pound (4.23-2build1) stonking; urgency=medium

  * No-change rebuild against libssl4

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Fri, 24 Jul 2026 11:10:20 +0000

pound (4.23-2) unstable; urgency=low

  * Backport typo fixes

 -- Carsten Leonhardt <leo@debian.org>  Thu, 28 May 2026 10:49:37 +0200

pound (4.23-1) unstable; urgency=high

  * New upstream release
    - Contains an important bugfix: A bug in "SendFile" allowed for
      reading files outside of the configured directory.

 -- Carsten Leonhardt <leo@debian.org>  Tue, 26 May 2026 20:01:47 +0200

pound (4.22-2) unstable; urgency=medium

  * Backport testsuite fixes from upstream

 -- Carsten Leonhardt <leo@debian.org>  Sun, 19 Apr 2026 09:48:30 +0200

pound (4.22-1) unstable; urgency=medium

  * New upstream release
    - Adds support for lua
    - Includes Emacs-mode for the configuration file (for now installed in
      /usr/share/pound)
  * Complies with standards version 4.7.4 (removed Priority field)

 -- Carsten Leonhardt <leo@debian.org>  Wed, 08 Apr 2026 00:23:39 +0200

pound (4.17-1) unstable; urgency=medium

  * New upstream release
  * Add Build-Depends: libcrypt-dev (Closes: #1106922)

 -- Carsten Leonhardt <leo@debian.org>  Sun, 10 Aug 2025 09:11:32 +0200

pound (4.16-3) unstable; urgency=medium

  * Complies with standards version 4.7.2

 -- Carsten Leonhardt <leo@debian.org>  Thu, 13 Mar 2025 00:12:40 +0100

pound (4.16-2) unstable; urgency=medium

  * Update to upstream commit c320888be33d0c75d7ab9297ae9c7f95a8e6eaca /
    Wed Feb 19 09:11:19 2025 +0200.
    This includes a fix for building with gcc15. (Closes: #1097642)
  * Complies with standards version 4.7.1

 -- Carsten Leonhardt <leo@debian.org>  Wed, 26 Feb 2025 23:48:55 +0100

pound (4.16-1) unstable; urgency=medium

  * New upstream release

 -- Carsten Leonhardt <leo@debian.org>  Tue, 14 Jan 2025 23:48:31 +0100

pound (4.15-2) unstable; urgency=medium

  [ Carsten Leonhardt ]
  * Set upstream metadata fields: Bug-Database, Repository, Repository-Browse.

  [Helmut Grohne]
  * Stop using dh-sysuser. (Closes: #1092954)

 -- Carsten Leonhardt <leo@debian.org>  Tue, 14 Jan 2025 19:54:58 +0100

pound (4.15-1) unstable; urgency=medium

  * New upstream release

 -- Carsten Leonhardt <leo@debian.org>  Sun, 17 Nov 2024 16:59:18 +0100

pound (4.14-2) unstable; urgency=medium

  [ Sergey Poznyakoff ]
  * Disable tests with fakedns, as they don't work on all architectures

 -- Carsten Leonhardt <leo@debian.org>  Mon, 21 Oct 2024 22:37:49 +0200

pound (4.14-1) unstable; urgency=medium

  * New upstream release
  * Enable dynamic backends by build-depending on libadns1-dev

 -- Carsten Leonhardt <leo@debian.org>  Mon, 21 Oct 2024 12:47:53 +0200

pound (4.13-1) unstable; urgency=low

  * New upstream release
  * Drop all patches, as they were all backports from upstream

 -- Carsten Leonhardt <leo@debian.org>  Sat, 24 Aug 2024 14:02:20 +0200

pound (4.12-8) unstable; urgency=low

  * Update to upstream commit c2af1531b434b304a793fde75b21d4663e51b41c /
    Thu Aug 22 15:45:14 2024 +0300
    This includes a fix for the flaky autotests

 -- Carsten Leonhardt <leo@debian.org>  Thu, 22 Aug 2024 20:34:20 +0200

pound (4.12-7) unstable; urgency=low

  [ Sergey Poznyakoff ]
  * Try to fix flaky autotest #5

 -- Carsten Leonhardt <leo@debian.org>  Tue, 20 Aug 2024 13:51:57 +0200

pound (4.12-6) unstable; urgency=low

  [ Sergey Poznyakoff ]
  * Minor changes to the default pound.cfg

 -- Carsten Leonhardt <leo@debian.org>  Tue, 20 Aug 2024 02:17:32 +0200

pound (4.12-5) unstable; urgency=low

  * Update to upstream commit 6847767b7e2f466df854e262604e7ac367da8d54 /
    Sun Aug 18 13:47:49 2024 +0300
  * Switch back to libpcre2. Upstream implemented a thread-safe way to use
    it.

 -- Carsten Leonhardt <leo@debian.org>  Tue, 20 Aug 2024 01:20:23 +0200

pound (4.12-4) unstable; urgency=low

  * Update to upstream commit e1cbb2edef562c0dffd91fbf86bd3cecdf2cdb21 /
    Mon Aug 12 17:33:37 2024 +0300, with fixes for autotests
  * Switch to libpcre3. According to upstream, libpcre2 is not
    thread-safe.

 -- Carsten Leonhardt <leo@debian.org>  Tue, 13 Aug 2024 00:05:11 +0200

pound (4.12-3) unstable; urgency=low

  * Make failing autotests verbose
  * Fix usage of touch with seconds since epoch

 -- Carsten Leonhardt <leo@debian.org>  Sun, 11 Aug 2024 23:41:01 +0200

pound (4.12-2) unstable; urgency=low

  * Make builds reproducible

 -- Carsten Leonhardt <leo@debian.org>  Sun, 11 Aug 2024 14:50:07 +0200

pound (4.12-1) unstable; urgency=low

  * New upstream version and developer, continuing from the former 2.x
    branch. The rewritten pound 3.0 has been discontinued, most changes to
    the Debian package that happened in the 3.x branch have been reverted.
  * Include patches from upstream up to commit
    b52ccc62a807d64beb6f7b86cfb0c6f75674d8d2.

 -- Carsten Leonhardt <leo@debian.org>  Sun, 04 Aug 2024 19:23:42 +0200

pound (3.0.2-1) unstable; urgency=medium

  * New upstream version
  * Link to libpcre2

 -- Carsten Leonhardt <leo@debian.org>  Tue, 30 Nov 2021 12:50:25 +0100

pound (3.0.1-2) unstable; urgency=medium

  * Disable linking to the obsolete libpcre3 (pcreposix) (Closes: #999985)

 -- Carsten Leonhardt <leo@debian.org>  Tue, 23 Nov 2021 13:03:31 +0100

pound (3.0.1-1) unstable; urgency=medium

  * New upstream version
  * Complies with standards version 4.6.0

 -- Carsten Leonhardt <leo@debian.org>  Wed, 01 Sep 2021 01:02:05 +0200

pound (3.0-3) unstable; urgency=medium

  [ Helmut Grohne ]
  * Fix FTCBFS: Let dh_auto_configure pass cross flags to cmake.
    (Closes: #987285)

 -- Carsten Leonhardt <leo@debian.org>  Tue, 17 Aug 2021 17:38:58 +0200

pound (3.0-2) unstable; urgency=medium

  * Fix FTBFS on KFreeBSD
  * Complies with standards version 4.5.1
  * Update package description, http redirects aren't supported since the
    rewrite
  * Add some simple autopkgtests

 -- Carsten Leonhardt <leo@debian.org>  Thu, 10 Dec 2020 11:23:42 +0100

pound (3.0-1) unstable; urgency=medium

  [ Carsten Leonhardt ]
  * New upstream version
    As pound 3.0 was rewritten from scratch, also most Ubuntu bug reports
    no longer apply (LP: #1189764, LP: #1398007, LP: #1639888)
  * Upstream is out of beta, upload to unstable
  * Add debian/NEWS to inform about new configuration format and file name

  [ Debian Janitor ]
  * debian/copyright: use spaces rather than tabs to start continuation lines.
  * Remove obsolete fields Contact, Name from debian/upstream/metadata (already
    present in machine-readable debian/copyright).
  * Fix day-of-week for changelog entries 2.5-1.1, 2.4.3-1, 2.4.2-1, 2.4-2.

 -- Carsten Leonhardt <leo@debian.org>  Thu, 05 Nov 2020 01:45:01 +0100

pound (3.0~e-1) experimental; urgency=medium

  * Remove session timeout from default configuration, upstream fixed the
    bug this was a workaround for.
  * Add IPv6 listener to default configuration.

 -- Carsten Leonhardt <leo@debian.org>  Mon, 05 Oct 2020 21:10:50 +0200

pound (3.0~d-2) experimental; urgency=medium

  * Add a session timeout to default configuration to work around a bug in
    the upstream code
  * Change listening port to 8008 in default configuration, which
    hopefully is less used

 -- Carsten Leonhardt <leo@debian.org>  Tue, 29 Sep 2020 22:18:09 +0200

pound (3.0~d-1) experimental; urgency=medium

  * New experimental upstream version.
    Pound was completely rewritten, most bug reports no longer apply
    (Closes: #861089, #490192, #733820, #456667).
  * Update debian/watch file.
  * Adapt much of the packaging to the new version.
  * Complies with standards version 4.5.0
  * Raise debhelper compat level to 13
  * Run as user "_pound"

 -- Carsten Leonhardt <leo@debian.org>  Sun, 07 Jun 2020 23:21:44 +0200

pound (2.8-2) unstable; urgency=low

  * Upstream fixed CVE-2016-10711 in version 2.8a (Closes: #888786).
  * Instead of following Rick O'Sullivan's fork, keep changes to a
    minimum.
  * Support for OpenSSL 1.1 from Sergey Poznyakoff (Closes: #859557).
  * Version 2.8 made single line headers the default (Closes: #897042).
  * Update to standards version 4.4.0.
  * Update FAQ about virtual hosting with HTTPS (Closes: #697064).
  * Fix wrong use of fallback SCSV. Thanks to Frank Schmirler.

 -- Carsten Leonhardt <leo@debian.org>  Thu, 11 Jul 2019 00:13:59 +0200

pound (2.8-1+patrodyne20190113) experimental; urgency=medium

  * New maintainer.
  * New upstream version.
  * Reintroduce package after it got removed from testing (Closes: #921076).
  * Add upstream signing key and let uscan check it.
  * Converted some of the packages' history to git on salsa.
  * Follow Rick O'Sullivan's fork at https://github.com/patrodyne/pound
  * Add Gitlab CI tests
  * Raise debhelper compat level to 12
  * Updated to standards version 4.3.0

 -- Carsten Leonhardt <leo@debian.org>  Wed, 13 Feb 2019 14:03:54 +0100

pound (2.7-1.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Build it with libssl1.0-dev for Jessie (Closes: #828511).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Sun, 19 Feb 2017 15:13:02 +0100

pound (2.7-1.2) unstable; urgency=medium

  * Include .orig.tar.gz in upload.

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Sun, 31 Jul 2016 10:40:17 +0100

pound (2.7-1.1) unstable; urgency=medium

  * Fix failed binary only upload.

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Sun, 31 Jul 2016 10:32:40 +0100

pound (2.7-1) unstable; urgency=medium

  * New upstream release

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Sat, 30 Jul 2016 20:07:36 +0100

pound (2.6-6.1) unstable; urgency=medium

  [ Thijs Kinkhorst ]
  * Non-maintainer upload by the security team with maintainer approval.
  * Add missing part of anti_beast patch to fix disabling of client
    renegotiation. (Closes: #765649)

  [ Brett Parker ]
  * 2.7-1

 -- Thijs Kinkhorst <thijs@debian.org>  Tue, 05 May 2015 13:27:06 +0000

pound (2.6-6) unstable; urgency=low

  * Add options to disable SSLv2 and SSLv3.

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Mon, 20 Oct 2014 00:48:13 +0100

pound (2.6-5) unstable; urgency=low

  * Add MKCALENDAR support (Closes: #742488)
  * Check config file is valid for restart/force-restart (Closes: #747517)
  * Up max http size to 8k (Closes: #691941)

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Sun, 19 Oct 2014 22:31:00 +0100

pound (2.6-4) unstable; urgency=low

  * Add HTTP PATCH support
  * Add semaphore wait support (Closes: #737853)

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Mon, 03 Mar 2014 15:22:11 +0000

pound (2.6-3) unstable; urgency=low

  * New maintainer: Brett Parker <iDunno@sommitrealweird.co.uk>
  * Update xss_redirect_patch
    - Allow = character in urls (Closes: #723731)
  * Add patch from Joe Gooch <mrwizard@k12system.com> for CRIME vulnerability
    - tls_compression_disable.patch (Closes: #727197)

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Sun, 26 Jan 2014 12:40:27 +0000

pound (2.6-2) unstable; urgency=low

  * Update anti_beast patch
     - Actually authored by Joe Gooch <mrwizard@k12system.com>
     - Fix segfault on some systems
  * Added patch to fix XSS redirect vulnerability
    - Patch from Joe Gooch <mrwizard@k12system.com>
  * Switched to dpkg-buildflags (Closes: #654833)
     - Patch from Moritz Muehlenhoff <jmm@debian.org>

 -- Martin Meredith <mez@debian.org>  Fri, 03 Feb 2012 09:40:45 +0000

pound (2.6-1) unstable; urgency=low

  * New upstream release
  * Patch from Michal Jirku <box@wejn.org> to add config
    options that prevent BEAST/renegotiation attacks

 -- Martin Meredith <mez@debian.org>  Mon, 30 Jan 2012 10:21:52 +0000

pound (2.5-1.1) unstable; urgency=low

  * NMU
  * Apply patch to work with new openssl. Thanks to Ilya Barygin
    <barygin@gmail.com> for the patch. Closes: #622041
  * Add simple initial build-arch and build-indep rules as suggested by
    lintian

 -- Steve McIntyre <steve.mcintyre@linaro.org>  Mon, 12 Dec 2011 15:29:12 +0000

pound (2.5-1) unstable; urgency=low

  * New upstream release
  * Switch to dpkg-source 3.0 (quilt) format
  * Removed previous patch from #517359 - incorporated upstream
  * Added ${misc:Depends}
  * Added openssl as a B-D (New functionality to connect to SSL backends)

 -- Martin Meredith <mez@debian.org>  Wed, 10 Mar 2010 21:44:12 +0000

pound (2.4.5-3) unstable; urgency=low

  * Added functionality to init script to allow optional
    arguments (Closes: #449430)

 -- Martin Meredith <mez@debian.org>  Fri, 02 Oct 2009 13:30:36 +0100

pound (2.4.5-2) unstable; urgency=low

  * Fixed small typo in init script (Closes: #537602)

 -- Martin Meredith <mez@debian.org>  Mon, 27 Jul 2009 21:04:07 +0100

pound (2.4.5-1) unstable; urgency=low

  * New upstream release
  * Hijacked Package: New Maintainer (due to MIA)
  * Changed init script to create /var/run/pound
  * Upstream has fixed RewriteLocation Port issues (Closes: #525733)
  * Added patch to fix truncation issues (Closes: #517359)
  * Updated to standards version 3.8.2
  * Updated to debhelper 7
  * Added dpatch as B-D

 -- Martin Meredith <mez@debian.org>  Sun, 05 Jul 2009 16:11:36 +0100

pound (2.4.3-1) unstable; urgency=medium

  [Michael Mende]
  * New upstream release.

 -- Michael Mende <debian@menole.net>  Sun, 04 May 2008 13:11:21 +0200

pound (2.4.2-1) unstable; urgency=medium

  [Michael Mende]
  * New upstream release.
  * Added FAQ and CHANGELOG. (Closes: #472453)
  * debian/watch
    + Fixed regex.

 -- Michael Mende <debian@menole.net>  Mon, 28 Apr 2008 14:33:11 +0200

pound (2.4-2) unstable; urgency=medium

  [Michael Mende]
  * debian/control:
    + Removed libgoogle-perftools-dev from build-dependencies because
      libgoogle-perftools does not seem to enter testing soon.
  * debian/rules:
    + Syntax error in LDFLAGS on some architectures. (Closes: #469823)
    + CFLAGS on ARM without '-fstack-protector' due to segmentation faults.
    + Added 'noexecstack' to LDFLAGS.

 -- Michael Mende <debian@menole.net>  Fri, 07 Mar 2008 11:20:11 +0100

pound (2.4-1) unstable; urgency=medium

  [Michael Mende]
  * New upstream version (Closes: #432784).
  * Has now support for IPv6 (Closes: #360158).
  * debian/copyright
    + Moved license to GPLv3 (changed in upstream version 2.4d).
  * debian/rules:
    + '[ ! -f Makefile ] || $(MAKE) clean' instead of '-$(MAKE) distclean'
      (Closes: #424308).
    + Remove Makefile after make clean.
    + Added security hardening features.
  * debian/control:
    + Removed Sam Johnston from Maintainer: and Jörg Wendland from Uploaders:
      field (Closes: #465968).
    + Set myself as maintainer.
    + Bumped Standards-Version to 3.7.3.
    + Use debhelper 6 now.
    + Added Homepage field.
    + Added libgoogle-perftools-dev to build-dependencies for amd64, i386, ia64
      and powerpc.
    + Added libpcre3-dev to build-dependencies.
  * debian/dirs:
    + Added /var/run/pound for poundctl control socket.
  * debian/pound.cfg:
    + Added global option 'Control' to enable poundctl usage.
  * Added watch file debian/watch.

 -- Michael Mende <debian@menole.net>  Wed, 27 Feb 2008 11:31:12 +0100

pound (2.2.7-2) unstable; urgency=high

  * Urgency high: This supersedes 2.2.7-1 which closed #360842. That was a
    grave bug, as it rendered pound unusable, I just had not realized how bad
    it was.
  * Also fix init script: restart did not work (first start, then stop),
    status bailed if daemon not running

 -- Michael Piefel <piefel@debian.org>  Thu, 29 Mar 2007 13:43:55 +0200

pound (2.2.7-1) unstable; urgency=low

  * New upstream version (closes: #407183)
    - also this time the fix that was supposed to be included in the last
      upload is now in the upstream source (closes: #360842)
  * Update syntax of example config file (closes: #356466)
  * Make pound really use the specified CFLAGS (closes: #342080)
  * Update init.d script to be LSB-compliant
  * Bumped Standards-Version to 3.7.2
  * Use debhelper 5 now

 -- Michael Piefel <piefel@debian.org>  Wed, 28 Mar 2007 11:12:25 +0200

pound (2.0-1.1) unstable; urgency=low

  * Non-maintainer upload
  * apply patch fixsegfaults.patch to fix segmentation fault
    in worker (closes: #360842)

 -- Arthur de Jong <adejong@debian.org>  Mon, 25 Sep 2006 12:42:57 +0200

pound (2.0-1) unstable; urgency=low

  * New upstream release
  * New configuration file syntax
  * Listener-specific backends to eliminate need for multiple instances
  * New redirector backend
  * Secondary proarties (error messages, timeouts, etc.) now private to
    listeners.
  * HAport accepts an optional address
  * Added -V flag for version
  * Session tracking on a specific header

 -- Sam Johnston <samj@aos.net.au>  Thu,  2 Feb 2006 05:29:09 +1100

pound (1.9.4-1) unstable; urgency=low

  * New upstream release
  * Added LogFacility config file directive
  * HTTP Request Smuggling fix: first of Content-Length and
    Transfer-Encoding takes precedence

 -- Sam Johnston <samj@aos.net.au>  Fri, 21 Oct 2005 03:14:24 +1000

pound (1.9.3-1) unstable; urgency=low

  * New upstream release. Closes #326941, #331604, #333559, #320220, #263578.

 -- Sam Johnston <samj@aos.net.au>  Sun, 16 Oct 2005 08:02:40 +1000

pound (1.9-1) unstable; urgency=low

  * New upstream version, closes: #310646, #311548, #306649
  * Ack security NMU, the fix is included upstream, closes: #307852
  * Add myself to uploaders with ok from Sam.
  * Clean up debian/:
    - remove rules.old
    - remove bogus comments and commands from rules
    - remove config, debconf is not used
  * debian/init.d:
    - use pid file
    - remove commented lines

 -- Joerg Wendland <joergland@debian.org>  Mon, 11 Jul 2005 09:16:30 +0200

pound (1.8.2-1.1) unstable; urgency=high

  * Non-maintainer upload (tnx djpig).
  * CAN-2005-1391: Fix possible buffer overflow in the add_port
    function which could be triggered by a long Host: header
    from a remote host (Closes: #307852)

 -- Joey Hess <joeyh@debian.org>  Mon, 27 Jun 2005 14:13:42 -0400

pound (1.8.2-1) unstable; urgency=low

  * New upstream version, closes: #285357
    - This supposedly also fixes some SSL issues and closes 263578
  * Added myself to uploaders, I will try to look after the package as
    long as Sam is too busy.
  * Increased MAXBUF, closes: #293915

 -- Michael Piefel <piefel@debian.org>  Tue, 22 Mar 2005 09:45:58 +0100

pound (1.7-1) unstable; urgency=high

  * New upstream *SECURITY* release
  * Resolves bugtraq id 10267 (Input Validation Error)

 -- Sam Johnston <samj@aos.net.au>  Wed, 19 May 2004 09:09:39 +1000

pound (1.5-2) unstable; urgency=medium

  * Removed --pidfile argument to start-stop-daemon in init script.
    Closes: #222885.

 -- Sam Johnston <samj@aos.net.au>  Thu,  5 Feb 2004 01:50:07 +1100

pound (1.5-1) unstable; urgency=low

  * New upstream release
  * Changing priority from optional to extra.

 -- Sam Johnston <samj@aos.net.au>  Fri, 24 Oct 2003 17:13:59 +1000

pound (1.4-3) unstable; urgency=low

  * Changing priority back to optional while waiting for override update.

 -- Sam Johnston <samj@aos.net.au>  Mon, 13 Oct 2003 18:07:22 +1000

pound (1.4-2) unstable; urgency=low

  * New maintainer
  * Changing priority from optional to extra.

 -- Sam Johnston <samj@aos.net.au>  Mon, 13 Oct 2003 16:51:57 +1000

pound (1.4-1.1) unstable; urgency=low

  * Non-maintainer upload
  * Removes templates file as debconf is not used. Closes: #208064, #208392.
  * Adds init.d script. Closes: #207689.
  * Added version (0.9.7) for libssl-dev to resolve engine related compile
    errors.
  * Sets default config file location to /etc/pound/pound.cfg
  * Includes minimal example pound.cfg (courtesy gentoo-portage)
  * Fixed broken paths in manpage.
  * Adds /etc/default/pound file to prevent unconfigured startup.

 -- Sam Johnston <samj@aos.net.au>  Sat, 11 Oct 2003 14:12:13 +1000

pound (1.4-1) unstable; urgency=low

  * Initial release.

 -- Norbert Tretkowski <nobse@debian.org>  Sun, 03 Aug 2003 12:20:27 +0200
