Merge ~sergiodj/ubuntu/+source/squid:squid-merge-4.12-1 into ubuntu/+source/squid:debian/sid

[Sergio Durigan Junior]

This is the merge of squid 4.12.1 from Debian.

We're still keeping some of our existing delta. I'm taking a closer look at the patches we're carrying and checking which ones can be proposed upstream or to Debian.

As for the good news, we can drop a number of local modifications:

- No need to add -Wno-format-truncation to CXXFLAGS anymore; the build works normally on ppc64el on groovy now.

- Dropped 2 patches accepted by Debian which simplify and fix the postinst script.

- Dropped 1 patch acccepted by Debian which adjusts the 'test-squid.py' dep8 test.

I'm adding a patch needed to make the build pass on s390x; there's a GCC-10 FTBFS that happens there. This patch has already been proposed and accepted upstream:

  https://github.com/squid-cache/squid/pull/708/

autopkgtest is still happy:

autopkgtest [15:11:15]: @@@@@@@@@@@@@@@@@@@@ summary
upstream-test-suite PASS
squid PASS

[Andreas Hasenack (ahasenack)]

grabbing this

[Andreas Hasenack (ahasenack)]

Looks good, +1. You said you would still add a DEP3 header to d/p/90-cf.data.ubuntu.patch because you forwarded it to debian, right? Feel free to do that and commit, and then ping here when ready for sponsoring.

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Tuesday, August 11 2020, Andreas Hasenack wrote:

> Looks good, +1. You said you would still add a DEP3 header to
> d/p/90-cf.data.ubuntu.patch because you forwarded it to debian, right?
> Feel free to do that and commit, and then ping here when ready for
> sponsoring.

Thanks for the review, Andreas.

I have force-pushed the branch with the DEP3 header update now, so it's
ready for sponsorship.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Andreas Hasenack (ahasenack)]

Tagging and uploading db0be8a903e911be4fa27b1fe29ad5c57590291b

$ git push pkg upload/4.12-1ubuntu1
Enumerating objects: 43, done.
Counting objects: 100% (43/43), done.
Delta compression using up to 4 threads
Compressing objects: 100% (32/32), done.
Writing objects: 100% (36/36), 11.59 KiB | 565.00 KiB/s, done.
Total 36 (delta 25), reused 7 (delta 4)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/squid
 * [new tag] upload/4.12-1ubuntu1 -> upload/4.12-1ubuntu1

$ dput ubuntu ../squid_4.12-1ubuntu1_source.changes
Checking signature on .changes
gpg: ../squid_4.12-1ubuntu1_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../squid_4.12-1ubuntu1.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading squid_4.12-1ubuntu1.dsc: done.
  Uploading squid_4.12.orig.tar.xz: done.
  Uploading squid_4.12-1ubuntu1.debian.tar.xz: done.
  Uploading squid_4.12-1ubuntu1_source.buildinfo: done.
  Uploading squid_4.12-1ubuntu1_source.changes: done.
Successfully uploaded packages.

Please follow its migration.

[Sergio Durigan Junior (sergiodj)]

This has migrated.

diff --git a/debian/changelog b/debian/changelog
index 345a140..c1c8b6b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,40 @@
+squid (4.12-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern
+      for debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
+        to the default config file
+  * Dropped changes, not needed anymore:
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround
+      if building for ppc64el. On that arch, dpkg-buildflags sets -O3
+      instead of -O2 and that triggers a format-truncation error on
+      pcon.cc. See https://bugs.squid-cache.org/show_bug.cgi?id=4875.
+      [ Dropped because the build now passes on ppc64el ]
+  * Dropped changes, incorporated by Debian:
+    - Don't restart squid by hand on postinst script
+      + d/squid.postinst: When installing/upgrading squid, the service
+        is being restarted manually in the postinst script, which can
+        break installations that have the squid apparmor enabled because
+        it will try to restart the service before reloading the apparmor
+        profile.  There is no reason to restart squid manually, since the
+        restart will be automatically performed later.
+    - Drop conffile check for squid < 2.7
+      + d/squid.postinst: squid 2.7 is long, long gone, so it should be
+        safe to drop the postinst code to make sure that
+        /etc/squid/squid.conf was properly upgraded.
+    - d/tests/test-squid.py: Adjust 'pidfile' variable to reflect fact
+      that we now store the pidfile under '/run/squid/'.
+  * Added changes:
+    - d/p/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch:
+      Fix GCC-10 build failure due to -Wstringop-truncation warning.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 10 Aug 2020 11:20:46 -0400
+
 squid (4.12-1) unstable; urgency=high
 
   * Urgency high due to security fixes
@@ -35,6 +72,63 @@ squid (4.12-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Wed,  1 Jul 2020 10:52:54 +0200
 
+squid (4.11-5ubuntu3) groovy; urgency=medium
+
+  * No change rebuild against new libnettle8 and libhogweed6 ABI.
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 29 Jun 2020 22:38:13 +0100
+
+squid (4.11-5ubuntu2) groovy; urgency=medium
+
+  * d/tests/test-squid.py: Adjust 'pidfile' variable to reflect fact
+    that we now store the pidfile under '/run/squid/'.
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 20 May 2020 10:32:32 -0400
+
+squid (4.11-5ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for
+      debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl to the
+        default config file
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead
+      of -O2 and that triggers a format-truncation error on pcon.cc. See See
+      https://bugs.squid-cache.org/show_bug.cgi?id=4875
+  * Dropped:
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+      [ In 4.11-4 ]
+    - SECURITY UPDATE: multiple ESI issues
+      + debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
+        into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
+        src/esi/Esi.h, src/esi/Expression.cc.
+      + CVE-2019-12519
+      [ In 4.11-4 ]
+    - SECURITY UPDATE: Digest Authentication nonce replay issue
+      + debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
+        overflow in src/auth/digest/Config.cc.
+      [ In 4.11-4 ]
+  * Added:
+    - Don't restart squid by hand on postinst script
+      + d/squid.postinst: When installing/upgrading squid, the service
+        is being restarted manually in the postinst script, which can
+        break installations that have the squid apparmor enabled because
+        it will try to restart the service before reloading the apparmor
+        profile.  There is no reason to restart squid manually, since the
+        restart will be automatically performed later.
+    - Drop conffile check for squid < 2.7
+      + d/squid.postinst: squid 2.7 is long, long gone, so it should be
+        safe to drop the postinst code to make sure that
+        /etc/squid/squid.conf was properly upgraded.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 19 May 2020 14:43:04 -0400
+
 squid (4.11-5) unstable; urgency=medium
 
   [ Sergio Durigan Junior <[e-mail]> ]
@@ -113,6 +207,64 @@ squid (4.11-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Thu, 23 Apr 2020 19:34:54 +0200
 
+squid (4.10-1ubuntu2) groovy; urgency=medium
+
+  * SECURITY UPDATE: multiple ESI issues
+    - debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
+      into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
+      src/esi/Esi.h, src/esi/Expression.cc.
+    - CVE-2019-12519
+    - CVE-2019-12521
+  * SECURITY UPDATE: Digest Authentication nonce replay issue
+    - debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
+      overflow in src/auth/digest/Config.cc.
+    - CVE-2020-11945
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 13 May 2020 09:51:10 -0400
+
+squid (4.10-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
+        to the default config file
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+  * Dropped:
+    - d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
+      no longer available in Focal (LP: #1858827)
+      [In 4.10-1, undocumented]
+    - d/t/test-squid.py, d/t/squid: switch to python3
+      [In 4.10-1, undocumented]
+    - d/t/control: depend on python3-minimal
+      [In 4.10-1, undocumented]
+    - SECURITY UPDATE: info disclosure via FTP server
+      + debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
+        src/clients/FtpGateway.cc.
+      + CVE-2019-12528
+      [Fixed upstream]
+    - SECURITY UPDATE: incorrect input validation and buffer management
+      + debian/patches/CVE-2020-84xx.patch: fix request URL generation in
+        reverse proxy configurations in src/client_side.cc.
+      + CVE-2020-8449
+      + CVE-2020-8450
+      [Fixed upstream]
+    - SECURITY UPDATE: DoS in NTLM authentication
+      + debian/patches/CVE-2020-8517.patch: improved username handling in
+        src/acl/external/LM_group/ext_lm_group_acl.cc.
+      + CVE-2020-8517
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 25 Feb 2020 15:37:55 -0300
+
 squid (4.10-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -134,6 +286,70 @@ squid (4.10-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Tue, 10 Feb 2020 14:12:54 +0100
 
+squid (4.9-2ubuntu4) focal; urgency=medium
+
+  * SECURITY UPDATE: info disclosure via FTP server
+    - debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
+      src/clients/FtpGateway.cc.
+    - CVE-2019-12528
+  * SECURITY UPDATE: incorrect input validation and buffer management
+    - debian/patches/CVE-2020-84xx.patch: fix request URL generation in
+      reverse proxy configurations in src/client_side.cc.
+    - CVE-2020-8449
+    - CVE-2020-8450
+  * SECURITY UPDATE: DoS in NTLM authentication
+    - debian/patches/CVE-2020-8517.patch: improved username handling in
+      src/acl/external/LM_group/ext_lm_group_acl.cc.
+    - CVE-2020-8517
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 19 Feb 2020 12:43:05 -0500
+
+squid (4.9-2ubuntu3) focal; urgency=medium
+
+  * No-change rebuild with fixed binutils on arm64.
+
+ -- Matthias Klose <[e-mail]>  Sat, 08 Feb 2020 11:20:19 +0000
+
+squid (4.9-2ubuntu2) focal; urgency=medium
+
+  * d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
+    no longer available in Focal (LP: #1858827)
+  * d/t/test-squid.py, d/t/squid: switch to python3
+  * d/t/control: depend on python3-minimal
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 08 Jan 2020 15:52:32 -0300
+
+squid (4.9-2ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+  * Dropped:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+      [Fixed upstream]
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+      [Fixed upstream]
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c. (LP #1835831)
+      [Fixed upstream]
+    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
+      mounted
+      [Fixed upstream]
+
+ -- Lucas Kanashiro <[e-mail]>  Thu, 14 Nov 2019 16:33:10 -0300
+
 squid (4.9-2) unstable; urgency=medium
 
   [ Andreas Hasenack <[e-mail]> ]
@@ -190,6 +406,73 @@ squid (4.9-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Sun, 10 Nov 2019 20:28:15 +0100
 
+squid (4.8-1ubuntu3) focal; urgency=medium
+
+  * No-change rebuild against libnettle7
+
+ -- Steve Langasek <[e-mail]>  Thu, 31 Oct 2019 22:15:39 +0000
+
+squid (4.8-1ubuntu2) eoan; urgency=medium
+
+  * d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+    deprecated in glibc 2.30 (LP: #1843325)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 09 Sep 2019 17:31:45 -0300
+
+squid (4.8-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c. (LP #1835831)
+  * Dropped:
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Fixed upstream]
+    - debian/patches/413.patch: Fix gcc-9 build issues with upstream merged
+      patch
+      [Fixed upstream]
+    - SECURITY UPDATE: incorrect digest auth parameter parsing
+      + debian/patches/CVE-2019-12525.patch: check length in
+        src/auth/digest/Config.cc.
+      + CVE-2019-12525
+      [Fixed upstream]
+    - SECURITY UPDATE: buffer overflow in basic auth decoding
+      + debian/patches/CVE-2019-12527.patch: switch to SBuf in
+        src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+        src/clients/FtpGateway.cc.
+      + CVE-2019-12527
+      [Fixed upstream]
+    - SECURITY UPDATE: basic auth uudecode length issue
+      + debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+        base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+        include/uudecode.h, lib/uudecode.c.
+      + CVE-2019-12529
+      [Fixed upstream]
+    - SECURITY UPDATE: XSS issues in cachemgr.cgi
+      + debian/patches/CVE-2019-13345.patch: properly escape values in
+        tools/cachemgr.cc.
+      + CVE-2019-13345
+      [Fixed upstream]
+  * Added:
+    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
+      mounted
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 24 Jul 2019 16:38:59 -0300
+
 squid (4.8-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -208,6 +491,86 @@ squid (4.8-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Thu, 18 Jul 2019 22:28:15 +0200
 
+squid (4.6-2ubuntu4) eoan; urgency=medium
+
+  * Fix gcc-9 issues (LP: #1835831)
+    - Remove -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c.
+  * SECURITY UPDATE: incorrect digest auth parameter parsing
+    - debian/patches/CVE-2019-12525.patch: check length in
+      src/auth/digest/Config.cc.
+    - CVE-2019-12525
+  * SECURITY UPDATE: buffer overflow in basic auth decoding
+    - debian/patches/CVE-2019-12527.patch: switch to SBuf in
+      src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+      src/clients/FtpGateway.cc.
+    - CVE-2019-12527
+  * SECURITY UPDATE: basic auth uudecode length issue
+    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+      include/uudecode.h, lib/uudecode.c.
+    - CVE-2019-12529
+  * SECURITY UPDATE: XSS issues in cachemgr.cgi
+    - debian/patches/CVE-2019-13345.patch: properly escape values in
+      tools/cachemgr.cc.
+    - CVE-2019-13345
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 19 Jul 2019 08:01:58 -0400
+
+squid (4.6-2ubuntu3) eoan; urgency=medium
+
+  * Override newly added gcc-9 flags:
+    -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    NOTE: Overriding those flags is a possible security
+    asked for info on the gcc-9 issue bug tracker:
+    https://github.com/squid-cache/squid/pull/413#issuecomment-511314076
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 15 Jul 2019 10:21:47 +0200
+
+squid (4.6-2ubuntu2) eoan; urgency=medium
+
+  * Fix gcc-9 build issues with upstream merged patch
+
+ -- Gianfranco Costamagna <[e-mail]>  Sun, 14 Jul 2019 14:41:16 +0200
+
+squid (4.6-2ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Added Applied-Upstream header]
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+  * Dropped:
+    - d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+      at boot. Thanks to Luigi Gangitano <[e-mail]> (LP #1816006)
+      [Fixed in 4.5-2]
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+      [Fixed upstream]
+    - Add disabled by default AppArmor profile.
+      [Added by Debian in 4.6-2]
+    - d/usr.sbin.squid: fix the apparmor profile (LP #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+      [Fixed in 4.6-2]
+
+ -- Andreas Hasenack <[e-mail]>  Sat, 18 May 2019 14:39:09 -0300
+
 squid (4.6-2) unstable; urgency=high
 
   [ Andreas Hasenack <[e-mail]> ]
@@ -268,6 +631,57 @@ squid (4.5-1) unstable; urgency=medium
 
  -- Luigi Gangitano <[e-mail]>  Wed, 20 Feb 2019 11:57:15 +0100
 
+squid (4.4-1ubuntu2) disco; urgency=medium
+
+  * d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+    at boot. Thanks to Luigi Gangitano <[e-mail]> (LP: #1816006)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 27 Feb 2019 08:54:45 -0300
+
+squid (4.4-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - Add disabled by default AppArmor profile.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+  * Drop:
+    - d/rules: enable cdbs parallel build
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix apparmor profile filename
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+      [Fixed in 4.2-1]
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+      [Fixed in 4.2-1]
+  * Added changes:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - d/usr.sbin.squid: fix the apparmor profile (LP: #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 19 Nov 2018 10:51:18 -0200
+
 squid (4.4-1) unstable; urgency=high
 
   * Urgency high due to security fixes
@@ -332,6 +746,85 @@ squid (4.2-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Wed, 22 Aug 2018 13:57:15 +0200
 
+squid (4.1-1ubuntu3) cosmic; urgency=medium
+
+  * d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+    Thanks to Vitaly Lavrov <[e-mail]>. (LP: #1794553)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 09 Oct 2018 14:00:36 -0300
+
+squid (4.1-1ubuntu2) cosmic; urgency=medium
+
+  * d/usr.sbin.squid: Update apparmor profile to grant read access to squid
+    binary (LP: #1792728)
+
+ -- Simon Deziel <[e-mail]>  Sat, 15 Sep 2018 13:55:32 -0400
+
+squid (4.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merged with Debian unstable (LP: #1780944, LP: #1097032, LP: #16669).
+    Remaining changes:
+    - Use snakeoil certificates.
+      [Updated to use the correct config setting names]
+    - Add an example refresh pattern for debs.
+      [Improved the refresh patterns based on the configuration from
+       squid-deb-proxy package]
+    - Add disabled by default AppArmor profile.
+      [Updated to include the ssl_certs abstraction and suggestions on how to
+       deal with the snakeoil private key and other keys in /etc/ssl.]
+  * Dropped changes:
+    - Add additional dep8 tests.
+      [Adopted in 4.0.21-1~exp5, albeit a stripped down version]
+    - Correct attribution and add explanatory note in d/NEWS.debian.
+      [That particular upgrade path has happened long ago.]
+    - Drop wrong short-circuiting of various invocations; we always want to
+      call the debhelper block.
+      [This was for the transitional squid3 package, and that transition has
+       already happened.]
+    - Revert "Set pidfile for systemd's sysv-generator" from Debian.
+      [Not needed anymore since we have a native systemd service file
+       and no longer rely on the generator.]
+    - Enable autoreconf. This is no longer required for the security updates,
+      but is needed for the seddery of test-suite/Makefile.am in
+      d/t/upstream-test-suite.
+      [Replaced by patch 0003-installed-binary-for-debian-ci.patch]
+    - Adjust seddery for upstream test squid binary location.
+      [sed no longer necessary since patch,
+       0003-installed-binary-for-debian-ci.patch, will be dropped
+       entirely.]
+    - Drop Conflicts/Replaces of squid against squid3. In Ubuntu, the migration
+      happened in Xenial, so no upgrade path still requires this code. This
+      reduces upgrade ordering difficulty.
+      [Again we have a migration, but this time from squid3 to squid, so we
+      need this].
+    - GCC7 FTBFS fixes (LP: #1712668):
+      + d/rules: don't error when hitting the "deprecated" and
+      "format-truncation" gcc7 warnings. Upstream 3.5.27 has fixes for these,
+      but one in Format.cc that affects 32bit builds was deemed too intrusive
+      for the 3.5 stable series and is only in squid 4.x
+      [No longer needed with squid 4.x]
+    - Do not force gcc-6
+      [It was a temporary workaround in Debian that got dropped]
+  * Added changes:
+    - d/rules: enable cdbs parallel build
+    - d/t/test-squid.py: fix apparmor profile filename
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 16 Aug 2018 12:33:17 -0300
+
 squid (4.1-1) unstable; urgency=high
 
   * New Upstream Release (Closes: #896120)
diff --git a/debian/control b/debian/control
index 9645a8d..a567c91 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: squid
 Section: web
 Priority: optional
-Maintainer: Luigi Gangitano <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Luigi Gangitano <[e-mail]>
 Uploaders: Santiago Garcia Mantinan <[e-mail]>
 Homepage: http://www.squid-cache.org
 Standards-Version: 4.5.0
@@ -31,7 +32,7 @@ Build-Depends: ed, libltdl-dev, pkg-config
 Package: squid
 Architecture: any
 Pre-Depends: adduser
-Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl
+Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl, ssl-cert
 Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbind, apparmor
 Recommends: libcap2-bin [linux-any], ca-certificates
 Provides: squid3
diff --git a/debian/patches/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch b/debian/patches/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch
 new file mode 100644
index 0000000..8de4e08
--- /dev/null
+++ b/debian/patches/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch
@@ -0,0 +1,112 @@
+From: Sergio Durigan Junior <[e-mail]>
+Date: Fri, 7 Aug 2020 00:00:30 -0400
+Subject: WCCP: Fix GCC-10 -Wstringop-truncation failures
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 8bit
+
+When building squid using GCC10, I'm seeing a few failures related to
+the -Wstringop-truncation option:
+
+In file included from /usr/include/string.h:495,
+                 from ../compat/xstring.h:13,
+                 from ../compat/compat_shared.h:225,
+                 from ../compat/compat.h:87,
+                 from ../include/squid.h:43,
+                 from wccp2.cc:11:
+In function ‘char* strncpy(char*, const char*, size_t)’,
+    inlined from ‘void wccp2_add_service_list(int, int, int, int, int, int*, int, char*)’ at wccp2.cc:523:12,
+    inlined from ‘void parse_wccp2_service(void*)’ at wccp2.cc:2140:27:
+/usr/include/s390x-linux-gnu/bits/string_fortified.h:106:34: error: ‘char* __builtin_strncpy(char*, const char*, long unsigned int)’ output may be truncated copying 8 bytes from a string of length 8 [-Werror=stringop-truncation]
+  106 |   return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
+      |          ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+cc1plus: all warnings being treated as errors
+
+The curious thing is that I can only trigger these failures when I
+compile on s390x.
+
+The fix here is simple and inspired by
+02fc37ca9112cd2afd7d9f3acea06c53b900453a: use xstrncpy instead of
+strncpy.  I confirmed that this fixes the problem by recompiling, and
+doesn't introduce any other issues.
+
+Signed-off-by: Sergio Durigan Junior <[e-mail]>
+
+Author: Sergio Durigan Junior <[e-mail]>
+Last-Updated: 2020-08-10
+Forwarded: https://github.com/squid-cache/squid/pull/708/
+---
+ src/wccp2.cc | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/src/wccp2.cc b/src/wccp2.cc
+index 70a2796..05dfc6e 100644
+--- a/src/wccp2.cc
++++ b/src/wccp2.cc
+@@ -49,7 +49,7 @@ static EVH wccp2AssignBuckets;
+ 
+ /* Useful defines */
+ #define WCCP2_NUMPORTS  8
+-#define WCCP2_PASSWORD_LEN  8
++#define WCCP2_PASSWORD_LEN  8 + 1 /* + 1 for C-string NUL terminator */
+ 
+ /* WCCPv2 Pakcet format structures */
+ /* Defined in draft-wilson-wccp-v2-12-oct-2001.txt */
+@@ -451,7 +451,7 @@ struct wccp2_service_list_t {
+     size_t wccp_packet_size;
+ 
+     struct wccp2_service_list_t *next;
+-    char wccp_password[WCCP2_PASSWORD_LEN + 1];     /* hold the trailing C-string NUL */
++    char wccp_password[WCCP2_PASSWORD_LEN];     /* hold the trailing C-string NUL */
+     uint32_t wccp2_security_type;
+ };
+ 
+@@ -519,8 +519,8 @@ wccp2_add_service_list(int service, int service_id, int service_priority,
+     wccp2_update_service(wccp2_service_list_ptr, service, service_id,
+                          service_priority, service_proto, service_flags, ports);
+     wccp2_service_list_ptr->wccp2_security_type = security_type;
+-    memset(wccp2_service_list_ptr->wccp_password, 0, WCCP2_PASSWORD_LEN + 1);
+-    strncpy(wccp2_service_list_ptr->wccp_password, password, WCCP2_PASSWORD_LEN);
++    memset(wccp2_service_list_ptr->wccp_password, 0, WCCP2_PASSWORD_LEN);
++    xstrncpy(wccp2_service_list_ptr->wccp_password, password, WCCP2_PASSWORD_LEN);
+     /* add to linked list - XXX this should use the Squid dlink* routines! */
+     wccp2_service_list_ptr->next = wccp2_service_list_head;
+     wccp2_service_list_head = wccp2_service_list_ptr;
+@@ -562,8 +562,7 @@ wccp2_update_md5_security(char *password, char *ptr, char *packet, int len)
+ 
+     /* The password field, for the MD5 hash, needs to be 8 bytes and NUL padded. */
+     memset(pwd, 0, sizeof(pwd));
+-    strncpy(pwd, password, sizeof(pwd));
+-    pwd[sizeof(pwd) - 1] = '\0';
++    xstrncpy(pwd, password, sizeof(pwd));
+ 
+     ws = (struct wccp2_security_md5_t *) ptr;
+     assert(ntohs(ws->security_type) == WCCP2_SECURITY_INFO);
+@@ -630,8 +629,7 @@ wccp2_check_security(struct wccp2_service_list_t *srv, char *security, char *pac
+ 
+     /* The password field, for the MD5 hash, needs to be 8 bytes and NUL padded. */
+     memset(pwd, 0, sizeof(pwd));
+-    strncpy(pwd, srv->wccp_password, sizeof(pwd));
+-    pwd[sizeof(pwd) - 1] = '\0';
++    xstrncpy(pwd, srv->wccp_password, sizeof(pwd));
+ 
+     /* Take a copy of the challenge: we need to NUL it before comparing */
+     memcpy(md5_challenge, ws->security_implementation, sizeof(md5_challenge));
+@@ -2096,7 +2094,7 @@ parse_wccp2_service(void *)
+     int service = 0;
+     int service_id = 0;
+     int security_type = WCCP2_NO_SECURITY;
+-    char wccp_password[WCCP2_PASSWORD_LEN + 1];
++    char wccp_password[WCCP2_PASSWORD_LEN];
+ 
+     if (wccp2_connected == 1) {
+         debugs(80, DBG_IMPORTANT, "WCCPv2: Somehow reparsing the configuration without having shut down WCCP! Try reloading squid again.");
+@@ -2132,7 +2130,7 @@ parse_wccp2_service(void *)
+     if ((t = ConfigParser::NextToken()) != NULL) {
+         if (strncmp(t, "password=", 9) == 0) {
+             security_type = WCCP2_MD5_SECURITY;
+-            strncpy(wccp_password, t + 9, WCCP2_PASSWORD_LEN);
++            xstrncpy(wccp_password, t + 9, sizeof(wccp_password));
+         }
+     }
+ 
diff --git a/debian/patches/90-cf.data.ubuntu.patch b/debian/patches/90-cf.data.ubuntu.patch
 new file mode 100644
index 0000000..2c15c53
--- /dev/null
+++ b/debian/patches/90-cf.data.ubuntu.patch
@@ -0,0 +1,22 @@
+Description: Add an example refresh pattern for .debs
+
+Reviewed-By: Sergio Durigan Junior <[e-mail]>
+Last-Updated: 2020-08-12
+Forwarded: https://salsa.debian.org/squid-team/squid/-/merge_requests/15
+
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -5859,6 +5862,12 @@ NOCOMMENT_START
+ refresh_pattern ^ftp:		1440	20%	10080
+ refresh_pattern ^gopher:	1440	0%	1440
+ refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
++refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
++refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
++refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++# example pattern for deb packages
++#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
+ refresh_pattern .		0	20%	4320
+ NOCOMMENT_END
+ DOC_END
+
diff --git a/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
 new file mode 100644
index 0000000..40b5306
--- /dev/null
+++ b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
@@ -0,0 +1,22 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -3516,6 +3516,19 @@
+ 			reference a PEM file containing both the certificate
+ 			and private key.
+ 	
++	Notes:
++
++	On Debian/Ubuntu systems a default snakeoil certificate is
++	available in /etc/ssl and users can set:
++
++		sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem
++
++	and
++
++		sslkey=/etc/ssl/private/ssl-cert-snakeoil.key
++
++	for testing.
++
+ 	sslcipher=...	The list of valid SSL ciphers to use when connecting
+ 			to this peer.
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 6561436..d481df0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,6 @@
 0003-installed-binary-for-debian-ci.patch
 #0004-upstream-bug5041.patch
 0005-Use-RuntimeDirectory-to-create-run-squid.patch
+90-cf.data.ubuntu.patch
+99-ubuntu-ssl-cert-snakeoil.patch
+0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch
diff --git a/debian/usr.sbin.squid b/debian/usr.sbin.squid
index bc1f987..232b59f 100644
--- a/debian/usr.sbin.squid
+++ b/debian/usr.sbin.squid
@@ -50,6 +50,39 @@
   # squid-langpack
   /usr/share/squid-langpack/** r,
 
+  # maas-proxy
+  /var/lib/maas/maas-proxy.conf r,
+  /var/log/maas/proxy/** rw,
+  /var/spool/maas-proxy/ r,
+  /var/spool/maas-proxy/** rwk,
+
+  # squid-deb-proxy
+  /etc/squid-deb-proxy/** r,
+  /{,var/}run/squid-deb-proxy.pid rwk,
+  /var/cache/squid-deb-proxy/ r,
+  /var/cache/squid-deb-proxy/** rwk,
+  /var/log/squid-deb-proxy/* rw,
+
+  # squidguard
+  /usr/bin/squidGuard Cx -> squidguard,
+  profile squidguard {
+    #include <abstractions/base>
+
+    /etc/squid/squidGuard.conf r,
+    /var/log/squid{,3}/squidGuard.log w,
+    /var/lib/squidguard/** rw,
+
+    # squidguard by default uses /var/log/squid as its logdir, however, we
+    # don't want it to access squid's logs, only its own. Explicitly deny
+    # access to squid's files but allow all others since the user may specify
+    # anything for the squidGurad 'log' directive.
+    /var/log/squid{,3}/* rw,
+    audit deny /var/log/squid{,3}/{access,cache,store}.log* rw,
+
+    # Site-specific additions and overrides. See local/README for details.
+    #include <local/usr.sbin.squid>
+  }
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.squid>
 }