haveged (1.9.14-1+deb12u1) bookworm-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * Fix privilege escalation via command socket (CVE-2026-41054)
    (Closes: #1137096)
  * Check peer credentials before reading command (CVE-2026-41054)

 -- Salvatore Bonaccorso <carnil@debian.org>  Fri, 22 May 2026 14:56:30 +0200

haveged (1.9.14-1) unstable; urgency=low

  * New upstram version (2021-01-01)
    Added --version and new subcommand to close communication socket

  * Upgrade to debhelper compatibility level 13
    dh_missing --fail-missing is now the default.

  * d/control: Declare compliance with policy v4.5.1.
    No change needed.

 -- nicoo <nicoo@debian.org>  Thu, 14 Jan 2021 00:56:44 +0100

haveged (1.9.13-1) unstable; urgency=medium

  [ nicoo ]
  * New upstream version (2020-06-28)
    + added support for --version [Jirka Hladky]
    + fix a memory leak in havege_destroy [Anakin Zhang]
    + libhavege2: Update symbols file

  * Setup Salsa CI for the packaging repository
  * haveged: Simplify handling of the Apparmor profile

  [ Dan Streetman ]
  * Add consoles to apparmor profile
    Support outputting logs when running inside a container
  * Improve autopkgtests.
  * Remove -w parameter from /etc/default/haveged

  [ Debian Janitor ]
  * Add missing ${misc:Depends} to Depends for haveged-udeb.
  * Set upstream metadata fields
    Bug-Database, Bug-Submit, Repository, Repository-Browse.

 -- nicoo <nicoo@debian.org>  Wed, 25 Nov 2020 02:09:10 +0100

haveged (1.9.8-4) unstable; urgency=high (RC bug fix)

  * debian/haveged.service: Break ordering cycle
    Drop ordering constraint with systemd-journald
    Closes: #950418, #950540

  * debian/control: Build-Depends on debhelper (>= 12.3)
    Closes: #944040

 -- nicoo <nicoo@debian.org>  Fri, 07 Feb 2020 14:34:56 +0100

haveged (1.9.8-3) unstable; urgency=medium

  * debian/haveged.service
    + Sync with upstream's version
      - Service ordering changes
        - Start after systemd-tmpfiles-setup-dev.service
          This is required, otherwise /dev/random might not yet exist.
        - Start before systemd-journald
        - Set WantedBy=sysinit.target (rather than multi-user.target)
      - Drop `NoNewPrivileges` (useless, as haveged keeps running as root)
      - Update SuccessExitStatus
      - Always restart the service
      - Allow running haveged in containers
      - Normalise on Boolean “true” instead of “yes”

    + Tighten-down security settings
      - Apply a syscall filter to the service
      - Set ProtectHostname, ProtectKernel{Logs,Modules}
      - Set Restrict{Namespaces,Realtime}, preventing access to
        potentially-vulnerable kernel features.
      - Set LockPersonality, MemoryDenyWriteExecute


  * Declare compliance with policy v4.5.0.
    No change required.

  * Remove obsolete debian/source/include-binaries

 -- nicoo <nicoo@debian.org>  Fri, 31 Jan 2020 05:16:40 +0100

haveged (1.9.8-2) unstable; urgency=medium

  * Fix haveged-udeb by bumping SONAME in shlibs.local; otherwise, the
    udeb would get a dependency on non-udeb libhavege2, rendering it
    uninstallable and breaking d-i builds (Closes: #944189).

 -- Cyril Brulebois <kibi@debian.org>  Tue, 05 Nov 2019 16:53:59 +0000

haveged (1.9.8-1) unstable; urgency=high (systemd boot fix)

  [nicoo]
  * New upstream version 1.9.8  (Closes: #934971)
    + Remove patches merged upstream
    + libhavege: Update symbols file, bump soname.
      Upstream removed visibility of havegecmd in v1.9.7, which is ABI-breaking.

  * debian/watch
    + Deal with new release tag names
    + Stop expecting signed releases.
      Upstream stopped signing releases, this is a known issue:
        https://github.com/jirka-h/haveged/issues/2

  * debian/rules: Fixup for debhelper/12.3
    dh_makeshlibs now detects the library in haveged-udeb, but complains it
    is not shipped in haveged (since it's shipped in libhavege2)

  * debian/control
    + Use HTTPS for the Homepage link.
    + Declare compliance with policy v4.4.1.
      No change required.

  [Dan Streetman]
  * haveged.service: do not order After=systemd-random-seed.service
    Upstream systemd has recently changed systemd-random-seed.serivce to
    no longer be ordered before sysinit.target.
    However, since haveged orders itself After=systemd-random-seed and also
    Before=sysinit.service, it is now causing boot delays:
      https://github.com/systemd/systemd/issues/13252
    Closes: #938939

 -- nicoo <nicoo@debian.org>  Wed, 16 Oct 2019 21:13:07 +0200

haveged (1.9.4-2) unstable; urgency=medium

  * haveged.service: Set WantedBy=multi-user.target (Closes: #934165)
  * Patch reliability issue (segfault on start)

 -- nicoo <nicoo@debian.org>  Thu, 15 Aug 2019 14:18:48 +0200

haveged (1.9.4-1) unstable; urgency=medium

  [ nicoo ]
  * New upstream version 1.9.4 (Closes: #906294)

  * Add myself as an uploader
  * New upstream maintainer
    + Update debian/copyright, debian/watch
    + Switch to new-style upstream signing keys, update signing keys
    + Forward Debian patches (as Github PRs), update patch metadata

  * Amend the changelog for 1.9.1-6.
    It should have closed #866513, as the start ordering issue was likely the
    problem.

  * libhavege1
    + Add Build-Depends-Package to symbols file
    + Update symbols file

  * Comply with policy v4.4.0
    + Set Rules-Requires-Root: no
    + Install the upstream changelog as NEWS.gz
    + debian/copyright: Use HTTPS format URI

  * debian/control
    + Replace `Priority: extra` with `optional`
    + Drop obsolete -dbg package (Closes: #874627)
    + Add missing Pre-Depends for haveged

  * debian/gbp.conf
    + Update the name of the debian branch
    + Enable use of pristine-tar by default

  * Switch to debhelper 12, remove the old-style debian/compat file
  * Add missing installed paths, not-installed, make dh_missing failing
  * Simplify debian/rules

  [ Ondřej Nový ]
  * d/control: Set Vcs-* to salsa.debian.org

 -- nicoo <nicoo@debian.org>  Wed, 14 Aug 2019 16:34:34 +0200

haveged (1.9.1-8) unstable; urgency=medium

  * Update apparmor profile: add write access to /run/haveged.pid as that
    would get DENIED when running under sysvinit (Closes: #911604). That's
    not an issue when running under systemd as PID file handling isn't
    needed there.

 -- Cyril Brulebois <kibi@debian.org>  Sat, 13 Jul 2019 01:36:24 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog haveged`.
