sudo (1.9.17p2-7ubuntu3) stonking; urgency=medium

  * d/t/04-getroot-sssd: adjust slapd apparmor for autopkgtests
    (LP: #2156801)
  * d/p/openssl4-ftbfs-fix.patch: fix build with OpenSSL4 (LP: #2161810)
  * d/t/03-1126085-sudoersd: make sure we are using sudo.ws for this
    test, since this is the package shipping the sudo.ws implementation

 -- Andreas Hasenack <andreas.hasenack@canonical.com>  Tue, 18 Aug 2026 15:35:45 -0300

sudo (1.9.17p2-7ubuntu2) stonking; urgency=medium

  * No-change rebuild against libssl4

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Fri, 24 Jul 2026 11:21:47 +0000

sudo (1.9.17p2-7ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2153358). Remaining changes:
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/sudoers:
       + also grant admin group sudo access
       + include /snap/bin in the secure_path
    - debian/tests/04-getroot-sssd:
    - Check if the slapd daemon is ready before proceeding.
      + In some situations, the next command (ldapmodify) runs before
        the service is ready. See LP#2026888
    - set alternatives (LP #2111419)
    - remove sudo-ldap package (LP #2115781)
      + Whereas Debian introduced a transitional for this package,
        we remove it outright.

 -- Mitchell Augustin <mitchell.augustin@canonical.com>  Fri, 05 Jun 2026 16:28:18 -0500

sudo (1.9.17p2-7) unstable; urgency=medium

  * new unchanged source upload to trigger build with new
    debhelper which is needed for full DPKG_ROOT support

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Mon, 08 Jun 2026 09:32:46 +0200

sudo (1.9.17p2-6) unstable; urgency=medium

  [ Marc Haber ]
  * add CVE number to 1.9.17p2-5 changelog
  * Fix test suite caching tests.
  * add pam_env.so invocation to pam files.
  * align /etc/sudoers with what upstream ships.

  [ Johannes Schauer Marin Rodrigues ]
  * debian/sudo.postinst: support DPKG_ROOT

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Mon, 01 Jun 2026 06:44:55 +0200

sudo (1.9.17p2-5) unstable; urgency=medium

  * cherry-pick upstream exec_mailer-Set-group-as-well-as-uid.
    This is the upstream fix for CVE-2026-35535:
    https://github.com/sudo-project/sudo/commit/3e474c2
  * Build-Depend on libselinux-dev instead of libselinux1-dev

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 28 Mar 2026 13:11:59 +0100

sudo (1.9.17p2-4) unstable; urgency=medium

  * some improvements to the test suite, making it more suitable
    for older Debian releases
  * remove sudo.preinst (historic)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Tue, 10 Feb 2026 21:29:33 +0100

sudo (1.9.17p2-3) unstable; urgency=medium

  * use dh_maintscript to remove /etc/sudoers.d/README.
    Thanks to Sven Joachim (Closes: #1126614)
  * comment mail_badpass in default /etc/sudoers.
    Thanks to Sven Geggus (Closes: #1114986)
  * remove no longer used debconf templates (Closes: #1101123)
  * remove po-debconf dependency

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 31 Jan 2026 21:32:35 +0100

sudo (1.9.17p2-2) unstable; urgency=medium

  * upload to unstable
  * declare proper breaks/replacest
  * add upstream patch (and test case): Do not perform path expansion
    Thanks to Adam D. Barratt (Closes: #1126085)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 28 Jan 2026 22:12:32 +0100

sudo (1.9.17p2-1ubuntu3) resolute; urgency=medium

  * SECURITY UPDATE: exec_mailer gid issue (LP: #2143042)
    - debian/patches/lp2143042.patch: set group as well as uid when running
      the mailer and make a setuid(), setgid() or setgroups() failure fatal
      in include/sudo_eventlog.h, lib/eventlog/eventlog.c,
      lib/eventlog/eventlog_conf.c, plugins/sudoers/logging.c,
      plugins/sudoers/policy.c.
    - No CVE number

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 13 Mar 2026 07:02:48 -0400

sudo (1.9.17p2-1ubuntu2) resolute; urgency=medium

  * Remove debian/etc/ and add sudo-common as dependency (LP: #2113927)

 -- Simon Johnsson <simon.johnsson@canonical.com>  Fri, 17 Oct 2025 16:18:39 +0200

sudo (1.9.17p2-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2125486). Remaining changes:
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/04-getroot-sssd:
      + Check if the slapd daemon is ready before proceeding.
      In some situations, the next command (ldapmodify) runs before
      the service is ready. See LP#2026888
    - set alternatives (LP #2111419)
    - remove sudo-ldap package (LP #2115781)
  * Drop Changes:
    - patches merges upstream CVE-2025-32463, CVE-2025-32462
    - man/man8/sudo_root.8, no longer required

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Thu, 25 Sep 2025 14:47:20 +0200

sudo (1.9.17p2-1exp1) experimental; urgency=medium

  [ Marc Haber ]
  * remove sudo-ldap.maintscript
  * remove sudo-ldap and libnss-sudo

  [ Alexander Reichle-Schmehl ]
  * Add myself to uploaders

  [ Daniel Lewart ]
  * Move /etc/sudoers.d/README to top of README.Debian (Closes: #1108772)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 31 Dec 2025 08:37:25 +0100

sudo (1.9.17p2-1) unstable; urgency=medium

  [ Otto Kekäläinen ]
  * New upstream release

  [ Marc Haber ]
  * add debian/upstream/metadata.
    Thanks to Otto Kekäläinen
  * add debian/gbp.conf (to reflect new repo structure)
    Thanks to Otto Kekäläinen
  * split Build-Depends to Build-Depends-Arch
  * run wrap-and-sort

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sun, 17 Aug 2025 12:41:14 +0200

sudo (1.9.17p1-1) experimental; urgency=medium

  * New upstream version 1.9.17p1
    * this includes the upstream fixes for
      CVE-2025-32462 and CVE-2025-32463.
  * Add new italian debconf translation.
    Thanks to Ceppo (Closes: #1108208)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Tue, 01 Jul 2025 06:15:43 +0200

sudo (1.9.16p2-3ubuntu2) questing; urgency=medium

  * add sudoers man to alternatives (LP: #2121037)
  * use sudo.ws for debian/tests

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Wed, 20 Aug 2025 11:35:49 +0200

sudo (1.9.16p2-3ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2119135). Remaining changes:
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/04-getroot-sssd:
      + Check if the slapd daemon is ready before proceeding.
        In some situations, the next command (ldapmodify) runs before
        the service is ready. See LP#2026888
    - set alternatives (LP #2111419)
    - remove sudo-ldap package (LP #2115781)

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Wed, 30 Jul 2025 23:49:17 +0200

sudo (1.9.16p2-3) unstable; urgency=high

  * backport upstream patch for CVE-2025-32463
  * add upstream patch for CVE-2025-32462
  * Add new italian debconf translation.
    Thanks to Ceppo (Closes: #1108208)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Mon, 30 Jun 2025 07:55:33 +0200

sudo (1.9.16p2-2) unstable; urgency=medium

  * new European Portuguese translation of debconf messages.
    Thanks to Américo Monteiro (Closes: #1101892)
  * add new Romanian debconf translation.
    Thanks to Remus-Gabriel Chelu (Closes: #1102040)
  * Build-Depend on tzdata.
    Thanks to Chris Hofstaedtler and other Mini Debconf Hamburg people
    (Closes: #1104681)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sun, 04 May 2025 17:48:51 +0200

sudo (1.9.16p2-1ubuntu4) questing; urgency=medium

  * remove sudo-ldap package (LP: #2115781)

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Wed, 02 Jul 2025 11:41:28 +0200

sudo (1.9.16p2-1ubuntu3) questing; urgency=medium

  * fix autopackage test (LP: #2115183)
    - rename cvtsudoers to cvtsudoers.ws

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Wed, 25 Jun 2025 11:22:35 +0200

sudo (1.9.16p2-1ubuntu2) questing; urgency=medium

  * set alternatives (LP: #2111419)
    - rename sudo to sudo.ws (ubuntu suffix based on upstream
      https://www.sudo.ws/).
    - adds a patch d/p/sudo-rename-for-alternates.patch to symlink
      sudoedit to new name.
    - add d/sudo.alternatives
    - rename sudo and dependent binaries and manpages in
      override_dh_auto_install
    - recommends: sudo-rs for installation on upgrades
    - update lintian overrides for new name
    - remove old reference to /etc/alternatives/sudo in d/sudo.postinst 

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Mon, 12 May 2025 16:01:09 +0200

sudo (1.9.16p2-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2098855). Remaining changes:
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
    - debian/tests/04-getroot-sssd:
      + Check if the slapd daemon is ready before proceeding.
        In some situations, the next command (ldapmodify) runs before
        the service is ready. See LP: #2026888
  * Drop Changes:
    - Disable an offensive insult (LP: #2058053)
      + d/p/disable_offensive_insult.patch: properly disable an offensive
        insult that was fogotten when the configure options were refactored
        in plugins/sudoers/ins_csops.h.
      [Disabled by default with 1.9.16]

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Wed, 19 Feb 2025 16:30:12 +0200

sudo (1.9.16p2-1) unstable; urgency=medium

  * New upstream version 1.9.16p2

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sun, 09 Feb 2025 20:13:12 +0100

sudo (1.9.16p1-1) unstable; urgency=medium

  * New upstream version 1.9.16p1

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 13 Nov 2024 18:08:56 +0100

sudo (1.9.16-2) unstable; urgency=medium

  * Upload to unstable

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Mon, 23 Sep 2024 08:14:18 +0200

sudo (1.9.16-1) experimental; urgency=medium

  * New upstream version 1.9.16
  * update debian/copyright
  * Streamline po-debconf translations headers
  * Add debconf translations for Simplified and Traditional Chinese.
    Thanks to Yangfl
  * Update Brazilian Portuguese debconf translation.
    Thanks to Adriano Rafael Gomes (Closes: #1068109)
  * add patch to fix docs to correctly point to ssh-askpass
  * remove obsolete lintian tag from overrides
  * Standards-Version: 4.7.0 (no changes necessary)
  * fix proper file suffixes for patches
  * disable libapparmor-dev build dependency for non-linux arches.
    Thanks to Sambuel Thibault (Closes: #1079659)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sun, 22 Sep 2024 21:19:01 +0200

sudo (1.9.15p5-3ubuntu5) noble; urgency=high

  * No change rebuild against libssl3t64.

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 08 Apr 2024 16:50:39 +0200

sudo (1.9.15p5-3ubuntu4) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 17:17:28 +0000

sudo (1.9.15p5-3ubuntu3) noble; urgency=medium

  * Disable an offensive insult (LP: #2058053)
    - d/p/disable_offensive_insult.patch: properly disable an offensive
      insult that was fogotten when the configure options were refactored
      in plugins/sudoers/ins_csops.h.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 18 Mar 2024 07:53:26 -0400

sudo (1.9.15p5-3ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 21:28:45 +0000

sudo (1.9.15p5-3ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2051576). Remaining changes:
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
    - debian/tests/04-getroot-sssd:
      + Check if the slapd daemon is ready before proceeding.
        In some situations, the next command (ldapmodify) runs before
        the service is ready. See LP#2026888

 -- Danilo Egea Gondolfo <danilo.egea.gondolfo@canonical.com>  Mon, 29 Jan 2024 17:09:56 +0000

sudo (1.9.15p5-3) unstable; urgency=medium

  * add --with-devel configure option.
    Thanks to Bastien Roucariès (Closes: #1061272)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Fri, 26 Jan 2024 21:10:13 +0100

sudo (1.9.15p5-2) unstable; urgency=medium

  * switch Build-Depends from systemd to systemd-dev
    Thanks to Michael Biebl (Closes: #1060511)
  * set Multi-Arch: foreign on sudo and sudo-ldap.
    Thanks to Andreas Rottmann (Closes: #1060445)
  * add debian/copyright clause for source_sudo.py.
    Oops.

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 13 Jan 2024 21:59:56 +0100

sudo (1.9.15p5-1) unstable; urgency=medium

  * new upstream version 1.9.15p5
    * This is supposed to properly malloc on hurd.
      Thanks to Martin-Éric Racine (Closes: #1057833)
  * add durch debconf translation.
    Thanks to Frans Spiesschaert (Closes: #1059567)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 03 Jan 2024 21:40:38 +0100

sudo (1.9.15p4-2) unstable; urgency=medium

  * upload to unstable
  * use pkg-config to place systemd units.
    Thanks to Chris Hofstaedtler (Closes: #1059063)
  * Add french debconf translation.
    Thanks to bubu (Closes: #1058939)
  * fix typo in NEWS.Debian.
    Thanks to Vincent Danjean (Closes: #1058925)
  * add persian debconf translation.
    Thanks to Danial Behzadi
  * add spanish debconf translation.
    Thanks to Camaleón (Closes: #1059460)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 27 Dec 2023 17:53:13 +0100

sudo (1.9.15p4-1) experimental; urgency=medium

  * new upstream version 1.9.15p4
  * add de.po template translation.
    Thanks to Christoph Brinkhaus (Closes: #1058762)
  * Enable AppArmor (MR 15, manually apṕlied)
    Thanks to Will Shand
  * remove legacy debian/rules.predh7

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Fri, 15 Dec 2023 22:57:27 +0100

sudo (1.9.15p3-1) unstable; urgency=medium

  * new upstream version 1.9.15p3

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Thu, 14 Dec 2023 20:22:51 +0100

sudo (1.9.15p2-2) unstable; urgency=medium

  * upload to unstable

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Fri, 08 Dec 2023 18:31:14 +0100

sudo (1.9.15p2-1) experimental; urgency=medium

  * the #DENOG15 release
  * New upstream version 1.9.15p2
  * mark sudo-ldap as deprecated.

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Mon, 20 Nov 2023 14:15:22 +0100

sudo (1.9.14p2-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2030914). Remaining changes:
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
    - debian/tests/04-getroot-sssd:
      + Check if the slapd daemon is ready before proceeding.
        In some situations, the next command (ldapmodify) runs before
        the service is ready. See LP#2026888

 -- Danilo Egea Gondolfo <danilo.egea.gondolfo@canonical.com>  Wed, 09 Aug 2023 21:53:59 +0100

sudo (1.9.14p2-1) unstable; urgency=medium

  * new upstream version

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Thu, 20 Jul 2023 00:31:52 +0200

sudo (1.9.13p3-3ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2025655). Remaining changes:
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap:
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
  * Added changes:
    - debian/tests/04-getroot-sssd:
      + Check if the slapd daemon is ready before proceeding.
        In some situations, the next command (ldapmodify) runs before
        the service is ready. See LP:#2026888
  * Dropped changes:
    - Drop Build-Conflicts on fakeroot (<< 1.25.3-1.1ubuntu1)
      This wasn't in the former Ubuntu version, just mentioned
      in the changelog by accident

 -- Danilo Egea Gondolfo <danilo.egea.gondolfo@canonical.com>  Mon, 03 Jul 2023 15:23:30 +0100

sudo (1.9.13p3-3) unstable; urgency=medium

  * fix wrong patch to fix event log format
    (added wrongly in 1.9.13p3-2)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Tue, 27 Jun 2023 11:43:07 +0200

sudo (1.9.13p3-2) unstable; urgency=medium

  * add upstream patch to fix event log format.
    Thanks to Kimmo Suominen (Closes: #1039557)
  * add patch to improve upstream spanish translation

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Tue, 27 Jun 2023 11:09:16 +0200

sudo (1.9.13p3-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap:
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
    - debian/control:
      + Drop Build-Conflicts on fakeroot (<< 1.25.3-1.1ubuntu1)
      (for context see LP 1915250)
  * Dropped changes, now included in Debian:
    - debian/patches/CVE-2023-27320.patch

 -- Danilo Egea Gondolfo <danilo.egea.gondolfo@canonical.com>  Tue, 23 May 2023 14:34:04 +0100

sudo (1.9.13p3-1) unstable; urgency=medium

  * new upstream version:
    * Fix potential double free for CHROOT= rules
      CVE-2023-27320. (Closes: #1032163)
    * Fix --enable-static-sudoers regression
    * check for overflow as result of fuzzing efforts
    * Fix parser regression disallowing rules for user "list"
    * Fix eventloop hang if there is /dev/tty data
    * Fix sudo -l command args regression
    * Fix sudo -l -U someuser regression
    * Fix list privs regression

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 08 Mar 2023 21:17:05 +0100

sudo (1.9.13p1-1ubuntu2) lunar; urgency=medium

  * SECURITY UPDATE: double free with per-command chroot sudoers rules
    - debian/patches/CVE-2023-27320.patch: don't free user_cmnd twice in
      MANIFEST, plugins/sudoers/match_command.c,
      plugins/sudoers/regress/fuzz/fuzz_sudoers.c,
      plugins/sudoers/regress/testsudoers/test20.out.ok,
      plugins/sudoers/regress/testsudoers/test20.sh,
      plugins/sudoers/testsudoers.c,
      plugins/sudoers/visudo.c.
    - CVE-2023-27320

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Mar 2023 08:51:34 -0500

sudo (1.9.13p1-1ubuntu1) lunar; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap:
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
    - debian/control:
      + Drop Build-Conflicts on fakeroot (<< 1.25.3-1.1ubuntu1)
        (for context see LP: 1915250)
    - Drop patches for issues fixed upstream
      + d/p/CVE-2023-22809.patch
      + d/p/Add-XDG_CURRENT_DESKTOP-to-initial_keepenv_table.patch

 -- Danilo Egea Gondolfo <danilo.egea.gondolfo@canonical.com>  Mon, 20 Feb 2023 17:38:07 +0000

sudo (1.9.13p1-1) unstable; urgency=medium

  * new upstream version 1.9.13p1
    * remove unnecessary changelog creation patch
  * remove lsb-base from dependencies

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 18 Feb 2023 13:03:19 +0100

sudo (1.9.12p2-1) unstable; urgency=high

  * new upstream version 1.9.12p2
  * this fixes CVE-2023-22809:
    Sudoedit can edit arbitrary files

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 18 Jan 2023 16:19:23 +0100

sudo (1.9.12p1-1) unstable; urgency=low

  * new upstream version 1.9.12p1
  * update patches
  * update debian/copyright
  * Add upstream patch to silence libgcrypt error message.
    Thanks to Francesco P. Lovergine (Closes: #1019428)
  * Standards-Version: 4.6.2 (no changes necessary)
  * clean out obsolete lintian overrides
  * Add patch to disable regeneration of upstream ChangeLog from git.
    Thanks to Gioele Barabucci (Closes: #1025740)
  * remove extra whitespace from debconf-get-selections output.
  * add autopkgtest for sudo with sssd (Closes: #1004910)

  [ Niels Thykier ]
  * Support building sudo without (fake)root.

  [ Gioele Barabucci ]
  * Use dh_installnss to add ldap to sudoers NSS database
  * Add libnss-sudo package. (Closes: #1023524)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sun, 15 Jan 2023 13:58:48 +0100

sudo (1.9.11p3-1ubuntu3) lunar; urgency=medium

  * SECURITY UPDATE: arbitrary file overwrite via sudoedit
    - debian/patches/CVE-2023-22809.patch: do not permit editor arguments
      to include -- in plugins/sudoers/editor.c, plugins/sudoers/sudoers.c,
      plugins/sudoers/visudo.c.
    - CVE-2023-22809

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 18 Jan 2023 12:46:34 -0500

sudo (1.9.11p3-1ubuntu2) lunar; urgency=medium

  * No-change rebuild against libldap-2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 15 Dec 2022 19:57:01 +0000

sudo (1.9.11p3-1ubuntu1) kinetic; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/control:
      + Build-Conflicts on fakeroot (<< 1.25.3-1.1ubuntu1)
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap:
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
    - Add XDG_CURRENT_DESKTOP to initial_keepenv_table for Qt to determine the
      correct theme (LP: #1958055)

 -- Benjamin Drung <bdrung@ubuntu.com>  Tue, 23 Aug 2022 10:06:34 +0200

sudo (1.9.11p3-1) unstable; urgency=low

  * new upstream version 1.9.11p3

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 23 Mar 2022 10:50:16 +0100

sudo (1.9.10-3ubuntu1) kinetic; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/control:
      + Build-Conflicts on fakeroot (<< 1.25.3-1.1ubuntu1)
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap:
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
  * Dropped changes (applied in Debian):
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
  * Add XDG_CURRENT_DESKTOP to initial_keepenv_table for Qt to determine the
    correct theme (LP: #1958055)

 -- Benjamin Drung <bdrung@ubuntu.com>  Wed, 03 Aug 2022 10:45:04 +0200

sudo (1.9.10-3) unstable; urgency=medium

  * some changes to 03-getroot-ldap autopkgtest to find out
    about ppc64el failure

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Wed, 23 Mar 2022 10:38:39 +0100

sudo (1.9.10-2) unstable; urgency=medium

  * upload to unstable (fixed autopkgtest is needed to allow
    adduser to migrate)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Mon, 21 Mar 2022 11:49:06 +0100

sudo (1.9.10-1) experimental; urgency=medium

  * new upstream version
    * unverified upstream changelog
    * implement workaround if /proc/self/stat is invalid.
      (Closes: #940533)
    * Fix compilation problem on kFreeBSD. (Closes: #1004909)
      (different fix than the Debian patch, disable Debian patch)
    * get rid of e-mails "problem with defaults entries" in sss
      configurations. (Closes: #793660)
    * regular expression support for sudoers. (Closes: #945366)
    * handle /proc/self/fd in qemu.
    * Apply Upstream Patch to allow test suite with non-english LANG
      https://bugzilla.sudo.ws/show_bug.cgi?id=1025
    * Apply Upstream Patch to allow test suite with faketime
  * re-introduce MVPROG patch that got lost in dh migration.
    Thanks to Vagrant Cascadian (Closes: #976307)
  * revert back to directly shipping the mask symlink in the package.
    Thanks to Michael Biebl (Closes: #1004730)
  * adopt configure changes from Ubuntu
    --without-lecture --with-tty-tickets --enable-admin-flag (Closes: #1006273)
  * fix wrong handling of --with-systemd-tmpfiles.d
  * bring OPTIONS up to date.
  * have upstream install docs directly to correct directory
  * let debhelper handle the upstream changelog
  * remove LICENSE.md in both packages
  * autopkgtest: send deluser stderr to null in cleanup
  * Add cron to autopkgtest 03-getroot-ldap dependencies
  * improve lintian overrides

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Fri, 18 Mar 2022 14:31:30 +0100

sudo (1.9.9-1ubuntu2) jammy; urgency=medium

  * d/t/control: skip 03-getroot-ldap autopkgtest on non-containers

 -- Lukas Märdian <slyon@ubuntu.com>  Mon, 14 Feb 2022 12:48:05 +0100

sudo (1.9.9-1ubuntu1) jammy; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/control:
      + Build-Conflicts on fakeroot (<< 1.25.3-1.1ubuntu1)
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
    - debian/sudo[-ldap].manpages: install man/man8/sudo_root.8
    - debian/sudo[-ldap].init: delete init scripts, as they are no longer
      necessary.
    - debian/etc/pam.d/sudo[-i]:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/etc/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/tests/control: 03-getroot-ldap:
      + allow removal of 'sudo' in autopkgtest (SUDO_FORCE_REMOVE=yes)
  * Dropped changes:
    - debian/rules:
       + use dh-autoreconf (converted to using dh)

 -- Lukas Märdian <slyon@ubuntu.com>  Tue, 08 Feb 2022 12:01:45 +0100

sudo (1.9.9-1) unstable; urgency=medium

  * new upstream version
    * audit plugin now handles unresolvable hostname better
      Thanks to Sven Mueller (Closes: #1003969)
    * better document environment handling.
      Thanks to Arnout Engelen (Closes: #659101)
    * README files now come as markdown
    * schemas are now in docs subdirectory
    * LICENSE is now LICENSE.md

  [ Marc Haber ]
  * refresh patches
    * mark paths-in-samples.diff expicitly as not forwarded
  * have systemd-tmpfiles clean up /run/sudo on boot
  * lintian overrides:
    * improve 'em in various places
    * give better explanations
    * override long line warnings
    * override typo warning for a literal film quote
    * use correct lintian tag for override init script without unit
  * init script / systemd units
    * guarantee init script no-op on systemd systems
    * mask sysv init script on systemd systems in postinst
      instead of debian/rules
    * actually remove masking of service in postrm
  * maintainer scripts
    * document when .dist file removal was added to that
      it can be eventually removed
    * document when alternative removal was added to that
      it can be eventually removed
  * add a test to check for presence of #1003969
  * Standards-Version: 4.6.0 (no changes)
  * use uscan version 4
  * honor nocheck DEB_BUILD_OPTION

  [ Hilko Bengen ]
  * More improvement for Lintian overrides
  * Convert debian/copyright to machine-readable format, using
    information from upstream-provided LICENSE.md file

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Mon, 31 Jan 2022 20:19:55 +0100

sudo (1.9.8p2-1) unstable; urgency=medium

  * add more autopkgtests (especially for LDAP)
  * improve existing autopkgtests
  * debian/patches:
    * Remove typo-in-classic-insults.diff, reflectinc upstream's decision
      to not fix the typo as a way of remembering Evi Nemeth.
    * remove unneeded sudo-success_return. patch
    * mark debian/patches/sudo-ldap-docs as Forwarded: not-needed
    * add DEP3 headers
  * mention #1001858 in sudo.prerm
  * comment some lintian-overrides with unclear results

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 18 Dec 2021 14:55:08 +0100

sudo (1.9.8p2-1~exp1) experimental; urgency=medium

  [ Marc Haber ]
  * new upstream version 1.9.8p2-1
    * this correctly handles double defined alases (Closes: #985412)
    * improve sudoers.ldap.manpage. Thanks to Dennis Filder and
      Eric Brun (Closes: #981190)
    * refresh patches
  * remove prompting for wrong sudo group id (Closes: #605576)
  * give better docs for LDAP success behavior.
    Thanks to Dennis Filder (Closes: 981190)
  * remove unneeded mandoc from Build-Depends.
    Thanks to Ingo Schwarze
  * Restore inclusion of pam_limits.so PAM module.
    Thanks to Salvatore Bonaccorso (Closes: 518464)
  * Use @includedir in sudoers.d/README (Closes: #993815)
  * Other improvements for sudoers.d/README.
    Thanks to Josh Triplett (Closes: #994962)
  * add some (simple) autopkgtests
  * better short description for sudo-ldap
  * use https in debian/watch
  * some changes to patch headers for Lintian
  * manually remove executable bit from shared libs
  * explicitly write set -e in maintainer scripts
  * debian/control: set Rules-Requires-Root: binary-targets
  * add first/trivial autopkgtests

  [ Hilko Bengen ]
  * Update lintian-overrides files
  * Remove group sudo / gid=27 check from postinst scripts

  [ Otto Kekäläinen ]
  * Add basic Salsa-CI for project quality assurance

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sun, 12 Dec 2021 22:45:15 +0100

sudo (1.9.6-1~exp2) experimental; urgency=low

  [ Marc Haber ]
  * add use_pty to default configuration, fixing CVE-2005-4890.
    Thanks to Daniel Kahn Gillmor (Closes: #657784)
  * Add group specific defaults for environment variables (commented out)
    Thanks to Josh Triplett
  * remove --disable-setresuid from sudo-ldap as well.
    Thanks to Dennis Filder (Closes: #985307)

  [ Hilko Bengen ]
  * Add PAM config for interactive login use (Closes: #690044)
  * Actually configure sudo to use pam / sudo-i

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Fri, 02 Apr 2021 18:15:21 +0200

sudo (1.9.6-1~exp1) experimental; urgency=medium

  * new upstream version
  * add upstream signature
  * refresh patches
  * remove NO_ROOT_MAILER patch (incorporated upstream)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Fri, 12 Mar 2021 22:06:59 +0100

sudo (1.9.5p2-3+exp1) experimental; urgency=medium

  [ Marc Haber ]
  * convert package to dh
    * rename init scripts to be picked up by new debhelper
    * rename and update lintian overrides
    * let /run directory be created by systemd
    * remove documentation files that are installed by upstream scripts
    * clear dependency path in .la files
  * add Pre-Depends: ${misc:Pre-Depends}
  * override package-has-unnecessary-activation-of-ldconfig-trigger

  [ Bastian Blank ]
  * Move stuff to /usr/libexec.
  * Use dpkg provided make snippets
  * Provide build-flags via environment
  * Use easier to read multi-line variables
  * Remove not require prefix override
  * Move stuff to /usr/libexec

  [ Hilko Bengen ]
  * Remove unneeded Built-Using
  * Simplify dh_auto_* overrides
  * Further simplification
  * debian/rules: Remove another unneeded variable
  * Don't ship *.la files
  * Add Apport script

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Fri, 12 Mar 2021 20:48:13 +0100

sudo (1.9.5p2-3ubuntu2) impish; urgency=medium

  * No-change rebuild due to OpenLDAP soname bump.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 21 Jun 2021 18:09:32 -0400

sudo (1.9.5p2-3ubuntu1) impish; urgency=low

  * Merge from Debian unstable (LP: #1929110). Remaining changes:
    - debian/rules:
       + use dh-autoreconf
    - debian/rules: stop shipping init scripts, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
  * Dropped changes, now included in Debian:
    - debian/rules:
      + install apport hooks
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks

 -- William 'jawn-smith' Wilson <william.wilson@canonical.com>  Thu, 20 May 2021 15:43:31 +0000

sudo (1.9.5p2-3) unstable; urgency=medium

  * new maintainer team and uploaders (Closes: #976244)
    * sudo is now team maintained
    * add Uploaders field
    * move salsa repo to team-sudo group
  * refresh patches
  * Adapt README.LDAP to the actual state of sudo-ldap (Closes: #442871)
  * add Apport hook.
    Thanks to Balint Reczey (Closes: 881671)

 -- Marc Haber <mh+debian-packages@zugschlus.de>  Sat, 27 Feb 2021 09:28:03 +0100

sudo (1.9.5p2-2ubuntu3) hirsute; urgency=medium

  * No change rebuild with fixed ownership.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 18 Feb 2021 00:03:21 +0000

sudo (1.9.5p2-2ubuntu2) hirsute; urgency=medium

  * No change rebuild against new permissions ABI. LP: #1915250

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 16 Feb 2021 10:39:16 +0000

sudo (1.9.5p2-2ubuntu1) hirsute; urgency=low

  * Merge from Debian unstable. (LP: #1915307)
    * Remaining changes:
      - debian/rules:
        + use dh-autoreconf
      - debian/rules: stop shipping init scripts, as they are no longer
        necessary.
      - debian/rules:
        + compile with --without-lecture --with-tty-tickets --enable-admin-flag
        + install man/man8/sudo_root.8 in both flavours
        + install apport hooks
      - debian/sudo-ldap.dirs, debian/sudo.dirs:
        + add usr/share/apport/package-hooks
      - debian/sudo.pam:
        + Use pam_env to read /etc/environment and /etc/default/locale
          environment files. Reading ~/.pam_environment is not permitted due
          to security reasons.
      - debian/sudoers:
        + also grant admin group sudo access
        + include /snap/bin in the secure_path
    * Dropped patches, no longer needed because they are integrated in Debian:
      - CVE-2021-23239.patch
      - CVE-2021-3156-1.patch
      - CVE-2021-3156-2.patch
      - CVE-2021-3156-3.patch
      - CVE-2021-3156-4.patch
      - CVE-2021-3156-5.patch

 -- William 'jawn-smith' Wilson <william.wilson@canonical.com>  Wed, 10 Feb 2021 05:42:42 -0600

sudo (1.9.5p2-2) unstable; urgency=medium

  * patch from upstream repo to fix NO_ROOT_MAILER

 -- Bdale Garbee <bdale@gag.com>  Fri, 29 Jan 2021 18:12:32 -0700

sudo (1.9.5p2-1) unstable; urgency=high

  * new upstream version, addresses CVE-2021-3156

 -- Bdale Garbee <bdale@gag.com>  Tue, 26 Jan 2021 21:20:05 -0700

sudo (1.9.5p1-1.1) unstable; urgency=high

  * Non-maintainer upload.
  * Heap-based buffer overflow (CVE-2021-3156)
    - Reset valid_flags to MODE_NONINTERACTIVE for sudoedit
    - Add sudoedit flag checks in plugin that are consistent with front-end
    - Fix potential buffer overflow when unescaping backslashes in user_args
    - Fix the memset offset when converting a v1 timestamp to TS_LOCKEXCL
    - Don't assume that argv is allocated as a single flat buffer

 -- Salvatore Bonaccorso <carnil@debian.org>  Wed, 20 Jan 2021 10:11:47 +0100

sudo (1.9.5p1-1) unstable; urgency=medium

  * new upstream version, closes: #980028

 -- Bdale Garbee <bdale@gag.com>  Wed, 13 Jan 2021 01:09:19 -0700

sudo (1.9.5-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Mon, 11 Jan 2021 15:15:48 -0700

sudo (1.9.4p2-2ubuntu3) hirsute; urgency=medium

  * SECURITY UPDATE: ineffective NO_ROOT_MAILER hardening option
    - debian/patches/ineffective_no_root_mailer.patch: fix NO_ROOT_MAILER
      in plugins/sudoers/logging.c, plugins/sudoers/policy.c.
    - No CVE number

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 30 Jan 2021 14:35:13 -0500

sudo (1.9.4p2-2ubuntu2) hirsute; urgency=medium

  * SECURITY UPDATE: dir existence issue via sudoedit race
    - debian/patches/CVE-2021-23239.patch: fix potential directory existing
      info leak in sudoedit in src/sudo_edit.c.
    - CVE-2021-23239
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2021-3156-1.patch: reset valid_flags to
      MODE_NONINTERACTIVE for sudoedit in src/parse_args.c.
    - debian/patches/CVE-2021-3156-2.patch: add sudoedit flag checks in
      plugin in plugins/sudoers/policy.c.
    - debian/patches/CVE-2021-3156-3.patch: fix potential buffer overflow
      when unescaping backslashes in plugins/sudoers/sudoers.c.
    - debian/patches/CVE-2021-3156-4.patch: fix the memset offset when
      converting a v1 timestamp to TS_LOCKEXCL in
      plugins/sudoers/timestamp.c.
    - debian/patches/CVE-2021-3156-5.patch: don't assume that argv is
      allocated as a single flat buffer in src/parse_args.c.
    - CVE-2021-3156

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 26 Jan 2021 14:37:48 -0500

sudo (1.9.4p2-2ubuntu1) hirsute; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/rules:
      + use dh-autoreconf
    - debian/rules: stop shipping init scripts, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 06 Jan 2021 13:51:07 -0800

sudo (1.9.4p2-2) unstable; urgency=medium

  * always use /bin/mv to ensure reproducible builds whether built on a
    usrmerge or non-usrmerge system, closes: #976307

 -- Bdale Garbee <bdale@gag.com>  Sun, 03 Jan 2021 09:11:13 -0700

sudo (1.9.4p2-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Sun, 20 Dec 2020 17:43:54 -0700

sudo (1.9.4p1-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Thu, 17 Dec 2020 17:35:55 -0700

sudo (1.9.4-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Tue, 01 Dec 2020 22:10:03 -0500

sudo (1.9.3p1-1ubuntu1) hirsute; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/rules:
      + use dh-autoreconf
    - debian/rules: stop shipping init scripts, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sat, 24 Oct 2020 17:14:39 -0700

sudo (1.9.3p1-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Thu, 24 Sep 2020 11:10:02 -0600

sudo (1.9.3-1) unstable; urgency=medium

  * new upstream version
  * make the comment match the text in default sudoers, closes: #964922
  * enable zlib, closes: #846077

 -- Bdale Garbee <bdale@gag.com>  Mon, 21 Sep 2020 17:11:30 -0600

sudo (1.9.1-2) unstable; urgency=medium

  * change # to @ on includedir in default sudoers to reduce confusion with
    a comment, such as in 964922

 -- Bdale Garbee <bdale@gag.com>  Sun, 12 Jul 2020 09:52:08 -0600

sudo (1.9.1-1ubuntu1) groovy; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/rules:
      + use dh-autoreconf
    - debian/rules: stop shipping init scripts, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 08 Jul 2020 09:38:55 -0700

sudo (1.9.1-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Fri, 19 Jun 2020 15:44:09 -0600

sudo (1.9.0-1ubuntu1) groovy; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/rules:
      + use dh-autoreconf
    - debian/rules: stop shipping init scripts, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due
        to security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
  * Dropped changes, no longer needed:
    - debian/control:
      + use dh-autoreconf

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 20 May 2020 17:07:02 -0700

sudo (1.9.0-1) unstable; urgency=medium

  * new upstream version, closes: #669687, #571621, #734752

 -- Bdale Garbee <bdale@gag.com>  Wed, 13 May 2020 18:34:59 -0600

sudo (1.8.31p1-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Thu, 19 Mar 2020 15:47:17 -0600

sudo (1.8.31-1ubuntu1) focal; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
      shipping init script and service file, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 03 Feb 2020 09:32:18 -0500

sudo (1.8.31-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Sat, 01 Feb 2020 23:07:09 -0800

sudo (1.8.29-1ubuntu1) focal; urgency=medium

  * Merge from Debian unstable.
    Remaining changes:
    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
      shipping init script and service file, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
  * Removed patches included in new version:
    - debian/patches/CVE-2019-14287.patch
    - debian/patches/CVE-2019-14287-2.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 26 Nov 2019 13:13:21 -0500

sudo (1.8.29-1) unstable; urgency=medium

  * new upstream version
  * make --libexecdir use /usr/lib instead of /usr/lib/sudo, closes: #943313

 -- Bdale Garbee <bdale@gag.com>  Mon, 28 Oct 2019 19:27:42 -0600

sudo (1.8.28p1-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Tue, 22 Oct 2019 16:13:34 -0600

sudo (1.8.27-1.1) unstable; urgency=high

  * Non-maintainer upload.
  * Treat an ID of -1 as invalid since that means "no change" (CVE-2019-14287)
    (Closes: #942322)
  * Fix test failure in plugins/sudoers/regress/testsudoers/test5.sh

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 14 Oct 2019 21:10:58 +0200

sudo (1.8.27-1ubuntu4) eoan; urgency=medium

  * SECURITY UPDATE: privilege escalation via UID -1
    - debian/patches/CVE-2019-14287.patch: treat an ID of -1 as invalid
      in lib/util/strtoid.c.
    - debian/patches/CVE-2019-14287-2.patch: fix and add to tests in
      lib/util/regress/atofoo/atofoo_test.c,
      plugins/sudoers/regress/testsudoers/test5.out.ok,
      plugins/sudoers/regress/testsudoers/test5.sh.
    - CVE-2019-14287

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 15 Oct 2019 07:09:02 -0400

sudo (1.8.27-1ubuntu3) eoan; urgency=medium

  * No-change upload with strops.h and sys/strops.h removed in glibc.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 05 Sep 2019 11:12:29 +0000

sudo (1.8.27-1ubuntu2) eoan; urgency=medium

  * Remove d/p/keep_home_by_default.patch (LP: #1556302)
    - This restores sudo handling of $HOME to what everyone else does

 -- Dan Streetman <ddstreet@canonical.com>  Tue, 04 Jun 2019 08:58:02 -0400

sudo (1.8.27-1ubuntu1) disco; urgency=medium

  * Merge from Debian unstable.
    Remaining changes:
    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
      shipping init script and service file, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment

 -- Balint Reczey <rbalint@ubuntu.com>  Tue, 19 Feb 2019 09:30:21 +0100

sudo (1.8.27-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Sat, 12 Jan 2019 11:10:05 -0700

sudo (1.8.26-2) unstable; urgency=medium

  * patch from upstream to fix man page truncation, closes: #914469

 -- Bdale Garbee <bdale@gag.com>  Fri, 23 Nov 2018 14:59:17 -0700

sudo (1.8.26-1) unstable; urgency=medium

  [Bdale Garbee]
  * new upstream version

  [Ondřej Nový]
  * d/changelog: Remove trailing whitespaces
  * d/control: Remove trailing whitespaces
  * d/rules: Remove trailing whitespaces

 -- Bdale Garbee <bdale@gag.com>  Mon, 19 Nov 2018 00:32:06 -1000

sudo (1.8.23-2ubuntu1) cosmic; urgency=medium

  * Merge from Debian unstable.
    Remaining changes:
    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
      shipping init script and service file, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment

 -- Balint Reczey <rbalint@ubuntu.com>  Thu, 23 Aug 2018 19:36:40 +0200

sudo (1.8.23-2) unstable; urgency=high

  * fix FTBFS due to earlier sudoers2ldif removal, closes: #903415

 -- Bdale Garbee <bdale@gag.com>  Sat, 21 Jul 2018 11:22:37 -0600

sudo (1.8.23-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Mon, 30 Apr 2018 20:55:10 -0600

sudo (1.8.21p2-3ubuntu1) bionic; urgency=medium

  * Merge from Debian unstable.
    Remaining changes:
    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
      shipping init script and service file, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment

 -- Balint Reczey <rbalint@ubuntu.com>  Thu, 18 Jan 2018 01:08:16 +0100

sudo (1.8.21p2-3) unstable; urgency=medium

  * include sssd support in the sudo-ldap build too, closes: #884741

 -- Bdale Garbee <bdale@gag.com>  Mon, 18 Dec 2017 21:55:18 -0700

sudo (1.8.21p2-2ubuntu1) bionic; urgency=medium

  * Merge from Debian unstable. (LP: #1731981)
    Remaining changes:
    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
      shipping init script and service file, as they are no longer
      necessary.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
    Dropped changes since they are integrated in Debian:
    - Use tmpfs location to store timestamp files
      + debian/rules: change --with-rundir to /var/run/sudo
      + debian/*.preinst, debian/*.postinst, debian/*.postrm: remove old
        init script with dpkg-maintscript-helper.
    Dropped changes since the the transition took place already in every
    release the package can be upgraded from:
      + debian/*.postinst: remove old /var/run/sudo to /var/lib/sudo
        transition code, remove old /var/lib/sudo/ts timestamp directory.
  * Refresh patches

 -- Balint Reczey <rbalint@ubuntu.com>  Mon, 13 Nov 2017 17:53:45 +0100

sudo (1.8.21p2-2) unstable; urgency=medium

  * work harder to clean up mess left by sudo-ldap using /etc/init.d/sudo
    prior to version 1.8.7-1, closes: #877516

 -- Bdale Garbee <bdale@gag.com>  Mon, 02 Oct 2017 13:02:27 -0600

sudo (1.8.21p2-1) unstable; urgency=medium

  * new upstream version, closes: #873623, #873600, #874000
  * remove legacy /etc/sudoers.dist we no longer deliver, closes: #873561

 -- Bdale Garbee <bdale@gag.com>  Thu, 07 Sep 2017 10:42:19 -0600

sudo (1.8.21-1) unstable; urgency=medium

  [ Bdale Garbee ]
  * new upstream version
  * don't deliver /etc/sudoers.dist, closes: #862309
  * whitelist DPKG_COLORS env var, closes: #823368

  [ Laurent Bigonville ]
  * debian/sudo*.postinst: Drop /var/run/sudo -> /var/lib/sudo migration code,
    this migration happened in 2010 and that code is not necessary anymore
  * Move timestamp files to /run/sudo, with systemd the directory is
    created/cleaned by tmpfiles.d now, the sudo initscript/service is not
    doing anything in that case anymore (Closes: #786555)
  * debian/sudo*.postinst: Move the debhelper marker before the creation of
    the sudo group, this way the snippets added by debhelper will be executed
    even if the group already exists. (Closes: #870456)

 -- Bdale Garbee <bdale@gag.com>  Mon, 28 Aug 2017 09:44:06 -0600

sudo (1.8.20p2-1ubuntu1) artful; urgency=low

  * Merge from Debian unstable. (LP: #1697587)
    Remaining changes:
    - Use tmpfs location to store timestamp files
      + debian/rules: change --with-rundir to /var/run/sudo
      + debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
        shipping init script and service file, as they are no longer
        necessary.
      + debian/*.preinst, debian/*.postinst, debian/*.postrm: remove old
        init script with dpkg-maintscript-helper.
      + debian/*.postinst: remove old /var/run/sudo to /var/lib/sudo
        transition code, remove old /var/lib/sudo/ts timestamp directory.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
    - Dropped patches no longer needed:
      + CVE-2017-1000367.patch

 -- Balint Reczey <rbalint@ubuntu.com>  Mon, 12 Jun 2017 21:51:31 +0200

sudo (1.8.20p2-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Thu, 08 Jun 2017 11:57:02 -0600

sudo (1.8.20p1-1.1) unstable; urgency=high

  * Non-maintainer upload.
  * Use /proc/self consistently on Linux
  * CVE-2017-1000368: Arbitrary terminal access (Closes: #863897)

 -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 05 Jun 2017 14:19:33 +0200

sudo (1.8.20p1-1) unstable; urgency=high

  * New upstream version with fix for CVE-2017-1000367, closes: #863731

 -- Bdale Garbee <bdale@gag.com>  Tue, 30 May 2017 14:41:58 -0600

sudo (1.8.20-1) unstable; urgency=medium

  * New upstream version
  * patch from Helmut Grohne to fix cross-building issues, closes: #847131
    + Let dh_auto_configure pass --host to configure
    + Honour DEB_BUILD_OPTIONS=nocheck

 -- Bdale Garbee <bdale@gag.com>  Wed, 10 May 2017 10:25:46 -0600

sudo (1.8.19p1-1ubuntu2) artful; urgency=medium

  * SECURITY UPDATE: /proc/self/stat parsing confusion
    - debian/patches/CVE-2017-1000367.patch: adjust parsing to
      find ttyname
    - CVE-2017-1000367

 -- Steve Beattie <sbeattie@ubuntu.com>  Mon, 29 May 2017 03:13:37 -0700

sudo (1.8.19p1-1ubuntu1) zesty; urgency=low

  * Merge from Debian unstable. (LP: #1607666)
    Remaining changes:
    - Use tmpfs location to store timestamp files
      + debian/rules: change --with-rundir to /var/run/sudo
      + debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
        shipping init script and service file, as they are no longer
        necessary.
      + debian/*.preinst, debian/*.postinst, debian/*.postrm: remove old
        init script with dpkg-maintscript-helper.
      + debian/*.postinst: remove old /var/run/sudo to /var/lib/sudo
        transition code, remove old /var/lib/sudo/ts timestamp directory.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/sudoers:
      + also grant admin group sudo access
      + include /snap/bin in the secure_path
    - debian/control, debian/rules:
      + use dh-autoreconf
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
    - Dropped patches no longer needed:
      + debian/patches/lp1565567.patch: upstream.
      + debian/patches/also_check_sudo_group.diff: upstream.

 -- Timo Aaltonen <tjaalton@debian.org>  Sat, 14 Jan 2017 01:41:17 +0200

sudo (1.8.19p1-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Fri, 13 Jan 2017 11:12:49 -0700

sudo (1.8.19-1) unstable; urgency=medium

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Mon, 19 Dec 2016 13:00:21 -0700

sudo (1.8.18p1-2) unstable; urgency=medium

  * merge work done by Balint Reczey in parallel / conflict with my offline work

 -- Bdale Garbee <bdale@gag.com>  Thu, 15 Dec 2016 19:08:46 -0700

sudo (1.8.18p1-1) unstable; urgency=medium

  * new upstream version
  * explicitly depend on lsb-base since we use init-functions
  * move to latest debhelper compat level

 -- Bdale Garbee <bdale@gag.com>  Thu, 15 Dec 2016 18:10:29 -0700

sudo (1.8.17p1-2) unstable; urgency=medium

  * merge 1.8.15-1.1 NMU changes

 -- Bdale Garbee <bdale@gag.com>  Tue, 05 Jul 2016 16:01:55 +0200

sudo (1.8.17p1-1) unstable; urgency=low

  * new upstream version, closes: #805563
  * build-depend on the new mandoc package so we can rebuild man pages
    properly if needed, closes: #809984

 -- Bdale Garbee <bdale@gag.com>  Tue, 05 Jul 2016 16:01:55 +0200

sudo (1.8.16-0ubuntu3) yakkety; urgency=medium

  * debian/sudoers:
    - include /snap/bin in the secure_path (LP: #1595558)

 -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 15 Aug 2016 18:08:34 +0200

sudo (1.8.16-0ubuntu2) yakkety; urgency=medium

  * debian/patches/lp1565567.patch: fix crash when looking up a negative
    cached entry which is stored as a NULL passwd or group struct pointer
    in plugins/sudoers/pwutil.c. (LP: #1565567)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 04 May 2016 11:31:55 -0400

sudo (1.8.16-0ubuntu1) xenial; urgency=medium

  * Update to new upstream version 1.8.16. (LP: #1563825)
    - Dropped patches no longer needed:
      + CVE-2015-5602-6.patch
      + CVE-2015-5602-7.patch
  * Merge from Debian unstable. Remaining changes:
    - Use tmpfs location to store timestamp files
      + debian/rules: change --with-rundir to /var/run/sudo
      + debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
        shipping init script and service file, as they are no longer
        necessary.
      + debian/*.preinst, debian/*.postinst, debian/*.postrm: remove old
        init script with dpkg-maintscript-helper.
      + debian/*.postinst: remove old /var/run/sudo to /var/lib/sudo
        transition code, remove old /var/lib/sudo/ts timestamp directory.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudoers:
      + also grant admin group sudo access
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/control:
      + dh-autoreconf dependency fixes missing-build-dependency-for-dh_-command
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
      + debian/patches/also_check_sudo_group.diff: also check the sudo group
        in plugins/sudoers/sudoers.c to create the admin flag file. Leave the
        admin group check for backwards compatibility.
    - Dropped patches no longer needed:
      + debian/patches/pam_check_untranslated_prompt.patch: upstream.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 30 Mar 2016 08:03:52 -0400

sudo (1.8.15-1.1) unstable; urgency=medium

  * Non-maintainer upload
  * Disable editing of files via user-controllable symlinks
    (Closes: #804149) (CVE-2015-5602)
    - Fix directory writability checks for sudoedit
    - Enable sudoedit directory writability checks by default

 -- Ben Hutchings <ben@decadent.org.uk>  Mon, 04 Jan 2016 23:36:50 +0000

sudo (1.8.15-1) unstable; urgency=low

  * new upstream version, closes: #804149
  * use --with-exampledir to deliver example files more cleanly

 -- Bdale Garbee <bdale@gag.com>  Wed, 23 Dec 2015 11:15:22 -0700

sudo (1.8.12-1ubuntu3) wily; urgency=medium

  * debian/patches/pam_check_untranslated_prompt.patch: also check the un-
    translated version of the prompt when checking if the PAM prompt matches
    "Password:". Patch from Joel Pelaez Jorge. (LP: #1414303)

 -- Mathieu Trudel-Lapierre <mathieu-tl@ubuntu.com>  Tue, 22 Sep 2015 11:57:43 -0400

sudo (1.8.12-1ubuntu2) wily; urgency=medium

  * Use tmpfs location to store timestamp files (LP: #1458031)
    - debian/rules: change --with-rundir to /var/run/sudo
    - debian/rules, debian/sudo.service, debian/sudo.sudo.init: stop
      shipping init script and service file, as they are no longer
      necessary.
    - debian/*.preinst, debian/*.postinst, debian/*.postrm: remove old init
      script with dpkg-maintscript-helper.
    - debian/*.postinst: remove old /var/run/sudo to /var/lib/sudo
      transition code, remove old /var/lib/sudo/ts timestamp directory.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 05 Jun 2015 09:31:38 -0400

sudo (1.8.12-1ubuntu1) wily; urgency=medium

  * Merge from Debian unstable. (LP: #1451274, LP: #1219337)
    Remaining changes:
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudoers:
      + also grant admin group sudo access
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/control:
      + dh-autoreconf dependency fixes missing-build-dependency-for-dh_-command
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
      + debian/patches/also_check_sudo_group.diff: also check the sudo group
        in plugins/sudoers/sudoers.c to create the admin flag file. Leave the
        admin group check for backwards compatibility.
  * Dropped patches no longer needed:
      + add_probe_interfaces_setting.diff
      + actually-use-buildflags.diff
      + CVE-2014-9680.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 13 May 2015 15:43:49 -0400

sudo (1.8.12-1) unstable; urgency=low

  * new upstream version, closes: #772707, #773383
  * patch from Christian Kastner to fix sudoers handling error when moving
    between sudo and sudo-ldap packages, closes: #776137

 -- Bdale Garbee <bdale@gag.com>  Mon, 23 Feb 2015 08:56:06 -0700

sudo (1.8.11p2-1) unstable; urgency=low

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Thu, 30 Oct 2014 11:14:06 -0700

sudo (1.8.11p1-2) unstable; urgency=low

  * patch from Jakub Wilk to fix 'ignoring time stamp from the future'
    messages, closes: #762465
  * upstream patch forwarded by Laurent Bigonville that fixes problem with
    Linux kernel auditing code, closes: #764817

 -- Bdale Garbee <bdale@gag.com>  Mon, 20 Oct 2014 11:06:44 -0600

sudo (1.8.11p1-1) unstable; urgency=low

  * new upstream version, closes: #764286
  * fix typo in German translation, closes: #761601

 -- Bdale Garbee <bdale@gag.com>  Fri, 10 Oct 2014 10:16:08 -0600

sudo (1.8.10p3-1) unstable; urgency=low

  * new upstream release
  * add hardening=+all to match login and su
  * updated VCS URLs and crypto verified watch file, closes: #747473
  * harmonize configure options for LDAP version to match non-LDAP version,
    in particular stop using --with-secure-path and add configure_args
  * enable audit support on Linux systems, closes: #745779
  * follow upstream change from --with-timedir to --with-rundir

 -- Bdale Garbee <bdale@gag.com>  Sun, 14 Sep 2014 10:20:15 -0600

sudo (1.8.9p5-1ubuntu5) vivid; urgency=medium

  * SECURITY UPDATE: arbitrary file access via TZ
    - debian/patches/CVE-2014-9680.patch: sanity check TZ env variable in
      configure, configure.ac, doc/sudoers.cat, doc/sudoers.man.in,
      doc/sudoers.mdoc.in, m4/sudo.m4, pathnames.h.in,
      plugins/sudoers/env.c.
    - CVE-2014-9680

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 12 Mar 2015 10:45:21 -0400

sudo (1.8.9p5-1ubuntu4) vivid; urgency=medium

  * Correct sudo.pam use "session" for pam_env.so, not "auth". (LP:
    #155794, LP: #25700)

 -- Dimitri John Ledkov <dimitri.j.ledkov@linux.intel.com>  Tue, 23 Dec 2014 04:08:33 +0000

sudo (1.8.9p5-1ubuntu3) vivid; urgency=medium

  * debian/patches/also_check_sudo_group.diff: also check the sudo group
    in plugins/sudoers/sudoers.c to create the admin flag file. Leave the
    admin group check for backwards compatibility. (LP: #1387347)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Oct 2014 15:55:34 -0400

sudo (1.8.9p5-1ubuntu2) utopic; urgency=medium

  * debian/sudo_root.8: mention sudo group instead of deprecated group
    admin (LP: #1130643)

 -- Andrey Bondarenko <abondarenko@users.sourceforge.net>  Sat, 23 Aug 2014 01:18:05 +0600

sudo (1.8.9p5-1ubuntu1) trusty; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudoers:
      + also grant admin group sudo access
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - debian/control:
      + dh-autoreconf dependency fixes missing-build-dependency-for-dh_-command
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
      + actually-use-buildflags: Pass LDFLAGS everywhere
      + add_probe_interfaces_setting.diff: option to disable network inf probe
  * add_probe_interfaces_setting.diff: fix to not modify NEWS file.

 -- Chris J Arges <chris.j.arges@ubuntu.com>  Mon, 10 Feb 2014 12:21:53 -0600

sudo (1.8.9p5-1) unstable; urgency=low

  * new upstream release, closes: #735328

 -- Bdale Garbee <bdale@gag.com>  Tue, 04 Feb 2014 11:46:19 -0700

sudo (1.8.9p4-1) unstable; urgency=low

  * new upstream release, closes: #732008

 -- Bdale Garbee <bdale@gag.com>  Wed, 15 Jan 2014 14:55:25 -0700

sudo (1.8.9p3-1) unstable; urgency=low

  * new upstream release

 -- Bdale Garbee <bdale@gag.com>  Mon, 13 Jan 2014 14:49:42 -0700

sudo (1.8.9~rc1-1) experimental; urgency=low

  * upstream release candidate

 -- Bdale Garbee <bdale@gag.com>  Sun, 29 Dec 2013 21:36:12 -0700

sudo (1.8.9~b2-1) experimental; urgency=low

  * upstream beta release
  * update Debian standards version
  * squelch lintian complaint about missing sudo-ldap systemd service, since
    the service file is always called 'sudo.service'

 -- Bdale Garbee <bdale@gag.com>  Wed, 25 Dec 2013 14:48:23 -0700

sudo (1.8.9~b1-1) experimental; urgency=low

  * upstream beta release

 -- Bdale Garbee <bdale@gag.com>  Wed, 27 Nov 2013 09:37:00 -0700

sudo (1.8.8-3) unstable; urgency=low

  * document in README.Debian that the sssd support is enabled in the sudo
    package, not in the sudo-ldap package, closes: #728289

 -- Bdale Garbee <bdale@gag.com>  Wed, 30 Oct 2013 10:33:44 -0600

sudo (1.8.8-2ubuntu2) trusty; urgency=medium

  * Build using dh-autoreconf.

 -- Matthias Klose <doko@ubuntu.com>  Sun, 15 Dec 2013 16:24:49 +0100

sudo (1.8.8-2ubuntu1) trusty; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets --enable-admin-flag
      + install man/man8/sudo_root.8 in both flavours
      + install apport hooks
    - debian/sudoers:
      + also grant admin group sudo access
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
    - Remaining patches:
      + keep_home_by_default.patch: Keep HOME in the default environment
      + actually-use-buildflags: Pass LDFLAGS everywhere

 -- Stéphane Graber <stgraber@ubuntu.com>  Tue, 22 Oct 2013 17:43:37 -0400

sudo (1.8.8-2) unstable; urgency=low

  * fix touch errors on boot, closes: #725193

 -- Bdale Garbee <bdale@gag.com>  Tue, 08 Oct 2013 20:11:38 -0600

sudo (1.8.8-1) unstable; urgency=low

  * new upstream release

 -- Bdale Garbee <bdale@gag.com>  Mon, 30 Sep 2013 23:08:49 -0600

sudo (1.8.8~rc1-1) experimental; urgency=low

  * upstream release candidate with several of our patches folded in
  * set filestamps to epoch instead of an arbitrary old date in the init
    fragment, closes: #722335

 -- Bdale Garbee <bdale@gag.com>  Thu, 12 Sep 2013 10:16:58 -0700

sudo (1.8.8~b3-1) experimental; urgency=low

  * pre-release of new upstream version, put in experimental

 -- Bdale Garbee <bdale@gag.com>  Wed, 04 Sep 2013 07:53:08 -0600

sudo (1.8.7-4) unstable; urgency=low

  * looks like we actually need both --with-sssd and --with-sssd-lib,
    closes: #719987, #724763

 -- Bdale Garbee <bdale@gag.com>  Fri, 27 Sep 2013 11:48:55 -0600

sudo (1.8.7-3) unstable; urgency=low

  * use --with-sssd-lib to help sudo find libsss-sudo in multiarch path,
    closes: #719987

 -- Bdale Garbee <bdale@gag.com>  Sat, 17 Aug 2013 15:38:53 +0200

sudo (1.8.7-2) unstable; urgency=low

  * let debhelper scripts manage the update-rc.d calls, closes: #719755

 -- Bdale Garbee <bdale@gag.com>  Fri, 16 Aug 2013 01:48:23 +0200

sudo (1.8.7-1) unstable; urgency=low

  * new upstream version, closes: #715157, #655879
  * make sudo-ldap package's init.d script be called sudo-ldap
  * add sssd support to sudo, closes: #719574
  * recognize lenny, squeeze, and wheezy unmodified sudoers, closes: #660594

 -- Bdale Garbee <bdale@gag.com>  Wed, 14 Aug 2013 00:01:14 +0200

sudo (1.8.6p3-0ubuntu3) raring; urgency=low

  * SECURITY UPDATE: authentication bypass via clock set to epoch
    - debian/patches/CVE-2013-1775.patch: ignore time stamp file if it is
      set to epoch in plugins/sudoers/check.c.
    - CVE-2013-1775

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 27 Feb 2013 13:26:26 -0500

sudo (1.8.6p3-0ubuntu2) raring; urgency=low

  * The latest sssd upload dropped the soname from libsss_sudo.so, so we
    can now drop our sudo delta and just use libsss_sudo.so directly.

 -- Stéphane Graber <stgraber@ubuntu.com>  Fri, 07 Dec 2012 23:11:45 -0500

sudo (1.8.6p3-0ubuntu1) raring; urgency=low

  * New upstream release (1.8.6p3).
  * Add patch to fix building with sssd when ldap is disabled.
  * Drop sudo.manpages and sudo-ldap.manpages as the upstream build system
    now does the right thing here.
  * Build the main sudo package with support for sssd, this doesn't add any
    additional build time or runtime dependency. sudo will dynamically load
    the sssd library if 'sss' is listed for the 'sudoers' nss service.

 -- Stéphane Graber <stgraber@ubuntu.com>  Fri, 16 Nov 2012 09:31:32 -0500

sudo (1.8.5p2-1ubuntu1) quantal; urgency=low

  * Merge from debian/testing (LP: #1024154), remaining changes:
    - debian/patches/keep_home_by_default.patch:
      + Set HOME in initial_keepenv_table.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets (Ubuntu specific)
      + install man/man8/sudo_root.8 in both flavours (Ubuntu specific)
      + install apport hooks
      + The ubuntu-sudo-as-admin-successful.patch was taken upstream by
        Debian however it requires a --enable-admin-flag configure flag to
        actually enable it in both flavours.
    - debian/control:
      + Mark Debian Vcs-* as XS-Debian-Vcs-*
      + update debian/control
    - debian/sudoers:
      + grant admin group sudo access
    - debian/source_sudo.py, debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.pam:
      + Use pam_env to read /etc/environment and /etc/default/locale
        environment files. Reading ~/.pam_environment is not permitted due to
        security reasons.
  * Dropped changes:
    - debian/patches/lp927828-fix-abort-in-pam-modules-when-timestamp-valid.patch
      + Fixed upstream in 1.8.5
    - debian/patches/CVE-2012-2337.patch:
      + Fixed upstream in 1.8.4p5
    - debian/patches/pam_env_merge.patch:
      + Feature released upstream in 1.8.5
    - debian/{sudo,sudo-ldap}.{preinst,postinst,postrm}:
      + Drop Ubuntu-specific sudoers file migration code because the only
        upgrade path to quantal is from precise. All necessary sudoers file
        migration will have already been done by the time this version of the
        sudo package is installed.

 -- Tyler Hicks <tyhicks@canonical.com>  Mon, 16 Jul 2012 14:01:42 +0200

sudo (1.8.5p2-1) unstable; urgency=low

  * new upstream version
  * patch to use flock on hurd, run autoconf in rules, closes: #655883
  * patch to avoid calling unlink with null pointer on hurd, closes: #655948
  * patch to actually use hardening build flags, closes: #655417
  * fix sudo-ldap.postinst syntax issue, closes: #669576

 -- Bdale Garbee <bdale@gag.com>  Thu, 28 Jun 2012 12:01:37 -0600

sudo (1.8.3p2-1ubuntu2) quantal; urgency=low

  * debian/patches/pam_env_merge.patch: Merge the PAM environment into the
    user environment (LP: #982684)
  * debian/sudo.pam: Use pam_env to read /etc/environment and
    /etc/default/locale environment files. Reading ~/.pam_environment is not
    permitted due to security reasons.

 -- Tyler Hicks <tyhicks@canonical.com>  Mon, 21 May 2012 00:48:10 -0500

sudo (1.8.3p2-1ubuntu1) quantal; urgency=low

  * Merge from debian/testing, remaining changes:
    - debian/patches/keep_home_by_default.patch:
      + Set HOME in initial_keepenv_table. (rebased for 1.8.3p1)
    - debian/patches/lp927828-fix-abort-in-pam-modules-when-timestamp-valid.patch
      + Fix Abort in some PAM modules when timestamp is valid. (LP: #927828)
    - debian/patches/CVE-2012-2337.patch: Don't perform IPv6 checks on IPv4
      addresses. Based on upstream patch.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets (Ubuntu specific)
      + install man/man8/sudo_root.8 in both flavours (Ubuntu specific)
      + install apport hooks
      + The ubuntu-sudo-as-admin-successful.patch was taken upstream by
        Debian however it requires a --enable-admin-flag configure flag to
        actually enable it in both flavours.
    - debian/control:
      + Mark Debian Vcs-* as XS-Debian-Vcs-*
      + update debian/control
    - debian/sudoers:
      + grant admin group sudo access
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.preinst:
      + avoid conffile prompt by checking for known default /etc/sudoers
        and if found installing the correct default /etc/sudoers file.
        Modified for updated default sudoers. Aproach taken is different
        from Debian. Maybe this should now be dropped, since an LTS was
        released.

  * Dropped changes:
    - debian/patches/CVE-2012-0809.patch:
      + dropped, included in this new upstream release.
    - debian/patches/enable_badpass.patch:
      + dropped as Debian chose to set this by default in the sudoers.

 -- Dmitrijs Ledkovs <dmitrij.ledkov@ubuntu.com>  Tue, 01 May 2012 16:12:45 +0100

sudo (1.8.3p2-1) unstable; urgency=high

  * new upstream version, closes: #657985 (CVE-2012-0809)
  * patch from Pino Toscano to only use selinux on Linux, closes: #655894

 -- Bdale Garbee <bdale@gag.com>  Mon, 30 Jan 2012 16:11:54 -0700

sudo (1.8.3p1-3) unstable; urgency=low

  * patch from Moritz Muehlenhoff enables hardened build flags, closes: #655417
  * replacement postinst script from Mike Beattie using shell instead of Perl
  * include systemd service file from Michael Stapelberg, closes: #639633
  * add init.d status support, closes: #641782
  * make sudo-ldap package manage a sudoers entry in nsswitch.conf,
    closes: #610600, #639530
  * enable mail_badpass in the default sudoers file, closes: #641218
  * enable selinux support, closes: #655510

 -- Bdale Garbee <bdale@gag.com>  Wed, 11 Jan 2012 16:18:13 -0700

sudo (1.8.3p1-2) unstable; urgency=low

  * if upgrading from squeeze, and the sudoers file is unmodified, avoid
    the packaging system prompting the user about a change they didn't make
    now that sudoers is a conffile, closes: #612532, #636049
  * add a recommendation for the use of visudo to the sudoers.d/README file,
    closes: #648104

 -- Bdale Garbee <bdale@gag.com>  Sat, 12 Nov 2011 16:27:13 -0700

sudo (1.8.3p1-1ubuntu5) quantal; urgency=low

  * SECURITY UPDATE: Properly handle netmasks in sudoers Host and Host_List
    values (LP: #1000276)
    - debian/patches/CVE-2012-2337.patch: Don't perform IPv6 checks on IPv4
      addresses. Based on upstream patch.
    - CVE-2012-2337

 -- Tyler Hicks <tyhicks@canonical.com>  Wed, 16 May 2012 09:42:17 -0500

sudo (1.8.3p1-1ubuntu4) quantal; urgency=low

  * Fix Abort in some PAM modules when timestamp is valid. (LP: #927828)

 -- TJ (Ubuntu Contributions) <ubuntu@tjworld.net>  Mon, 30 Apr 2012 17:55:27 +0100

sudo (1.8.3p1-1ubuntu3) precise; urgency=low

  * SECURITY UPDATE: permissions bypass via format string
    - debian/patches/CVE-2012-0809.patch: fix format string vulnerability
      in src/sudo.c.
    - CVE-2012-0809

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 31 Jan 2012 10:25:52 -0500

sudo (1.8.3p1-1ubuntu2) precise; urgency=low

  * debian/sudo.preinst:
    - updated to avoid conffile prompt by migrating to the new sudoers file
      changes in Precise. (LP: #894410)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 24 Nov 2011 10:48:58 -0500

sudo (1.8.3p1-1ubuntu1) precise; urgency=low

  * Merge from debian/testing, remaining changes:
    - debian/patches/keep_home_by_default.patch:
      + Set HOME in initial_keepenv_table. (rebased for 1.8.3p1)
    - debian/patches/enable_badpass.patch: turn on "mail_badpass" by default:
      + attempting sudo without knowing a login password is as bad as not
        being listed in the sudoers file, especially if getting the password
        wrong means doing the access-check-email-notification never happens
        (rebased for 1.8.3p1)
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets (Ubuntu specific)
      + install man/man8/sudo_root.8 (Ubuntu specific)
      + install apport hooks
      + The ubuntu-sudo-as-admin-successful.patch was taken upstream by
        Debian however it requires a --enable-admin-flag configure flag to
        actually enable it.
    - debian/sudoers:
      + grant admin group sudo access
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
    - debian/sudo.preinst:
      + avoid conffile prompt by checking for known default /etc/sudoers
        and if found installing the correct default /etc/sudoers file

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sun, 20 Nov 2011 12:07:45 -0500

sudo (1.8.3p1-1) unstable; urgency=low

  * new upstream version, closes: #646478

 -- Bdale Garbee <bdale@gag.com>  Thu, 27 Oct 2011 01:03:44 +0200

sudo (1.8.3-1) unstable; urgency=low

  * new upstream version, closes: #639391, #639568

 -- Bdale Garbee <bdale@gag.com>  Sat, 22 Oct 2011 23:49:16 -0600

sudo (1.8.2-2) unstable; urgency=low

  [ Luca Capello ]
  * debian/rules improvements, closes: #642535
    + mv upstream sample.* files to the examples folder.
    - do not call dh_installexamples.

  [ Bdale Garbee ]
  * patch from upstream for SIGBUS on sparc64, closes: #640304
  * use common-session-noninteractive in the pam config to reduce log noise
    when sudo is used in cron, etc, closes: #519700
  * patch from Steven McDonald to fix segfault on startup under certain
    conditions, closes: #639568
  * add a NEWS entry regarding the secure_path change made in 1.8.2-1,
    closes: #639336

 -- Bdale Garbee <bdale@gag.com>  Mon, 26 Sep 2011 21:55:56 -0600

sudo (1.8.2-1) unstable; urgency=low

  * new upstream version, closes: #637449, #621830
  * include common-session in pam config, closes: #519700, #607199
  * move secure_path from configure to default sudoers, closes: #85123, 85917
  * improve sudoers self-documentation, closes: #613639
  * drop --disable-setresuid since modern systems should not run 2.2 kernels
  * lose the --with-devel configure option since it's breaking builds in
    subdirectories for some reason

 -- Bdale Garbee <bdale@gag.com>  Wed, 24 Aug 2011 13:33:11 -0600

sudo (1.7.4p6-1ubuntu2) oneiric; urgency=low

  * debian/patches/enable_badpass.patch: turn on "mail_badpass" by default:
    - attempting sudo without knowing a login password is as bad as not
      being listed in the sudoers file, especially if getting the password
      wrong means doing the access-check-email-notification never happens
      (Closes: 641218).

 -- Kees Cook <kees@ubuntu.com>  Sun, 11 Sep 2011 10:29:08 -0700

sudo (1.7.4p6-1ubuntu1) oneiric; urgency=low

  * Merge from debian/unstable, remaining changes:
    - debian/patches/keep_home_by_default.patch:
      + Set HOME in initial_keepenv_table.
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets (Ubuntu specific)
      + install man/man8/sudo_root.8 (Ubuntu specific)
      + install apport hooks
    - debian/sudoers:
      + grant admin group sudo access
    - debian/sudo-ldap.dirs, debian/sudo.dirs:
      + add usr/share/apport/package-hooks
  * drop debian/patches/CVE-2011-0010.patch, applied upstream now

 -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 23 May 2011 09:50:37 +0200

sudo (1.7.4p6-1) unstable; urgency=low

  * new upstream version
  * touch the right stamp name after configuring, closes: #611287
  * patch from Svante Signell to fix build problem on Hurd, closes: #611290

 -- Bdale Garbee <bdale@gag.com>  Wed, 09 Feb 2011 11:32:58 -0700

sudo (1.7.4p4-6) unstable; urgency=low

  * update /etc/sudoers.d/README now that sudoers is a conffile
  * patch from upstream to fix special case in password checking code
    when only the gid is changing, closes: #609641

 -- Bdale Garbee <bdale@gag.com>  Tue, 11 Jan 2011 10:22:39 -0700

sudo (1.7.4p4-5ubuntu8) oneiric; urgency=low

  * debian/sudo.preinst:
    - if well-known ec2 vmbuilder file is found, write a file in
      sudoers.d for the 'ubuntu' user (LP: #768625)

 -- Scott Moser <smoser@ubuntu.com>  Thu, 21 Apr 2011 18:04:34 -0400

sudo (1.7.4p4-5ubuntu7) natty; urgency=low

  * debian/sudo.preinst:
    - do not consider the ec2 vmbuilder default sudoers file
      verbatim as its actually customized (LP: #761689)

 -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 15 Apr 2011 16:40:10 +0200

sudo (1.7.4p4-5ubuntu6) natty; urgency=low

  * debian/patches/keep_home_by_default.patch: Set HOME in
    initial_keepenv_table.  LP: #760140

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 13 Apr 2011 12:32:25 -0700

sudo (1.7.4p4-5ubuntu5) natty; urgency=low

  * debian/sudo.preinst:
    - avoid conffile prompt by checking for known default /etc/sudoers
      and if found installing the correct default /etc/sudoers file
      (LP: #690873)

 -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 25 Mar 2011 09:13:43 +0100

sudo (1.7.4p4-5ubuntu4) natty; urgency=low

  * debian/rules: The ubuntu-sudo-as-admin-successful.patch was taken
    upstream by Debian however it requires a --enable-admin-flag configure
    flag to actually enable it.
    (LP: #706045)

 -- Bryce Harrington <bryce@ubuntu.com>  Thu, 10 Feb 2011 12:01:53 -0800

sudo (1.7.4p4-5ubuntu3) natty; urgency=low

  * SECURITY UPDATE: privilege escalation via -g when using group Runas_List
    - debian/patches/CVE-2011-0010.patch: prompt for password when the user is
      running sudo as himself but as a different group
    - CVE-2011-0010

 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 18 Jan 2011 16:37:09 -0600

sudo (1.7.4p4-5ubuntu2) natty; urgency=low

  * debian/sudoers: temporarily workaround LP #690873 by adding %admin
    into the default sudoers file in case people just say "yes" to the
    dpkg conffile prompt.

 -- Kees Cook <kees@ubuntu.com>  Wed, 15 Dec 2010 15:38:17 -0800

sudo (1.7.4p4-5ubuntu1) natty; urgency=low

  * Merge from debian unstable (LP: #689025), remaining changes:
    - debian/rules:
      + compile with --without-lecture --with-tty-tickets (Ubuntu specific)
      + install man/man8/sudo_root.8 (Ubuntu specific)
      + install apport hooks
    - debian/sudo-ldap.dirs, debian/sudo.dirs: add
      usr/share/apport/package-hooks
  * This upload also fixes: LP: #609645

 -- Lorenzo De Liso <blackz@ubuntu.com>  Wed, 15 Dec 2010 21:32:57 +0100

sudo (1.7.4p4-5) unstable; urgency=low

  * patch from Jakub Wilk to add noopt and nostrip build option support,
    closes: #605580
  * make sudoers a conffile, closes: #605130
  * add descriptions to LSB init headers, closes: #604619
  * change default sudoers %sudo entry to allow gid changes, closes: #602699
  * add Vcs entries to the control file
  * use debhelper install files instead of explicit installs in rules

 -- Bdale Garbee <bdale@gag.com>  Wed, 01 Dec 2010 20:32:31 -0700

sudo (1.7.4p4-4) unstable; urgency=low

  * patch from upstream to resolve problem always prompting for a password
    when run without a tty, closes: #599376
  * patch from upstream to resolve interoperability problem between HOME in
    env_keep and the -H flag, closes: #596493
  * change path syntax to avoid tar error when /var/run/sudo exists but is
    empty, closes: #598877

 -- Bdale Garbee <bdale@gag.com>  Thu, 07 Oct 2010 15:59:06 -0600

sudo (1.7.4p4-3) unstable; urgency=low

  * make postinst clause for handling /var/run -> /var/lib transition less
    fragile, closes: #585514
  * cope with upstream's Makefile trying to install ChangeLog in our doc
    directory, closes: #597389
  * fix README.Debian to reflect that HOME is no longer preserved by default,
    closes: #596847

 -- Bdale Garbee <bdale@gag.com>  Tue, 21 Sep 2010 23:53:08 -0600

sudo (1.7.4p4-2) unstable; urgency=low

  * add a NEWS item about change in $HOME handling that impacts programs
    like pbuilder

 -- Bdale Garbee <bdale@gag.com>  Wed, 08 Sep 2010 14:29:16 -0600

sudo (1.7.4p4-1) unstable; urgency=high

  * new upstream version, urgency high due to fix for flaw in Runas group
    matching (CVE-2010-2956), closes: #595935
  * handle transition of /var/run/sudo to /var/lib/sudo better, to avoid
    re-lecturing existing users, and to clean up after ourselves on upgrade,
    and remove the RAMRUN section from README.Debian since the new state dir
    should fix the original problem, closes: #585514
  * deliver README.Debian to both package flavors, closes: #593579

 -- Bdale Garbee <bdale@gag.com>  Tue, 07 Sep 2010 12:22:42 -0600

sudo (1.7.2p7-1ubuntu3) natty; urgency=low

  * No-change upload to drop sizable upstream changelog.

 -- Martin Pitt <martin.pitt@ubuntu.com>  Mon, 22 Nov 2010 11:24:33 +0100

sudo (1.7.2p7-1ubuntu2) maverick; urgency=low

  * SECURITY UPDATE: privilege escalation via '-g' option when using
    'user:group' in Runas_Spec
    - debian/patches/CVE-2010-2956.patch: update match.c to verify both user
      and group match sudoers when using '-g'
    - CVE-2010-2956

 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 31 Aug 2010 14:54:06 -0500

sudo (1.7.2p7-1ubuntu1) maverick; urgency=low

  * Merge from debian unstable.  Remaining changes:
   - debian/rules:
     - compile with --without-lecture --with-tty-tickets (Ubuntu specific)
     - install man/man8/sudo_root.8 (Ubuntu specific)
     - install apport hooks
   - debian/sudo-ldap.dirs, debian/sudo.dirs: add
     usr/share/apport/package-hooks
   - debian/patches/ubuntu-sudo-as-admin-successful.patch: adjust sudo.c so
     that if the user successfully authenticated and he is in the 'admin'
     group, then create a stamp ~/.sudo_as_admin_successful. Our default bash
     profile checks for this and displays a short intro about sudo if the flag
     is not present
  * Dropped the following, now included upstream:
    - fix for CVE-2010-1163
    - fix for CVE-2010-0426
    - debian/sudo.postinst, debian/sudo-ldap.postinst: update description to
      match behavior in sudoers file
    - don't install init script. Debian moved to /var/lib/sudo from
      /var/run/sudo, so Ubuntu's tmpfs usage won't clean those out
      automatically any more, so we now need the initscript.

 -- Jamie Strandboge <jamie@ubuntu.com>  Tue, 06 Jul 2010 11:43:05 -0500

sudo (1.7.2p7-1) unstable; urgency=high

  * new upstream release with security fix for secure path (CVE-2010-1646),
    closes: #585394
  * move timestamps from /var/run/sudo to /var/lib/sudo, so that the state
    about whether to give the lecture is preserved across reboots even when
    RAMRUN is set, closes: #581393
  * add a note to README.Debian about LDAP needing an entry in
    /etc/nsswitch.conf, closes: #522065
  * add a note to README.Debian about how to turn off lectures if using
    RAMRUN in /etc/default/rcS, closes: #581393

 -- Bdale Garbee <bdale@gag.com>  Thu, 10 Jun 2010 15:42:14 -0600

sudo (1.7.2p6-1) unstable; urgency=low

  * new upstream version fixing CVE-2010-1163, closes: #578275, #570737

 -- Bdale Garbee <bdale@gag.com>  Mon, 19 Apr 2010 10:45:47 -0600

sudo (1.7.2p5-1) unstable; urgency=low

  * new upstream release, closes a bug filed upstream regarding missing man
    page processing scripts in the 1.7.2p1 tarball, also includes the fix
    for CVE-2010-0426 previously the subject of a security team nmu
  * move to source format 3.0 (quilt) and restructure changes as patches
  * fix unprocessed substitution variables in man pages, closes: #557204
  * apply patch from Neil Moore to fix Debian-specific content in the
    visudo man page, closes: #555013
  * update descriptions to better explain sudo-ldap, closes: #573108
  * eliminate spurious 'and' in man page, closes: #571620
  * fix confusing text in default sudoers, closes: #566607

 -- Bdale Garbee <bdale@gag.com>  Thu, 11 Mar 2010 15:44:53 -0700

sudo (1.7.2p1-1ubuntu5) lucid; urgency=low

  * SECURITY UPDATE: properly verify path in find_path.c for the 'sudoedit'
    pseudo-command when running from the current working directory and
    secure_path is disabled
    - CVE-2010-XXXX

 -- Jamie Strandboge <jamie@ubuntu.com>  Wed, 07 Apr 2010 15:35:36 -0500

sudo (1.7.2p1-1ubuntu4) lucid; urgency=low

  * env.c: Revert addition of "http_proxy" again. This was an Ubuntu specific
    EBW hack, caused inconsistencies with other proxy variables (such as
    https_proxy and ftp_proxy), made sudo incompatible to upstream
    behaviour/documentation. This is solved in a much better way in apt itself
    and gnome-network-properties now. (LP: #432631)

 -- Martin Pitt <martin.pitt@ubuntu.com>  Fri, 26 Mar 2010 18:48:18 +0100

sudo (1.7.2p1-1ubuntu3) lucid; urgency=low

  * debian/sudo.postinst, debian/sudo-ldap.postinst: update description to
    match behaviour in sudoers file. (LP: #534090)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sun, 07 Mar 2010 19:49:39 -0500

sudo (1.7.2p1-1ubuntu2) lucid; urgency=low

  * SECURITY UPDATE: properly verify path for the 'sudoedit' pseudo-command
    in match.c
    - http://sudo.ws/repos/sudo/rev/88f3181692fe
    - CVE-2010-0426

 -- Jamie Strandboge <jamie@ubuntu.com>  Wed, 24 Feb 2010 16:50:11 -0600

sudo (1.7.2p1-1ubuntu1) lucid; urgency=low

  * Merge from debian testing.  Remaining changes:
   - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu
     specific)
   - Add debian/sudo_root.8: Explanation of root handling through sudo.
     Install it in debian/rules. (Ubuntu specific)
   - sudo.c: If the user successfully authenticated and he is in the 'admin'
     group, then create a stamp ~/.sudo_as_admin_successful. Our default bash
     profile checks for this and displays a short intro about sudo if the
     flag is not present. (Ubuntu specific)
   - env.c: Add "http_proxy" to initial_keepenv_table, so that it is kept
     for "sudo apt-get ...". (Ubuntu specific EBW hack, should disappear at
     some point)
   - debian/{rules,postinst,sudo-ldap.postinst}: Disable init script
     installation. Debian reintroduced it because /var/run tmpfs is not the
     default there, but has been on Ubuntu for ages.
   - debian/{source_sudo.py,rules,sudo-ldap.dirs,sudo.dirs}: Add apport hook

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 08 Feb 2010 18:47:06 -0500

sudo (1.7.2p1-1) unstable; urgency=low

  * new upstream version
  * add support for /etc/sudoers.d using #includedir in default sudoers,
    which I think is also a good solution to the request for a crontab-like
    API requested in March of 2001, closes: #539994, #271813, #89743
  * move init.d script from using rcS.d to rc[0-6].d, closes: #542924

 -- Bdale Garbee <bdale@gag.com>  Mon, 31 Aug 2009 14:09:32 -0600

sudo (1.7.2-2) unstable; urgency=low

  * further improve initial sudoers to not include the NOPASSWD option on
    the group sudo exception, closes: #539136, #198991

 -- Bdale Garbee <bdale@gag.com>  Wed, 29 Jul 2009 16:21:04 +0200

sudo (1.7.2-1) unstable; urgency=low

  * new upstream version, closes: #537103
  * improve initial sudoers by having the exemption for users in group
    sudo on by default, and including the ability to run any command as
    any user.  This makes the default install roughly equivalent to our
    old use of the --with-exempt=sudo build option, closes: #536220, #536222

 -- Bdale Garbee <bdale@gag.com>  Wed, 15 Jul 2009 01:29:46 -0600

sudo (1.7.0-1ubuntu3) lucid; urgency=low

  * debian/{source_sudo.py,rules}: Add apport hook

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 29 Jan 2010 09:31:00 -0500

sudo (1.7.0-1ubuntu2) karmic; urgency=low

  * env.c: add logic similar to pam_env's stripping of single and double
    quotes around /etc/environment env vars; fixes literal quotes in LANG when
    using sudo -i; LP: #387262.

 -- Loïc Minier <loic.minier@ubuntu.com>  Mon, 22 Jun 2009 18:03:45 +0200

sudo (1.7.0-1ubuntu1) karmic; urgency=low

  * Merge from debian unstable, remaining changes:
   - debian/rules: Disable lecture, enable tty_tickets by default. (Ubuntu
     specific)
   - Add debian/sudo_root.8: Explanation of root handling through sudo.
     Install it in debian/rules. (Ubuntu specific)
   - sudo.c: If the user successfully authenticated and he is in the 'admin'
     group, then create a stamp ~/.sudo_as_admin_successful. Our default bash
     profile checks for this and displays a short intro about sudo if the
     flag is not present. (Ubuntu specific)
   - env.c: Add "http_proxy" to initial_keepenv_table, so that it is kept
     for "sudo apt-get ...". (Ubuntu specific EBW hack, should disappear at
     some point)
   - debian/{rules,postinst,sudo-ldap.postinst}: Disable init script
     installation. Debian reintroduced it because /var/run tmpfs is not the
     default there, but has been on Ubuntu for ages.

 -- Martin Pitt <martin.pitt@ubuntu.com>  Mon, 11 May 2009 18:07:03 +0200

sudo (1.7.0-1) unstable; urgency=low

  * new upstream version, closes: #510179, #128268, #520274, #508514
  * fix ldap config file path for sudo-ldap package, including creating
    a symlink in postinst and cleaning it up in postrm for the sudo-ldap
    package, closes: #430826
  * fix NOPASSWD entry location in default config file for the sudo-ldap
    instance too, closes: #479616

 -- Bdale Garbee <bdale@gag.com>  Sat, 28 Mar 2009 15:15:01 -0600

sudo (1.6.9p17-2) unstable; urgency=high

  * patch from upstream to fix privilege escalation with certain
    configurations, CVE-2009-0034
  * typo in sudoers man page, closes: #507163

 -- Bdale Garbee <bdale@gag.com>  Tue, 27 Jan 2009 11:49:02 -0700

sudo (1.6.9p17-1) unstable; urgency=low

  * new upstream version, closes: #481008
  * deliver schemas to doc directory in sudo-ldap package, closes: #474331
  * re-apply patch from Petter Reinholdtsen to improve init.d apparently lost
    in move from CVS to git for package management, closes: #475821
  * re-instate the init.d for the sudo-ldap package too... /o\

 -- Bdale Garbee <bdale@gag.com>  Sun, 06 Jul 2008 01:16:31 -0600

sudo (1.6.9p15-2) unstable; urgency=low

  * revert the fix for 388659 such that visudo once again defaults to using
    /usr/bin/editor.  I was always ambivalent about this change, it has caused
    more confusion and frustration than it cured, and I find Justin's line of
    reasoning persuasive.  Update the man page source to reflect this choice
    and the related use of --with-env-editor.  Closes: #474197.
  * patch from Petter Reinholdtsen to improve init.d, closes: #475821

 -- Bdale Garbee <bdale@gag.com>  Wed, 16 Apr 2008 00:38:56 -0600

sudo (1.6.9p15-1) unstable; urgency=low

  * new upstream version, closes: #467126, #473337
  * remove pointless postrm scripts, leaving debhelper do its thing if needed,
    thanks to Justin Pryzby for pointing this out
  * reinstate the init.d, since bootclean doesn't quite do what we want.  This
    also means we don't need the preinst scripts any more.  Update the lintian
    overrides since postinst is a Perl script lintian apparently isn't parsing
    well.  closes: #330868

 -- Bdale Garbee <bdale@gag.com>  Thu, 03 Apr 2008 14:25:56 -0600

sudo (1.6.9p12-1) unstable; urgency=low

  * new upstream version, closes: #464890

 -- Bdale Garbee <bdale@gag.com>  Tue, 19 Feb 2008 11:19:54 +0900

sudo (1.6.9p11-3) unstable; urgency=low

  * patch for configure to fix FTBFS on GNU/kFreeBSD, closes: #465956

 -- Bdale Garbee <bdale@gag.com>  Fri, 15 Feb 2008 10:54:21 -0700

sudo (1.6.9p11-2) unstable; urgency=low

  * update version compared in preinst when removing obsolete init.d,
    closes: #459681
  * implement pam session config suggestions from Elizabeth Fong,
    closes: #452457, #402329

 -- Bdale Garbee <bdale@gag.com>  Mon, 04 Feb 2008 21:26:23 -0700

sudo (1.6.9p11-1) unstable; urgency=low

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Fri, 11 Jan 2008 01:54:35 -0700

sudo (1.6.9p10-1) unstable; urgency=low

  * new upstream version
  * tweak default password prompt as %u doesn't make sense.  Accept patch from
    Patrick Schoenfeld (recommend upstream accept it too) that adds a %p and
    uses it by default, closes: #454409
  * accept patch from Martin Pitt that adds a prerm making it difficult to
    "accidentally" remove sudo when there is no root password set on the
    system, closes: #451241

 -- Bdale Garbee <bdale@gag.com>  Fri, 28 Dec 2007 11:44:30 -0700

sudo (1.6.9p9-1) unstable; urgency=low

  * new upstream version
  * debian/rules: configure a more informative default password prompt to
    reduce confusion when using sudo to invoke commands which also ask for
    passwords, closes: #343268
  * auth/pam.c: don't use the PAM prompt if the user explicitly requested
    a custom prompt, closes: #448628.
  * fix configure's ability to discover that libc has dirfd, closes: #451324
  * make default editor be /usr/bin/vi instead of /usr/bin/editor, so that
    the command 'visudo' invokes a vi variant by default as documented,
    closes: #388659

 -- Bdale Garbee <bdale@gag.com>  Mon, 03 Dec 2007 10:26:51 -0700

sudo (1.6.9p6-1) unstable; urgency=low

  * new upstream version, closes: #442815, #446146, #438699, #435768, #435314
    closes: #434832, #434608, #430382
  * eliminate the now-redundant init.d scripts, closes: #397090
  * fix typo in TROUBLESHOOTING file, closes: #439624

 -- Bdale Garbee <bdale@gag.com>  Wed, 24 Oct 2007 21:13:41 -0600

sudo (1.6.8p12-6) unstable; urgency=low

  * fix typos in visudo.pod relating to env_editor variable, closes: #418886
  * have init.d touch directories in /var/run/sudo, not just files, as a
    followup to #330868.
  * fix various typos in sudoers.pod, closes: #419749
  * don't let Makefile strip binaries, closes: #438073

 -- Bdale Garbee <bdale@gag.com>  Wed, 05 Sep 2007 11:26:58 +0100

sudo (1.6.8p12-5) unstable; urgency=low

  * update debian/copyright to reflect new upstream URL, closes: #368746
  * add sandwich cartoon URL to the README.Debian
  * don't remove sudoers on purge.  can cause problems when moving between
    sudo and sudo-ldap.  leaving sudoers around on purge seems like the least
    evil choice for now, closes: #401366
  * also preserve XAPPLRESDIR, XFILESEARCHPATH, and XUSERFILESEARCHPATH,
    closes: #374509
  * accept patch that improves debian/rules from Ted Percival, closes: #382122
  * no longer build with --with-exempt=sudo, provide an example entry in the
    default sudoers file instead, closes: #296605
  * add --with-devel to configure and augment build dependencies so that flex
    and yacc files get re-generated on every build, closes: #316249

 -- Bdale Garbee <bdale@gag.com>  Tue,  3 Apr 2007 21:48:45 -0600

sudo (1.6.8p12-4) unstable; urgency=low

  * patch from Petter Reinholdtsen for the LSB info block in the init.d
    script, closes: #361055
  * deliver sudoers sample again, closes: #361593

 -- Bdale Garbee <bdale@gag.com>  Sat, 15 Apr 2006 01:38:04 -0600

sudo (1.6.8p12-3) unstable; urgency=low

  * force-feed configure knowledge of nroff's path so we get unformatted man
    pages installed without build-depending on groff-base, closes: #360894
  * add a reference to OPTIONS in the man page, closes: #186226

 -- Bdale Garbee <bdale@gag.com>  Wed,  5 Apr 2006 17:53:13 -0700

sudo (1.6.8p12-2) unstable; urgency=low

  * fix typos in init scripts, closes: #346325
  * update to debhelper compat level 5
  * build depend on autotools-dev to ensure config.sub/guess are fresh
  * accept patch from Martin Schulze developed for 1.6.8p7-1.4 in stable, and
    use it here as well.  Thanks to Martin and the debian-security team.
    closes: #349196, #349549, #349587, #349729, #349129, #350776, #349085
    closes: #315115, #315718, #203874
    * Non-maintainer upload by the Security Team
    * Reworked the former patch to limit environment variables from being
      passed through, set env_reset as default instead [sudo.c, env.c,
      sudoers.pod, Bug#342948, CVE-2005-4158]
    * env_reset is now set by default
    * env_reset will preserve only HOME, LOGNAME, PATH, SHELL, TERM,
      DISPLAY, XAUTHORITY, XAUTHORIZATION, LANG, LANGUAGE, LC_*, and USER
      (in addition to the SUDO_* variables)
    * Rebuild sudoers.man.in from the POD file
    * Added README.Debian
  * patch from Alexander Zangerl to fix duplicated PATH issue, closes: #354431
  * simplify rules file by using more of Makefile, despite having to override
    default directories with more arguments to configure, closes: #292833
  * update sudo man page to reflect use of SECURE_PATH, closes: #228551
  * inconsistencies in sudoers man page resolved, closes: #220808, #161012
  * patch from Jeroen van Wolffelaar to improve behavior when FQDNs are
    unresolveable (requires adding bison as build dep), closes: #314949

 -- Bdale Garbee <bdale@gag.com>  Sun,  2 Apr 2006 14:26:20 -0700

sudo (1.6.8p12-1) unstable; urgency=low

  * new upstream version, closes: #342948 (CVE-2005-4158)
  * add env_reset to the sudoers file we create if none already exists,
    as a further precaution in response to discussion about CVS-2005-4158
  * split ldap support into a new sudo-ldap package.  I was trying to avoid
    doing this, but the impact of going from 4 to 17 linked shlibs on the
    autobuilder chroots is sufficient motivation for me.
    closes: #344034

 -- Bdale Garbee <bdale@gag.com>  Wed, 28 Dec 2005 13:49:10 -0700

sudo (1.6.8p9-4) unstable; urgency=low

  * enable ldap support, deliver README.LDAP and sudoers2ldif, closes: #283231
  * merge patch from Martin Pitt / Ubuntu to be more robust about resetting
    timestamps in the init.d script, closes: #330868
  * add dependency header to init.d script, closes: #332849

 -- Bdale Garbee <bdale@gag.com>  Sat, 10 Dec 2005 07:47:07 -0800

sudo (1.6.8p9-3) unstable; urgency=high

  * update debhelper compatibility level from 2 to 4
  * add man page symlink for sudoedit
  * Clean SHELLOPTS and PS4 from the environment before executing programs
    with sudo permissions [env.c, CAN-2005-2959]
  * fix typo in manpage pointed out by Moray Allen, closes: #285995
  * fix paths in sample complex sudoers file, closes: #303542
  * fix type in sudoers man page, closes: #311244

 -- Bdale Garbee <bdale@gag.com>  Wed, 28 Sep 2005 01:18:04 -0600

sudo (1.6.8p9-2) unstable; urgency=high

  * merge the NMU fix for sudoedit symlink problem that was in 1.6.8p7-1.1,
    closes: #305735

 -- Bdale Garbee <bdale@gag.com>  Tue, 28 Jun 2005 16:18:47 -0400

sudo (1.6.8p9-1) unstable; urgency=high

  * new upstream version, fixes a race condition in sudo's pathname
    validation, which is a security issue (CAN-2005-1993),
    closes: #315115, #315718

 -- Bdale Garbee <bdale@gag.com>  Tue, 28 Jun 2005 15:33:11 -0400

sudo (1.6.8p7-1) unstable; urgency=low

  * new upstream version, closes: #299585
  * update lintian overrides to squelch the postinst warning
  * change sudoedit from a hard to a soft link, closes: #296896
  * fix regex doc in sudoers man page, closes: #300361

 -- Bdale Garbee <bdale@gag.com>  Sat, 26 Mar 2005 22:18:34 -0700

sudo (1.6.8p5-1) unstable; urgency=high

  * new upstream version
  * restores ability to use config tuples without a value, which was causing
    problems on upgrade closes: #283306
  * deliver sudoedit, closes: #283078
  * marking urgency high since 283306 is a serious upgrade incompatibility

 -- Bdale Garbee <bdale@gag.com>  Fri,  3 Dec 2004 10:11:16 -0700

sudo (1.6.8p3-2) unstable; urgency=high

  * update pam.d deliverable so ldap works again, closes: #282191

 -- Bdale Garbee <bdale@gag.com>  Mon, 22 Nov 2004 11:44:46 -0700

sudo (1.6.8p3-1) unstable; urgency=high

  * new upstream version, fixes a flaw in sudo's environment sanitizing that
    could allow a malicious user with permission to run a shell script that
    utilized the bash shell to run arbitrary commands, closes: #281665
  * patch the sample sudoers to have the proper path for kill on Debian
    systems, closes: #263486
  * patch the sudo manpage to reflect Debian's choice of exempt_group
    default setting, closes: #236465
  * patch the sudo manpage to reflect Debian's choice of no timeout on the
    password prompt, closes: #271194

 -- Bdale Garbee <bdale@gag.com>  Tue, 16 Nov 2004 23:23:41 -0700

sudo (1.6.7p5-2) unstable; urgency=low

  * Jeff Bailey reports that seteuid works on current sparc systems, so we
    no longer need the "grosshack" stuff in the sudo rules file
  * add a postrm that removes /etc/sudoers on purge.  don't do this with the
    normal conffile mechanism since it would generate noise on every upgrade,
    closes: #245405

 -- Bdale Garbee <bdale@gag.com>  Tue, 20 Jul 2004 12:29:48 -0400

sudo (1.6.7p5-1) unstable; urgency=low

  * new upstream version, closes: #190265, #193222, #197244
  * change from '.' to ':' in postinst chown call, closes: #208369

 -- Bdale Garbee <bdale@gag.com>  Tue,  2 Sep 2003 21:27:06 -0600

sudo (1.6.7p3-2) unstable; urgency=low

  * add --disable-setresuid to configure call since 2.2 kernels don't support
    setresgid, closes: #189044
  * cosmetic cleanups to debian/rules as long as I'm there

 -- Bdale Garbee <bdale@gag.com>  Tue, 15 Apr 2003 16:04:48 -0600

sudo (1.6.7p3-1) unstable; urgency=low

  * new upstream version
  * add overrides to quiet lintian about things it doesn't understand,
    except the source one that can't be overridden until 129510 is fixed

 -- Bdale Garbee <bdale@gag.com>  Mon,  7 Apr 2003 17:34:05 -0600

sudo (1.6.6-3) unstable; urgency=low

  * add code to rules file to update config.sub/guess, closes: #164501

 -- Bdale Garbee <bdale@gag.com>  Sat, 12 Oct 2002 15:35:22 -0600

sudo (1.6.6-2) unstable; urgency=low

  * adopt suggestion from Marcus Brinkmann to feed --with-sendmail option to
    configure, and lose the build dependency on mail-transport-agent
  * incorporate changes from LaMont's NMU, closes: #144665, #144737
  * update init.d to not try and set time on nonexistent timestamp files,
    closes: #132616
  * build with --with-all-insults, admin must edit sudoers to turn insults
    on at runtime if desired, closes: #135374
  * stop setting /usr/doc symlink in postinst

 -- Bdale Garbee <bdale@gag.com>  Sat, 12 Oct 2002 01:54:24 -0600

sudo (1.6.6-1.1) unstable; urgency=high

  * NMU - patch from Colin Watson <cjwatson@debian.org>, in bts.
  * Revert patch to auth/pam.c that left pass uninitialized, causing a
    segfault (Closes: #144665).

 -- LaMont Jones <lamont@debian.org>  Fri, 26 Apr 2002 22:36:04 -0600

sudo (1.6.6-1) unstable; urgency=high

  * new upstream version, fixes security problem with crafty prompts,
    closes: #144540

 -- Bdale Garbee <bdale@gag.com>  Thu, 25 Apr 2002 12:45:49 -0600

sudo (1.6.5p1-4) unstable; urgency=high

  * apply patch for auth/pam.c to fix yet another way to make sudo segfault
    if ctrl/C'ed at password prompt, closes: #131235

 -- Bdale Garbee <bdale@gag.com>  Sun,  3 Mar 2002 23:18:56 -0700

sudo (1.6.5p1-3) unstable; urgency=high

  * ugly hack to add --disable-saved-ids when building on sparc in response
    to 131592, which will be reassigned to glibc for a real fix
  * urgency high since the sudo currently in testing for sparc is worthless

 -- Bdale Garbee <bdale@gag.com>  Sun, 17 Feb 2002 22:42:10 -0700

sudo (1.6.5p1-2) unstable; urgency=high

  * patch from upstream to fix seg faults caused by versions of pam that
    follow a NULL pointer, closes: #129512

 -- Bdale Garbee <bdale@gag.com>  Tue, 22 Jan 2002 01:50:13 -0700

sudo (1.6.5p1-1) unstable; urgency=high

  * new upstream version
  * add --disable-root-mailer option supported by new version to configure
    call in rules file, closes: #129648

 -- Bdale Garbee <bdale@gag.com>  Fri, 18 Jan 2002 11:29:37 -0700

sudo (1.6.4p1-1) unstable; urgency=high

  * new upstream version, with fix for segfaulting problem in 1.6.4

 -- Bdale Garbee <bdale@gag.com>  Mon, 14 Jan 2002 20:09:46 -0700

sudo (1.6.4-1) unstable; urgency=high

  * new upstream version, includes an important security fix, closes: #127576

 -- Bdale Garbee <bdale@gag.com>  Mon, 14 Jan 2002 09:35:48 -0700

sudo (1.6.3p7-5) unstable; urgency=low

  * only touch /var/run/sudo/* if /var/run/sudo is there, closes: #126872
  * fix spelling error in init.d, closes: #126847

 -- Bdale Garbee <bdale@gag.com>  Sat, 29 Dec 2001 11:21:43 -0700

sudo (1.6.3p7-4) unstable; urgency=medium

  * use touch to set status files to an ancient date instead of removing them
    outright on reboot.  this achieves the desired effect of keeping elevated
    privs from living across reboots, without forcing everyone to see the
    new-sudo-user lecture after every reboot.  pick a time that's 'old enough'
    for systems with good clocks, and 'recent enough' that broken PC hardware
    setting the clock to commonly-seen bogus dates trips over the "don't trust
    future timestamps" rule.  closes: #76529, #123559
  * apply patch from Steve Langasek to fix seg faults due to interaction with
    PAM code.  upstream confirms the problem, and says they're fixing this
    differently for their next release... but this should be useful in the
    meantime, and would be good to get into woody.  closes: #119147
  * only run the init.d at boot, not on each runlevel change... and don't run
    it during package configure.  closes: #125935
  * add DEB_BUILD_OPTIONS support to rules file, closes: #94952

 -- Bdale Garbee <bdale@gag.com>  Wed, 26 Dec 2001 12:40:44 -0700

sudo (1.6.3p7-3) unstable; urgency=low

  * apply patch from Fumitoshi UKAI that fixes segfaults when hostname not
    resolvable, closes: #86062, #69430, #77852, #82744, #55716, #56718,
  * fix a typo in the manpage, closes: #97368
  * apply patch to configure.in and run autoconf to fix problem building on
    the hurd, closes: #96325
  * add an init.d to clean out /var/run/sudo at boot, so privs are guaranteed
    to not last across reboots, closes: #76529
  * clean up lintian-noticed cosmetic packaging issues

 -- Bdale Garbee <bdale@gag.com>  Sat,  1 Dec 2001 02:59:52 -0700

sudo (1.6.3p7-2) unstable; urgency=low

  * update config.sub/guess for hppa support

 -- Bdale Garbee <bdale@gag.com>  Sun, 22 Apr 2001 23:23:42 -0600

sudo (1.6.3p7-1) unstable; urgency=low

  * new upstream version
  * add build dependency on mail-transport-agent, closes: #90685

 -- Bdale Garbee <bdale@gag.com>  Thu, 12 Apr 2001 17:02:42 -0600

sudo (1.6.3p6-1) unstable; urgency=high

  * new upstream version, fixes buffer overflow problem,
    closes: #87259, #87278, #87263
  * revert to using --with-secure-path option at build time, since the option
    available in sudoers is parsed too late to be useful, and upstream says
    it won't get fixed quickly.  This reopens 85123, which I will mark as
    forwarded.  Closes: #86199, #86117, #85676

 -- Bdale Garbee <bdale@gag.com>  Mon, 26 Feb 2001 11:02:51 -0700

sudo (1.6.3p5-2) unstable; urgency=low

  * lose the dh_suidregister call since it's obsolete
  * stop using the --with-secure-path option at build time, and instead show
    how to set it in sudoers.  Closes: #85123
  * freshen config.sub and config.guess for ia64 and hppa
  * update sudoers man page to indicate exempt_group is on by default,
    closes: #70847

 -- Bdale Garbee <bdale@gag.com>  Sat, 10 Feb 2001 02:05:17 -0700

sudo (1.6.3p5-1) unstable; urgency=low

  * new upstream version, closes: #63940, #59175, #61817, #64652, #65743
  * this version restores core dumps before the exec, while leaving them
    disabled during sudo's internal execution, closes: #58289
  * update debhelper calls in rules file

 -- Bdale Garbee <bdale@gag.com>  Wed, 16 Aug 2000 00:13:15 -0600

sudo (1.6.2p2-1) frozen unstable; urgency=medium

  * new upstream source resulting from direct collaboration with the upstream
    author to fix ugly pam-related problems on Debian in 1.6.1 and later.
    Closes: #56129, #55978, #55979, #56550, #56772
  * include more upstream documentation, closes: #55054
  * pam.d fragment update, closes: #56129

 -- Bdale Garbee <bdale@gag.com>  Sun, 27 Feb 2000 11:48:48 -0700

sudo (1.6.1-1) unstable; urgency=low

  * new upstream source, closes: #52750

 -- Bdale Garbee <bdale@gag.com>  Fri,  7 Jan 2000 21:01:42 -0700

sudo (1.6-2) unstable; urgency=low

  * drop suidregister support for this package.  The sudo executable is
    essentially worthless unless it is setuid root, and making suidregister
    work involves shipping a non-setuid executable in the .deb and setting the
    perms in the postinst.  On a long upgrade run, this can leave the sudo
    executable 'broken' for a long time, which is unacceptable.  With this
    version, we ship the executable setuid root in the .deb.  Closes: #51742

 -- Bdale Garbee <bdale@gag.com>  Wed,  1 Dec 1999 19:59:44 -0700

sudo (1.6-1) unstable; urgency=low

  * new upstream version, many options previously set at compile-time are now
    configurable at runtime.
    Closes: #39255, #20996, #29812, #50705, #49148, #48435, #47190, #45639
  * FHS support

 -- Bdale Garbee <bdale@gag.com>  Tue, 23 Nov 1999 16:51:22 -0700

sudo (1.5.9p4-1) unstable; urgency=low

  * new upstream version, closes: #43464
  * empty password handling was fixed in 1.5.8, closes: #31863

 -- Bdale Garbee <bdale@gag.com>  Thu, 26 Aug 1999 00:00:57 -0600

sudo (1.5.9p1-1) unstable; urgency=low

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Thu, 15 Apr 1999 22:43:29 -0600

sudo (1.5.8p1-1) unstable; urgency=medium

  * new upstream version, closes 33690
  * add dependency on libpam-modules, closes 34215, 33432

 -- Bdale Garbee <bdale@gag.com>  Mon,  8 Mar 1999 10:27:42 -0700

sudo (1.5.7p4-2) unstable; urgency=medium

  * update the pam fragment provided so that sudo works with latest pam bits,
    closes 33432

 -- Bdale Garbee <bdale@gag.com>  Sun, 21 Feb 1999 00:22:44 -0700

sudo (1.5.7p4-1) unstable; urgency=low

  * new upstream release

 -- Bdale Garbee <bdale@gag.com>  Sun, 27 Dec 1998 16:13:53 -0700

sudo (1.5.6p5-1) unstable; urgency=low

  * new upstream patch release
  * add PAM support, closes 28594

 -- Bdale Garbee <bdale@gag.com>  Mon,  2 Nov 1998 00:00:24 -0700

sudo (1.5.6p2-2) unstable; urgency=low

  * update copyright file, closes 24136
  * review and close forwarded bugs believed fixed in this upstream version,
    closes 17606, 15786.

 -- Bdale Garbee <bdale@gag.com>  Mon,  5 Oct 1998 22:30:43 -0600

sudo (1.5.6p2-1) unstable; urgency=low

  * new upstream release

 -- Bdale Garbee <bdale@gag.com>  Mon,  5 Oct 1998 22:30:43 -0600

sudo (1.5.4-4) frozen unstable; urgency=low

  * update postinst to use groupadd, closes 21403
  * move the suidregister stuff earlier in postinst to ensure it always runs

 -- Bdale Garbee <bdale@gag.com>  Sun, 19 Apr 1998 22:07:45 -0600

sudo (1.5.4-3) frozen unstable; urgency=low

  * change /etc/sudoers from a conffile to being handled in postinst,
    closes 18219
  * add suidmanager support, closes 15711
  * add '-Wno-comment' to quiet warnings from gcc upstream maintainer is
    unlikely to ever fix, and which just don't matter.  closes 17146
  * fix FSF address in copyright file, and submit exception for lintian
    warning about sudo being setuid root

 -- Bdale Garbee <bdale@gag.com>  Thu,  9 Apr 1998 23:59:11 -0600

sudo (1.5.4-2) unstable; urgency=high

  * patch from upstream author correcting/improving security fix

 -- Bdale Garbee <bdale@gag.com>  Tue, 13 Jan 1998 10:39:35 -0700

sudo (1.5.4-1) unstable; urgency=high

  * new upstream version, includes a security fix
  * change default editor from /bin/ae to /usr/bin/editor

 -- Bdale Garbee <bdale@gag.com>  Mon, 12 Jan 1998 23:36:41 -0700

sudo (1.5.3-1) unstable; urgency=medium

  * new upstream version, closes bug 15911.
  * rules file reworked to use debhelper
  * implement a really gross hack to force use of the sudo-provided
    lsearch(), since the one in libc6 is broken!  This closes bugs
    12552, 12557, 14881, 15259, 15916.

 -- Bdale Garbee <bdale@gag.com>  Sat,  3 Jan 1998 20:39:23 -0700

sudo (1.5.2-6) unstable; urgency=LOW

  * don't install INSTALL in the doc directory, closes bug 13195.

 -- Bdale Garbee <bdale@gag.com>  Sun, 21 Sep 1997 17:10:40 -0600

sudo (1.5.2-5) unstable; urgency=LOW

  * libc6

 -- Bdale Garbee <bdale@gag.com>  Fri,  5 Sep 1997 00:06:22 -0600

sudo (1.5.2-4) unstable; urgency=LOW

  * change TIMEOUT (how long before you have to type your password again)
    to 15 mins, disable PASSWORD_TIMEOUT.  This makes building large Debian
    packages on slower machines much more tolerable.  Closes bug 9076.
  * touch debian/suid before debstd.  Closes bug 8709.

 -- Bdale Garbee <bdale@gag.com>  Sat, 26 Apr 1997 00:48:01 -0600

sudo (1.5.2-3) frozen unstable; urgency=LOW

  * patch from upstream maintainer to close Bug 6828
  * add a debian/suid file to get debstd to leave my perl postinst alone

 -- Bdale Garbee <bdale@gag.com>  Fri, 11 Apr 1997 23:09:55 -0600

sudo (1.5.2-2) frozen unstable; urgency=LOW

  * change rules to use -O2 -Wall as per standards

 -- Bdale Garbee <bdale@gag.com>  Sun, 6 Apr 1997 12:48:53 -0600

sudo (1.5.2-1) unstable; urgency=LOW

  * new upstream version
  * cosmetic changes to debian package control files

 -- Bdale Garbee <bdale@gag.com>  Wed, 30 Oct 1996 09:50:00 -0700

sudo (1.5-2) unstable; urgency=LOW

  * add /usr/X11R6/bin to the end of the secure path... this makes it
    much easier to run xmkmf, etc., during package builds.  To the extent
    that /usr/local/sbin and /usr/local/bin were already included, I see
    no security reasons not to add this.

 -- Bdale Garbee <bdale@gag.com>  Wed, 30 Oct 1996 09:44:58 -0700

sudo (1.5-1) unstable; urgency=LOW

  * New upstream version
  * New maintainer
  * New packaging format

 -- Bdale Garbee <bdale@gag.com>  Thu, 29 Aug 1996 11:44:22 +0200

Tue Mar  5 09:36:41 MET 1996 Michael Meskes <meskes@informatik.rwth-aachen.de>

        sudo (1.4.1-1):

        * hard code SECURE_PATH to:
		"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

	* enable ENV_EDITOR

	* enabled EXEMPTGROUP "sudo"

	* moved timestamp dir to /var/log/sudo

	* changed parser to check for long and short filenames (Bug#1162)

Wed Apr 17 13:03:31 MET DST 1996 Michael Meskes <meskes@informatik.rwth-aachen.de>

        sudo (1.4.2-1):

	* New upstream source

	* Fixed postinst script
		(thanks to Peter Tobis <tobias@et-inf.fho-emden.de>)

	* Removed special shadow binary. This version works with and without
	  shadow password file.

Mon May 20 09:35:22 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.2-2):

	* Corrected editor path to /bin/ae (Bug#3062)

	* Set file permission to 4755 for sudo and 755 for visudo (Bug#3063)

Mon Jun 17 12:06:41 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.3-1):

	* New upstream version

	* Changed sudoers permission to 440 (owner root, group root) to make
	  sudo usable via NFS

Wed Jun 19 10:56:54 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.3-2):

	* Applied upstream patch 1

Thu Jun 20 09:02:57 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.3-3):

        * Applied upstream patch 2

Fri Jun 28 12:49:40 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.3-4):

        * Applied upstream patch 3 (fixes problems with an NFS-mounted
          sudoers file)


Sun Jun 30 13:02:44 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.3-5):

	* Corrected postinst to use /usr/bin/perl instead of /bin/perl
	  [Reported by jdassen@wi.leidenuniv.nl (J.H.M.Dassen)]

Wed Jul 10 12:44:33 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.3-6):

	* Applied upstream patch 4 (fixes several bugs)

	* Changed priority to optional

Thu Jul 11 19:23:52 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.3-7):

	* Corrected postinst to create correct permission for /etc/sudoers
	  (Bug#3749)

Fri Aug  2 10:50:53 MET DST 1996 Michael Meskes <meskes@debian.org>

        sudo (1.4.4-1):

	* New upstream version


sudo (1.4.4-2) admin; urgency=HIGH

	* Fixed major security bug reported by Peter Tobias
	  <tobias@et-inf.fho-emden.de>
	* Added dchanges support to debian.rules

sudo (1.4.5-1) admin; urgency=LOW

	* New upstream version
	* Minor changes to debian.rules
