Merge ~sergiodj/ubuntu/+source/squid:squid-merge-4.13-1 into ubuntu/+source/squid:debian/sid

[Sergio Durigan Junior]

This is the merge of squid 4.13-1 from Debian.

It's a trivial merge. I was able to drop a patch that has been accepted upstream (to fix a FTBFS when building with GCC-10 on s390x). Still waiting to see if Debian will accept https://salsa.debian.org/squid-team/squid/-/merge_requests/15 (no replies for now).

There's a PPA with the proposed update here: https://launchpad.net/~sergiodj/+archive/ubuntu/squid-update

autopkgtest is still happy:

autopkgtest [17:15:11]: @@@@@@@@@@@@@@@@@@@@ summary
upstream-test-suite PASS
squid PASS

[Christian Ehrhardt  (paelzer)]

Just after 4.12-1 merge landed, can't get enough :-) ?

[Christian Ehrhardt  (paelzer)]

Dropping the now accepted patch is fine.
Everything else stays the same as it was 15 days ago, which means it still is as ok as it was last time.

Changelog entries look good and I see no good chance to upstream more of our delta except that which you have already started.

http://squid-web-proxy-cache.1019090.n4.nabble.com/squid-announce-Squid-4-13-is-available-td4689798.html erads ok as well, the CVes are marked there as needed.

I'm slightly unsure on the TLS/1.3 change, but following upstream should be the right choice here.

+1 and let me know if you want me to sponsor it.

review: Approve

[Christian Ehrhardt  (paelzer)]

Checked with Sergio and he wanted sponsoring as-is.

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/squid
 * [new tag] upload/4.13-1ubuntu1 -> upload/4.13-1ubuntu1

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading squid_4.13-1ubuntu1.dsc: done.
  Uploading squid_4.13.orig.tar.xz: done.
  Uploading squid_4.13.orig.tar.xz.asc: done.
  Uploading squid_4.13-1ubuntu1.debian.tar.xz: done.
  Uploading squid_4.13-1ubuntu1_source.buildinfo: done.
  Uploading squid_4.13-1ubuntu1_source.changes: done.
Successfully uploaded packages.

[Sergio Durigan Junior (sergiodj)]

This has migrated.

diff --git a/debian/changelog b/debian/changelog
index a4a9ea2..2b95e27 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+squid (4.13-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern
+      for debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
+        to the default config file
+  * Dropped changes:
+    - d/p/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch:
+      Fix GCC-10 build failure due to -Wstringop-truncation warning.
+      [ Accepted upstream. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 25 Aug 2020 15:01:58 -0400
+
 squid (4.13-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -10,6 +28,43 @@ squid (4.13-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Mon, 24 Aug 2020 17:27:54 +0200
 
+squid (4.12-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern
+      for debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
+        to the default config file
+  * Dropped changes, not needed anymore:
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround
+      if building for ppc64el. On that arch, dpkg-buildflags sets -O3
+      instead of -O2 and that triggers a format-truncation error on
+      pcon.cc. See https://bugs.squid-cache.org/show_bug.cgi?id=4875.
+      [ Dropped because the build now passes on ppc64el ]
+  * Dropped changes, incorporated by Debian:
+    - Don't restart squid by hand on postinst script
+      + d/squid.postinst: When installing/upgrading squid, the service
+        is being restarted manually in the postinst script, which can
+        break installations that have the squid apparmor enabled because
+        it will try to restart the service before reloading the apparmor
+        profile.  There is no reason to restart squid manually, since the
+        restart will be automatically performed later.
+    - Drop conffile check for squid < 2.7
+      + d/squid.postinst: squid 2.7 is long, long gone, so it should be
+        safe to drop the postinst code to make sure that
+        /etc/squid/squid.conf was properly upgraded.
+    - d/tests/test-squid.py: Adjust 'pidfile' variable to reflect fact
+      that we now store the pidfile under '/run/squid/'.
+  * Added changes:
+    - d/p/0007-WCCP-Fix-GCC-10-Wstringop-truncation-failures.patch:
+      Fix GCC-10 build failure due to -Wstringop-truncation warning.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 10 Aug 2020 11:20:46 -0400
+
 squid (4.12-1) unstable; urgency=high
 
   [ Sergio Durigan Junior <[e-mail]> ]
@@ -45,6 +100,63 @@ squid (4.12-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Wed,  1 Jul 2020 10:52:54 +0200
 
+squid (4.11-5ubuntu3) groovy; urgency=medium
+
+  * No change rebuild against new libnettle8 and libhogweed6 ABI.
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 29 Jun 2020 22:38:13 +0100
+
+squid (4.11-5ubuntu2) groovy; urgency=medium
+
+  * d/tests/test-squid.py: Adjust 'pidfile' variable to reflect fact
+    that we now store the pidfile under '/run/squid/'.
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 20 May 2020 10:32:32 -0400
+
+squid (4.11-5ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for
+      debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl to the
+        default config file
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead
+      of -O2 and that triggers a format-truncation error on pcon.cc. See See
+      https://bugs.squid-cache.org/show_bug.cgi?id=4875
+  * Dropped:
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+      [ In 4.11-4 ]
+    - SECURITY UPDATE: multiple ESI issues
+      + debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
+        into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
+        src/esi/Esi.h, src/esi/Expression.cc.
+      + CVE-2019-12519
+      [ In 4.11-4 ]
+    - SECURITY UPDATE: Digest Authentication nonce replay issue
+      + debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
+        overflow in src/auth/digest/Config.cc.
+      [ In 4.11-4 ]
+  * Added:
+    - Don't restart squid by hand on postinst script
+      + d/squid.postinst: When installing/upgrading squid, the service
+        is being restarted manually in the postinst script, which can
+        break installations that have the squid apparmor enabled because
+        it will try to restart the service before reloading the apparmor
+        profile.  There is no reason to restart squid manually, since the
+        restart will be automatically performed later.
+    - Drop conffile check for squid < 2.7
+      + d/squid.postinst: squid 2.7 is long, long gone, so it should be
+        safe to drop the postinst code to make sure that
+        /etc/squid/squid.conf was properly upgraded.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 19 May 2020 14:43:04 -0400
+
 squid (4.11-5) unstable; urgency=medium
 
   [ Sergio Durigan Junior <[e-mail]> ]
@@ -123,6 +235,64 @@ squid (4.11-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Thu, 23 Apr 2020 19:34:54 +0200
 
+squid (4.10-1ubuntu2) groovy; urgency=medium
+
+  * SECURITY UPDATE: multiple ESI issues
+    - debian/patches/CVE-2019-12519_12521.patch: convert parse exceptions
+      into 500 status response in src/esi/Context.h, src/esi/Esi.cc,
+      src/esi/Esi.h, src/esi/Expression.cc.
+    - CVE-2019-12519
+    - CVE-2019-12521
+  * SECURITY UPDATE: Digest Authentication nonce replay issue
+    - debian/patches/CVE-2020-11945.patch: fix auth digest refcount integer
+      overflow in src/auth/digest/Config.cc.
+    - CVE-2020-11945
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 13 May 2020 09:51:10 -0400
+
+squid (4.10-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/p/90-cf.data.ubuntu.patch: Add an example refresh pattern for debs.
+    - Use snakeoil certificates:
+      + d/control: add ssl-cert to dependencies
+      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
+        to the default config file
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+  * Dropped:
+    - d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
+      no longer available in Focal (LP: #1858827)
+      [In 4.10-1, undocumented]
+    - d/t/test-squid.py, d/t/squid: switch to python3
+      [In 4.10-1, undocumented]
+    - d/t/control: depend on python3-minimal
+      [In 4.10-1, undocumented]
+    - SECURITY UPDATE: info disclosure via FTP server
+      + debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
+        src/clients/FtpGateway.cc.
+      + CVE-2019-12528
+      [Fixed upstream]
+    - SECURITY UPDATE: incorrect input validation and buffer management
+      + debian/patches/CVE-2020-84xx.patch: fix request URL generation in
+        reverse proxy configurations in src/client_side.cc.
+      + CVE-2020-8449
+      + CVE-2020-8450
+      [Fixed upstream]
+    - SECURITY UPDATE: DoS in NTLM authentication
+      + debian/patches/CVE-2020-8517.patch: improved username handling in
+        src/acl/external/LM_group/ext_lm_group_acl.cc.
+      + CVE-2020-8517
+      [Fixed upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 25 Feb 2020 15:37:55 -0300
+
 squid (4.10-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -144,6 +314,70 @@ squid (4.10-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Tue, 10 Feb 2020 14:12:54 +0100
 
+squid (4.9-2ubuntu4) focal; urgency=medium
+
+  * SECURITY UPDATE: info disclosure via FTP server
+    - debian/patches/CVE-2019-12528.patch: fix FTP buffers handling in
+      src/clients/FtpGateway.cc.
+    - CVE-2019-12528
+  * SECURITY UPDATE: incorrect input validation and buffer management
+    - debian/patches/CVE-2020-84xx.patch: fix request URL generation in
+      reverse proxy configurations in src/client_side.cc.
+    - CVE-2020-8449
+    - CVE-2020-8450
+  * SECURITY UPDATE: DoS in NTLM authentication
+    - debian/patches/CVE-2020-8517.patch: improved username handling in
+      src/acl/external/LM_group/ext_lm_group_acl.cc.
+    - CVE-2020-8517
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 19 Feb 2020 12:43:05 -0500
+
+squid (4.9-2ubuntu3) focal; urgency=medium
+
+  * No-change rebuild with fixed binutils on arm64.
+
+ -- Matthias Klose <[e-mail]>  Sat, 08 Feb 2020 11:20:19 +0000
+
+squid (4.9-2ubuntu2) focal; urgency=medium
+
+  * d/t/control, d/t/test-squid.py: remove gopher tests, as pygopherd is
+    no longer available in Focal (LP: #1858827)
+  * d/t/test-squid.py, d/t/squid: switch to python3
+  * d/t/control: depend on python3-minimal
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 08 Jan 2020 15:52:32 -0300
+
+squid (4.9-2ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+      deprecated in glibc 2.30 (LP #1843325)
+  * Dropped:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+      [Fixed upstream]
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+      [Fixed upstream]
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c. (LP #1835831)
+      [Fixed upstream]
+    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
+      mounted
+      [Fixed upstream]
+
+ -- Lucas Kanashiro <[e-mail]>  Thu, 14 Nov 2019 16:33:10 -0300
+
 squid (4.9-2) unstable; urgency=medium
 
   [ Andreas Hasenack <[e-mail]> ]
@@ -200,6 +434,73 @@ squid (4.9-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Sun, 10 Nov 2019 20:28:15 +0100
 
+squid (4.8-1ubuntu3) focal; urgency=medium
+
+  * No-change rebuild against libnettle7
+
+ -- Steve Langasek <[e-mail]>  Thu, 31 Oct 2019 22:15:39 +0000
+
+squid (4.8-1ubuntu2) eoan; urgency=medium
+
+  * d/p/drop-sysctl_h.patch: no longer include sysctl.h as it was
+    deprecated in glibc 2.30 (LP: #1843325)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 09 Sep 2019 17:31:45 -0300
+
+squid (4.8-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c. (LP #1835831)
+  * Dropped:
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Fixed upstream]
+    - debian/patches/413.patch: Fix gcc-9 build issues with upstream merged
+      patch
+      [Fixed upstream]
+    - SECURITY UPDATE: incorrect digest auth parameter parsing
+      + debian/patches/CVE-2019-12525.patch: check length in
+        src/auth/digest/Config.cc.
+      + CVE-2019-12525
+      [Fixed upstream]
+    - SECURITY UPDATE: buffer overflow in basic auth decoding
+      + debian/patches/CVE-2019-12527.patch: switch to SBuf in
+        src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+        src/clients/FtpGateway.cc.
+      + CVE-2019-12527
+      [Fixed upstream]
+    - SECURITY UPDATE: basic auth uudecode length issue
+      + debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+        base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+        include/uudecode.h, lib/uudecode.c.
+      + CVE-2019-12529
+      [Fixed upstream]
+    - SECURITY UPDATE: XSS issues in cachemgr.cgi
+      + debian/patches/CVE-2019-13345.patch: properly escape values in
+        tools/cachemgr.cc.
+      + CVE-2019-13345
+      [Fixed upstream]
+  * Added:
+    - d/t/test-squid.py: test_zz_apparmor(): bail early if securityfs isn't
+      mounted
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 24 Jul 2019 16:38:59 -0300
+
 squid (4.8-1) unstable; urgency=high
 
   [ Amos Jeffries <[e-mail]> ]
@@ -218,6 +519,86 @@ squid (4.8-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Thu, 18 Jul 2019 22:28:15 +0200
 
+squid (4.6-2ubuntu4) eoan; urgency=medium
+
+  * Fix gcc-9 issues (LP: #1835831)
+    - Remove -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    - debian/patches/more-gcc-9-fixes.patch: switch to xstrncpy in
+      lib/smblib/smblib-util.c.
+  * SECURITY UPDATE: incorrect digest auth parameter parsing
+    - debian/patches/CVE-2019-12525.patch: check length in
+      src/auth/digest/Config.cc.
+    - CVE-2019-12525
+  * SECURITY UPDATE: buffer overflow in basic auth decoding
+    - debian/patches/CVE-2019-12527.patch: switch to SBuf in
+      src/HttpHeader.cc, src/HttpHeader.h, src/cache_manager.cc,
+      src/clients/FtpGateway.cc.
+    - CVE-2019-12527
+  * SECURITY UPDATE: basic auth uudecode length issue
+    - debian/patches/CVE-2019-12529.patch: replace uudecode with libnettle
+      base64 decoder in lib/Makefile.*, src/auth/basic/Config.cc,
+      include/uudecode.h, lib/uudecode.c.
+    - CVE-2019-12529
+  * SECURITY UPDATE: XSS issues in cachemgr.cgi
+    - debian/patches/CVE-2019-13345.patch: properly escape values in
+      tools/cachemgr.cc.
+    - CVE-2019-13345
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 19 Jul 2019 08:01:58 -0400
+
+squid (4.6-2ubuntu3) eoan; urgency=medium
+
+  * Override newly added gcc-9 flags:
+    -Wno-sizeof-pointer-memaccess -Wno-stringop-truncation
+    NOTE: Overriding those flags is a possible security
+    asked for info on the gcc-9 issue bug tracker:
+    https://github.com/squid-cache/squid/pull/413#issuecomment-511314076
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 15 Jul 2019 10:21:47 +0200
+
+squid (4.6-2ubuntu2) eoan; urgency=medium
+
+  * Fix gcc-9 build issues with upstream merged patch
+
+ -- Gianfranco Costamagna <[e-mail]>  Sun, 14 Jul 2019 14:41:16 +0200
+
+squid (4.6-2ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - d/usr.sbin.squid: Add sections for maas-proxy, squid-deb-proxy,
+      squidguard
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+      [Added Applied-Upstream header]
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+  * Dropped:
+    - d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+      at boot. Thanks to Luigi Gangitano <[e-mail]> (LP #1816006)
+      [Fixed in 4.5-2]
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+      [Fixed upstream]
+    - Add disabled by default AppArmor profile.
+      [Added by Debian in 4.6-2]
+    - d/usr.sbin.squid: fix the apparmor profile (LP #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+      [Fixed in 4.6-2]
+
+ -- Andreas Hasenack <[e-mail]>  Sat, 18 May 2019 14:39:09 -0300
+
 squid (4.6-2) unstable; urgency=high
 
   [ Andreas Hasenack <[e-mail]> ]
@@ -278,6 +659,57 @@ squid (4.5-1) unstable; urgency=medium
 
  -- Luigi Gangitano <[e-mail]>  Wed, 20 Feb 2019 11:57:15 +0100
 
+squid (4.4-1ubuntu2) disco; urgency=medium
+
+  * d/squid.tmpfile: add tmpfiles configuration to handle /var/run/squid
+    at boot. Thanks to Luigi Gangitano <[e-mail]> (LP: #1816006)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 27 Feb 2019 08:54:45 -0300
+
+squid (4.4-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Use snakeoil certificates.
+    - Add an example refresh pattern for debs.
+    - Add disabled by default AppArmor profile.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+      Thanks to Vitaly Lavrov <[e-mail]>. (LP #1794553)
+  * Drop:
+    - d/rules: enable cdbs parallel build
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix apparmor profile filename
+      [Fixed in 4.2-1]
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+      [Fixed in 4.2-1]
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+      [Fixed in 4.2-1]
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+      [Fixed in 4.2-1]
+  * Added changes:
+    - d/rules: Only use -latomic with the intended architectures, instead of
+      all of them. This matches what was suggested in
+      https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907106#5
+    - d/NEWS.debian: rename d/NEWS.debian to d/NEWS so that
+      dh_installchangelogs can pick it up. dh_installchangelogs handles
+      d/NEWS or d/<package>.NEWS, but not NEWS.debian.
+    - d/usr.sbin.squid: fix the apparmor profile (LP: #1796189):
+      + allow net_admin capability
+      + add attach_disconnected flag
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 19 Nov 2018 10:51:18 -0200
+
 squid (4.4-1) unstable; urgency=high
 
   * Urgency high due to security fixes
@@ -342,6 +774,85 @@ squid (4.2-1) unstable; urgency=high
 
  -- Luigi Gangitano <[e-mail]>  Wed, 22 Aug 2018 13:57:15 +0200
 
+squid (4.1-1ubuntu3) cosmic; urgency=medium
+
+  * d/p/fix-rotate-assertion.patch: Fix assertion error when rotating logs.
+    Thanks to Vitaly Lavrov <[e-mail]>. (LP: #1794553)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 09 Oct 2018 14:00:36 -0300
+
+squid (4.1-1ubuntu2) cosmic; urgency=medium
+
+  * d/usr.sbin.squid: Update apparmor profile to grant read access to squid
+    binary (LP: #1792728)
+
+ -- Simon Deziel <[e-mail]>  Sat, 15 Sep 2018 13:55:32 -0400
+
+squid (4.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merged with Debian unstable (LP: #1780944, LP: #1097032, LP: #16669).
+    Remaining changes:
+    - Use snakeoil certificates.
+      [Updated to use the correct config setting names]
+    - Add an example refresh pattern for debs.
+      [Improved the refresh patterns based on the configuration from
+       squid-deb-proxy package]
+    - Add disabled by default AppArmor profile.
+      [Updated to include the ssl_certs abstraction and suggestions on how to
+       deal with the snakeoil private key and other keys in /etc/ssl.]
+  * Dropped changes:
+    - Add additional dep8 tests.
+      [Adopted in 4.0.21-1~exp5, albeit a stripped down version]
+    - Correct attribution and add explanatory note in d/NEWS.debian.
+      [That particular upgrade path has happened long ago.]
+    - Drop wrong short-circuiting of various invocations; we always want to
+      call the debhelper block.
+      [This was for the transitional squid3 package, and that transition has
+       already happened.]
+    - Revert "Set pidfile for systemd's sysv-generator" from Debian.
+      [Not needed anymore since we have a native systemd service file
+       and no longer rely on the generator.]
+    - Enable autoreconf. This is no longer required for the security updates,
+      but is needed for the seddery of test-suite/Makefile.am in
+      d/t/upstream-test-suite.
+      [Replaced by patch 0003-installed-binary-for-debian-ci.patch]
+    - Adjust seddery for upstream test squid binary location.
+      [sed no longer necessary since patch,
+       0003-installed-binary-for-debian-ci.patch, will be dropped
+       entirely.]
+    - Drop Conflicts/Replaces of squid against squid3. In Ubuntu, the migration
+      happened in Xenial, so no upgrade path still requires this code. This
+      reduces upgrade ordering difficulty.
+      [Again we have a migration, but this time from squid3 to squid, so we
+      need this].
+    - GCC7 FTBFS fixes (LP: #1712668):
+      + d/rules: don't error when hitting the "deprecated" and
+      "format-truncation" gcc7 warnings. Upstream 3.5.27 has fixes for these,
+      but one in Format.cc that affects 32bit builds was deemed too intrusive
+      for the 3.5 stable series and is only in squid 4.x
+      [No longer needed with squid 4.x]
+    - Do not force gcc-6
+      [It was a temporary workaround in Debian that got dropped]
+  * Added changes:
+    - d/rules: enable cdbs parallel build
+    - d/t/test-squid.py: fix apparmor profile filename
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 16 Aug 2018 12:33:17 -0300
+
 squid (4.1-1) unstable; urgency=high
 
   * New Upstream Release (Closes: #896120)
diff --git a/debian/control b/debian/control
index 9645a8d..a567c91 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: squid
 Section: web
 Priority: optional
-Maintainer: Luigi Gangitano <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Luigi Gangitano <[e-mail]>
 Uploaders: Santiago Garcia Mantinan <[e-mail]>
 Homepage: http://www.squid-cache.org
 Standards-Version: 4.5.0
@@ -31,7 +32,7 @@ Build-Depends: ed, libltdl-dev, pkg-config
 Package: squid
 Architecture: any
 Pre-Depends: adduser
-Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl
+Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl, ssl-cert
 Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbind, apparmor
 Recommends: libcap2-bin [linux-any], ca-certificates
 Provides: squid3
diff --git a/debian/patches/90-cf.data.ubuntu.patch b/debian/patches/90-cf.data.ubuntu.patch
new file mode 100644
index 0000000..2c15c53
--- /dev/null
+++ b/debian/patches/90-cf.data.ubuntu.patch
@@ -0,0 +1,22 @@
+Description: Add an example refresh pattern for .debs
+
+Reviewed-By: Sergio Durigan Junior <[e-mail]>
+Last-Updated: 2020-08-12
+Forwarded: https://salsa.debian.org/squid-team/squid/-/merge_requests/15
+
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -5859,6 +5862,12 @@ NOCOMMENT_START
+ refresh_pattern ^ftp:		1440	20%	10080
+ refresh_pattern ^gopher:	1440	0%	1440
+ refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
++refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
++refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
++refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++# example pattern for deb packages
++#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
+ refresh_pattern .		0	20%	4320
+ NOCOMMENT_END
+ DOC_END
+
diff --git a/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
new file mode 100644
index 0000000..40b5306
--- /dev/null
+++ b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
@@ -0,0 +1,22 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -3516,6 +3516,19 @@
+ 			reference a PEM file containing both the certificate
+ 			and private key.
+ 	
++	Notes:
++
++	On Debian/Ubuntu systems a default snakeoil certificate is
++	available in /etc/ssl and users can set:
++
++		sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem
++
++	and
++
++		sslkey=/etc/ssl/private/ssl-cert-snakeoil.key
++
++	for testing.
++
+ 	sslcipher=...	The list of valid SSL ciphers to use when connecting
+ 			to this peer.
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 6561436..398816a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,5 @@
 0003-installed-binary-for-debian-ci.patch
 #0004-upstream-bug5041.patch
 0005-Use-RuntimeDirectory-to-create-run-squid.patch
+90-cf.data.ubuntu.patch
+99-ubuntu-ssl-cert-snakeoil.patch
diff --git a/debian/usr.sbin.squid b/debian/usr.sbin.squid
index bc1f987..232b59f 100644
--- a/debian/usr.sbin.squid
+++ b/debian/usr.sbin.squid
@@ -50,6 +50,39 @@
   # squid-langpack
   /usr/share/squid-langpack/** r,
 
+  # maas-proxy
+  /var/lib/maas/maas-proxy.conf r,
+  /var/log/maas/proxy/** rw,
+  /var/spool/maas-proxy/ r,
+  /var/spool/maas-proxy/** rwk,
+
+  # squid-deb-proxy
+  /etc/squid-deb-proxy/** r,
+  /{,var/}run/squid-deb-proxy.pid rwk,
+  /var/cache/squid-deb-proxy/ r,
+  /var/cache/squid-deb-proxy/** rwk,
+  /var/log/squid-deb-proxy/* rw,
+
+  # squidguard
+  /usr/bin/squidGuard Cx -> squidguard,
+  profile squidguard {
+    #include <abstractions/base>
+
+    /etc/squid/squidGuard.conf r,
+    /var/log/squid{,3}/squidGuard.log w,
+    /var/lib/squidguard/** rw,
+
+    # squidguard by default uses /var/log/squid as its logdir, however, we
+    # don't want it to access squid's logs, only its own. Explicitly deny
+    # access to squid's files but allow all others since the user may specify
+    # anything for the squidGurad 'log' directive.
+    /var/log/squid{,3}/* rw,
+    audit deny /var/log/squid{,3}/{access,cache,store}.log* rw,
+
+    # Site-specific additions and overrides. See local/README for details.
+    #include <local/usr.sbin.squid>
+  }
+
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.squid>
 }