev. Caused by an aborted attempt to
+    include the smbk5pwd overlay.
+
+ -- Chuck Short <[e-mail]>  Wed, 11 Jun 2008 21:25:40 +0000
+
+openldap2.3 (2.4.9-1ubuntu2) intrepid; urgency=low
+
+  * Rebuild for perl 5.10 transition (LP: #230016)
+  * debian/patches/fix-syncrepl-oops: Fixes segmentation fault when using
+    syncrepl. (LP: #227178) 
+
+ -- Chuck Short <[e-mail]>  Mon, 09 Jun 2008 14:56:40 +0000
+
+openldap2.3 (2.4.9-1ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/apparmor-profile: add AppArmor profile
+    - debian/slapd.postinst: Reload AA profile on configuration
+    - updated debian/slapd.README.Debian for note on AppArmor
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmour-profiles gets
+      installed it won't overwrite our profile.
+    - Modify Maintainer value to match the DebianMaintainerField
+      speficication.
+    - follow ApparmorProfileMigration and force apparmor compalin mode on 
+      some upgrades (LP: #203529)
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist.
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+    - debian/rules, debian/slapd.links: use hard links to slapd instead of
+      symlinks for slap* so these applications aren't confined by apparmor
+      (LP: #203898)
+    - debian/patches/fix-assertion-io.patch: Fixes ber_flush2 assertion. 
+      (LP: #215904)
+    - debian/patches/fix-dnpretty-assertion.patch: Fix dnPrettyNormal assertion
+      error. (LP: #234196)
+    - dropped debian/patches/fix-notify-crasher.patch: Fix modify timestamp crashes.
+      (LP: #220724)
+    - dropped debian/patches/SECURITY_CVE-2008-0658.patch. Already applied 
+      upstream.
+   * Added debian/patches/fix-ucred-libc due to changes how newer glibc handle
+     the ucred struct now.
+
+ -- Chuck Short <[e-mail]>  Fri, 30 May 2008 17:09:53 +0100
+
 openldap2.3 (2.4.9-1) unstable; urgency=low
 
   [ Updated debconf translations ]
@@ -1527,6 +4421,51 @@ openldap2.3 (2.4.7-6.1) unstable; urgency=high
 
  -- Nico Golde <[e-mail]>  Tue, 04 Mar 2008 14:34:44 +0100
 
+openldap2.3 (2.4.7-6ubuntu3) hardy; urgency=low
+
+  * remove apparmor-profile workaround for Launchpad #202161 (it's now fixed
+    in klibc)
+
+ -- Jamie Strandboge <[e-mail]>  Mon, 07 Apr 2008 16:09:38 -0400
+
+openldap2.3 (2.4.7-6ubuntu2) hardy; urgency=low
+
+  * apparmor-profile workaround for Launchpad #202161 
+  * follow ApparmorProfileMigration and force apparmor complain mode on some
+    upgrades (LP: #203529)
+    - debian/control: Recommends apparmor >= 2.1+1075-0ubuntu6
+    - debian/slapd.dirs: add etc/apparmor.d/force-complain
+    - debian/slapd.preinst: create symlink for force-complain/ on pre-feisty
+      upgrades, upgrades where apparmor-profiles profile is unchanged (ie
+      non-enforcing) and upgrades where apparmor profile does not exist
+    - debian/slapd.postrm: remove symlink in force-complain/ on purge
+  * debian/rules, debian/slapd.links: use hard links to slapd instead of
+    symlinks for slap* so these applications aren't confined by apparmor
+    (LP: #203898)
+
+ -- Jamie Strandboge <[e-mail]>  Tue, 18 Mar 2008 13:53:23 -0400
+
+openldap2.3 (2.4.7-6ubuntu1) hardy; urgency=low
+
+  * Merge from Debian unstable, remaining changes:
+    + debian/patches/SECURITY_CVE-2008-0658.patch (LP: #197077)
+      slapd/back-bdb/modrdn.c in the BDB backend for slapd in OpenLDAP 2.3.39
+      allows remote authenticated users to cause a denial of service (daemon
+      crash) via a modrdn operation with a NOOP (LDAP_X_NO_OPERATION)
+      control, a related issue to CVE-2007-6698.
+    + debian/apparmor-profile: add AppArmor profile
+    + debian/slapd.postinst: Reload AA profile on configuration
+    + updated debian/slapd.README.Debian for note on AppArmor
+    + debian/control: Replaces apparmor-profiles << 2.1+1075-0ubuntu4 as we
+      should now take control
+    + debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+      to make sure that if earlier version of apparmor-profiles gets
+      installed it won't overwrite our profile
+    + Modify Maintainer value to match the DebianMaintainerField
+      specification.
+
+ -- Steve Langasek <[e-mail]>  Tue, 04 Mar 2008 01:59:51 +0000
+
 openldap2.3 (2.4.7-6) unstable; urgency=low
 
   [ Updated debconf translations ]
@@ -1572,6 +4511,37 @@ openldap2.3 (2.4.7-6) unstable; urgency=low
 
  -- Steve Langasek <[e-mail]>  Thu, 28 Feb 2008 22:15:17 -0800
 
+openldap2.3 (2.4.7-5ubuntu2) hardy; urgency=low
+
+  * SECURITY UPDATE: 
+   + debian/patches/SECURITY_CVE-2008-0658.patch (LP: #197077)
+     slapd/back-bdb/modrdn.c in the BDB backend for slapd in OpenLDAP 2.3.39 
+     allows remote authenticated users to cause a denial of service (daemon crash) 
+     via a modrdn operation with a NOOP (LDAP_X_NO_OPERATION) control, a related 
+     issue to CVE-2007-6698.
+
+  * References
+   - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2008-0658
+   - http://www.openldap.org/its/index.cgi/Software%20Bugs?id=5358
+
+ -- Emanuele Gentili <[e-mail]>  Sun, 02 Mar 2008 16:34:30 +0100
+
+openldap2.3 (2.4.7-5ubuntu1) hardy; urgency=low
+
+  * add AppArmor profile
+    + debian/apparmor-profile
+    + debian/slapd.postinst: Reload AA profile on configuration
+  * updated debian/slapd.README.Debian for note on AppArmor
+  * debian/control: Replaces apparmor-profiles << 2.1+1075-0ubuntu4 as we
+    should now take control
+  * debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+    to make sure that if earlier version of apparmor-profiles gets installed
+    it won't overwrite our profile
+  * Modify Maintainer value to match the DebianMaintainerField
+    specification.
+
+ -- Jamie Strandboge <[e-mail]>  Wed, 13 Feb 2008 17:15:41 +0000
+
 openldap2.3 (2.4.7-5) unstable; urgency=low
 
   [ Updated debconf translations ]
diff --git a/debian/control b/debian/control
index 72c2fdf..877d42b 100644
--- a/debian/control
+++ b/debian/control
@@ -1,12 +1,14 @@
 Source: openldap
 Section: net
 Priority: optional
-Maintainer: Debian OpenLDAP Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian OpenLDAP Maintainers <[e-mail]>
 Uploaders: Steve Langasek <[e-mail]>,
  Torsten Landschoff <[e-mail]>,
  Ryan Tandy <[e-mail]>,
  Sergio Durigan Junior <[e-mail]>
 Build-Depends: debhelper-compat (= 12),
+               dh-apparmor,
                dpkg-dev (>= 1.17.14),
                groff-base,
                heimdal-multidev (>= 7.4.0.dfsg.1-1~) <!pkg.openldap.noslapd>,
@@ -43,7 +45,7 @@ Depends: ${shlibs:Depends}, libldap2 (= ${binary:Version}),
  coreutils (>= 4.5.1-1), psmisc, perl:any (>> 5.8.0) | libmime-base64-perl,
  adduser, lsb-base (>= 3.2-13), ${perl:Depends}, ${misc:Depends}
 Recommends: ldap-utils
-Suggests: libsasl2-modules,
+Suggests: libsasl2-modules, ufw,
  libsasl2-modules-gssapi-mit | libsasl2-modules-gssapi-heimdal
 Conflicts: umich-ldapd, ldap-server, libltdl3 (= 1.5.4-1)
 Replaces: ldap-utils (<< 2.2.23-3)
diff --git a/debian/rules b/debian/rules
index dec3a84..24f1691 100755
--- a/debian/rules
+++ b/debian/rules
@@ -11,7 +11,7 @@ export DEB_CFLAGS_MAINT_APPEND := -Wall -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE
 export DEB_BUILD_MAINT_OPTIONS := hardening=+all
 
 # Expose maintainer address to build/mkversion (see debian/patches/set-maintainer-name)
-export DEB_MAINTAINER := $(shell sed -ne 's/Maintainer:\s\+//p' debian/control)
+export DEB_MAINTAINER := $(shell sed -ne 's/^Maintainer:\s\+//p' debian/control)
 
 # Expose DEB_VERSION to build/version.sh (see debian/patches/debian-version)
 export DEB_VERSION
@@ -118,6 +118,22 @@ endif
 	find $(installdir)/usr/share/man -name \*.8 \
 		| xargs perl -pi -e 's#(\.TH \w+ 8)C#$$1#'
 
+ifeq ($(filter stage1,$(DEB_BUILD_PROFILES)),)
+override_dh_install-arch:
+	dh_install
+
+	# install AppArmor profile
+	install -D -m 644 $(CURDIR)/debian/apparmor-profile $(CURDIR)/debian/slapd/etc/apparmor.d/usr.sbin.slapd
+
+	# install Apport hook
+	install -D -m 644 $(CURDIR)/debian/slapd.py $(CURDIR)/debian/slapd/usr/share/apport/package-hooks/slapd.py
+
+	# install ufw profile
+	install -D -m 644 $(CURDIR)/debian/slapd.ufw.profile $(CURDIR)/debian/slapd/etc/ufw/applications.d/slapd
+
+	dh_apparmor -pslapd --profile-name=usr.sbin.slapd
+endif
+
 override_dh_installinit:
 	dh_installinit --no-restart-after-upgrade --error-handler=ignore_init_failure -- "defaults 19 80"
 
diff --git a/debian/slapd.README.Debian b/debian/slapd.README.Debian
index ff7d66b..a4f3f55 100644
--- a/debian/slapd.README.Debian
+++ b/debian/slapd.README.Debian
@@ -252,6 +252,17 @@ Modifications Compared to Upstream
 
  -- Russ Allbery <[e-mail]>, Thu, 14 Feb 2008 18:47:07 -0800
 
+Apparmor Profile
+----------------
+
+  If your system uses AppArmor, please note that the shipped enforcing profile
+  works with the default installation, and changes in your configuration may
+  require changes to the installed apparmor profile. Please see
+  https://wiki.ubuntu.com/DebuggingApparmor before filing a bug against this
+  software.
+
+ -- Jamie Strandboge <[e-mail]>, Mon,  4 Feb 2008 21:18:21 -0500
+
 Migrating your installation to OpenLDAP 2.5.x
 
   OpenLDAP 2.5 is a major new release and includes several incompatible
diff --git a/debian/slapd.py b/debian/slapd.py
new file mode 100644
index 0000000..b1aed25
--- /dev/null
+++ b/debian/slapd.py
@@ -0,0 +1,51 @@
+#!/usr/bin/python3
+
+'''apport hook for slapd
+
+(c) 2010 Adam Sommer.
+Author: Adam Sommer <[e-mail]>
+
+This program is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2 of the License, or (at your
+option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
+the full text of the license.
+'''
+
+from apport.hookutils import *
+import os
+
+# Scrub olcRootPW attribute and credentials strings if necessary.
+def scrub_pass_strings(config):
+    olcrootpw_regex = re.compile('olcRootPW:.*')
+    olcrootpw_string = olcrootpw_regex.search(config)
+    if olcrootpw_string:
+        config = config.replace(olcrootpw_string.group(0), 'olcRootPW: @@APPORTREPLACED@@') 
+
+    credentials_regex = re.compile('credentials=.* ')
+    credentials_string = credentials_regex.search(config)
+    if credentials_string:
+        config = config.replace(credentials_string.group(0), 'credentials=@@APPORTREPLACED@@ ') 
+
+    return config
+
+def add_info(report, ui):
+    response = ui.yesno("The contents of your /etc/ldap/slapd.d directory "
+                        "may help developers diagnose your bug more "
+                        "quickly.  However, it may contain sensitive "
+                        "information.  Do you want to include it in your "
+                        "bug report?")
+
+    if response == None: # user cancelled
+        raise StopIteration
+
+    elif response == True:
+        # Get the cn=config tree.
+        cn_config = root_command_output(['/usr/bin/ldapsearch', '-Q', '-LLL', '-Y EXTERNAL', '-H ldapi:///', '-b cn=config'])
+        report['CNConfig'] = scrub_pass_strings(cn_config)
+
+        # Get slapd messages from /var/log/syslog
+        slapd_re = re.compile('slapd', re.IGNORECASE)
+        report['SysLog'] = recent_syslog(slapd_re)
+
+        attach_mac_events(report, '/usr/sbin/slapd')
diff --git a/debian/slapd.ufw.profile b/debian/slapd.ufw.profile
new file mode 100644
index 0000000..3c4f676
--- /dev/null
+++ b/debian/slapd.ufw.profile
@@ -0,0 +1,9 @@
+[OpenLDAP LDAP]
+title=OpenLDAP with TLS
+description=OpenLDAP is a free, fast, lightweight LDAP server
+ports=389/tcp
+
+[OpenLDAP LDAPS]
+title=OpenLDAP over SSL
+description=OpenLDAP is a free, fast, lightweight LDAP server
+ports=636/tcp