php-phpseclib (2.0.30-2~deb10u4) buster-security; urgency=high

  * Non-maintainer upload by the ELTS team.
  * Add patch to fix for weird characters in subjaltname.
    (Fixes: CVE-2023-52892)
  * Add patch to make unpadding constant time.
    (Fixes: CVE-2026-32935)
  * Add patch to use constant time HMAC comparison in SSH2.
    (Fixes: CVE-2026-40194)
  * Add patch to reduce the length of supported OIDs in ASN1.
    (Fixes: CVE-2026-44167)
  * Add patch to add setURLFetchCallback() to mitigate AIA SSRF in X509.
    (Fixes: CVE-2026-55599)

 -- Utkarsh Gupta <utkarsh@debian.org>  Wed, 22 Jul 2026 22:12:27 +0530

php-phpseclib (2.0.30-2~deb10u3) buster-security; urgency=high

  * Non-maintainer upload by the LTS Security Team.
  * Fix CVE-2024-27354: An attacker can construct a malformed certificate
    containing an extremely large prime to cause a denial of service.
  * Fix CVE-2024-27355: When processing the ASN.1 object identifier of a
    certificate, a sub identifier may be provided that leads to a denial of
    service.

 -- Guilhem Moulin <guilhem@debian.org>  Tue, 05 Mar 2024 13:30:10 +0100

php-phpseclib (2.0.30-2~deb10u2) buster-security; urgency=high

  * Non-maintainer upload by the LTS Security Team.
  * Fix CVE-2023-48795 (terrapin attack): The SSH transport protocol with
    certain OpenSSH extensions allows remote attackers to bypass integrity
    checks such that some packets are omitted (from the extension negotiation
    message), and a client and server may consequently end up with a
    connection for which some security features have been downgraded or
    disabled, aka a Terrapin attack.

 -- Guilhem Moulin <guilhem@debian.org>  Thu, 25 Jan 2024 01:42:41 +0100

php-phpseclib (2.0.30-2~deb10u1) buster-security; urgency=high

  * Non-maintainer upload by the LTS Security Team.
  * Backport stable 2.x branch to buster (includes CVE backport, full test
    suite import, and bug fixes)

 -- Sylvain Beucler <beuc@debian.org>  Wed, 16 Nov 2022 18:56:09 +0100
  
php-phpseclib (2.0.30-2) unstable; urgency=medium

  * Drop Conflicts and Replaces: php-seclib (>= 2)
  * Rename branches for 2.x
  * Install /u/s/p/a/php-phpseclib
  * Simplify gbp import-orig workflow
  * Use debian/bullseye branch
  * Backport cleanup RSA PKCS#1 v1.5 signature verification (CVE-2021-30130)

 -- David Prévot <taffit@debian.org>  Sat, 10 Apr 2021 09:52:00 -0400

php-phpseclib (2.0.30-1) unstable; urgency=medium

  [ terrafrost ]
  * enable unit tests for PHP 8 / PHPUnit 9
  * CHANGELOG: add 2.0.30 entry

 -- David Prévot <taffit@debian.org>  Fri, 18 Dec 2020 23:36:42 -0400

php-phpseclib (2.0.29-2) unstable; urgency=medium

  * Adapt to recent version of PHPUnit (9)
  * Fix field name case in debian/tests/control (Test-command => Test-Command).
  * Update watch file format version to 4.
  * Update Standards-Version to 4.5.1
  * Drop versioned dependency satisfied in stable

 -- David Prévot <taffit@debian.org>  Mon, 14 Dec 2020 11:50:06 -0400

php-phpseclib (2.0.29-1) unstable; urgency=medium

  [ terrafrost ]
  * add 2.0.29 release

  [ David Prévot ]
  * Set upstream metadata fields: Archive.
  * Rename main branch to debian/latest (DEP-14)

 -- David Prévot <taffit@debian.org>  Tue, 08 Sep 2020 11:51:10 -0400

php-phpseclib (2.0.28-1) unstable; urgency=medium

  [ terrafrost ]
  * 2.0.27 release
  * CHANGELOG: there already was a 2.0.27 release..

  [ David Prévot ]
  * Set Rules-Requires-Root: no.
  * Use debhelper-compat 13
  * Simplify override_dh_auto_test

 -- David Prévot <taffit@debian.org>  Thu, 09 Jul 2020 22:35:32 -0400

php-phpseclib (2.0.27-1) unstable; urgency=medium

  [ terrafrost ]
  * CHANGELOG: add entries for 2.0.25 and 2.0.26 release notes

 -- David Prévot <taffit@debian.org>  Mon, 06 Apr 2020 10:19:11 -1000

php-phpseclib (2.0.26-1) unstable; urgency=medium

  * New upstream release

 -- David Prévot <taffit@debian.org>  Sun, 29 Mar 2020 10:22:34 -1000

php-phpseclib (2.0.25-1) unstable; urgency=medium

  [ terrafrost ]
  * CHANGELOG: 2.0.24 release

  [ David Prévot ]
  * Set upstream metadata fields:
    Bug-Database, Bug-Submit, Repository, Repository-Browse.
  * Update Standards-Version to 4.5.0

 -- David Prévot <taffit@debian.org>  Fri, 28 Feb 2020 09:50:37 -1000

php-phpseclib (2.0.23-2) unstable; urgency=medium

  * Revert "Update to current phpcs output"
  * Build-Depend on recent php-codesniffer
  * Set upstream metadata fields: Repository.
  * Drop versioned dependency satisfied in (old)stable
  * Update Standards-Version to 4.4.1

 -- David Prévot <taffit@debian.org>  Mon, 30 Sep 2019 19:06:51 -1000

php-phpseclib (2.0.23-1) unstable; urgency=medium

  [ terrafrost ]
  * SSH2: only do fclose($this->fsock) if doing so won't yield error
  * CHANGELOG: add 2.0.23 release

 -- David Prévot <taffit@debian.org>  Sat, 21 Sep 2019 17:11:46 -1000

php-phpseclib (2.0.22-1) unstable; urgency=medium

  [ terrafrost ]
  * CHANGELOG: add 2.0.22 release

 -- David Prévot <taffit@debian.org>  Mon, 16 Sep 2019 05:40:47 -1000

php-phpseclib (2.0.21-3) unstable; urgency=medium

  * Versioned php-codesniffer dependency to hint CI
  * Remove obsolete fields Name, Contact from debian/upstream/metadata.

 -- David Prévot <taffit@debian.org>  Thu, 29 Aug 2019 10:38:29 -1000

php-phpseclib (2.0.21-2) unstable; urgency=medium

  * Set upstream metadata fields: Contact, Name.
  * Update to current phpcs output
  * Compatibility with recent PHPUnit (8)

 -- David Prévot <taffit@debian.org>  Mon, 12 Aug 2019 06:52:20 -1000

php-phpseclib (2.0.21-1) unstable; urgency=medium

  * Upload to unstable now that buster has been released

  [ terrafrost ]
  * update copyright years on license

  [ David Prévot ]
  * Update copyright (years)
  * Update Standards-Version to 4.4.0

 -- David Prévot <taffit@debian.org>  Fri, 19 Jul 2019 11:16:44 -0300

php-phpseclib (2.0.20-1) experimental; urgency=medium

  [ Remi Collet ]
  * fix compat with 5.3

 -- David Prévot <taffit@debian.org>  Tue, 25 Jun 2019 07:40:50 -1000

php-phpseclib (2.0.19-1) experimental; urgency=medium

  [ terrafrost ]
  * SFTP: add callback parameter to get()
  * BigInteger: fix issues with divide method

 -- David Prévot <taffit@debian.org>  Thu, 20 Jun 2019 15:29:10 -1000

php-phpseclib (2.0.18-1) experimental; urgency=medium

  [ terrafrost ]
  * 1.0.16 release

 -- David Prévot <taffit@debian.org>  Sun, 16 Jun 2019 16:38:47 -1000

php-phpseclib (2.0.17-1) experimental; urgency=medium

  * Document gbp import-ref usage

 -- David Prévot <taffit@debian.org>  Mon, 03 Jun 2019 14:40:29 -1000

php-phpseclib (2.0.15-1) experimental; urgency=medium

  * Upload to experimental during the freeze

  [ terrafrost ]
  * 1.0.15 release

  [ David Prévot ]
  * Use upstream git tag as source
  * Adapt packaging to restored tests
  * Adapt packaging to restored changelog
  * Update copyright

 -- David Prévot <taffit@debian.org>  Tue, 12 Mar 2019 21:32:36 -1000

php-phpseclib (2.0.14-1) unstable; urgency=medium

  [ terrafrost ]
  * 1.0.14 release

  [ David Prévot ]
  * Use debhelper-compat 12
  * Update Standards-Version to 4.3.0

 -- David Prévot <taffit@debian.org>  Fri, 01 Feb 2019 13:47:35 -1000

php-phpseclib (2.0.13-1) unstable; urgency=medium

  [ Andreas Fischer ]
  * README: Declare 2.0 branch as LTS. #1310

 -- David Prévot <taffit@debian.org>  Fri, 21 Dec 2018 06:37:04 +1100

php-phpseclib (2.0.12-1) unstable; urgency=medium

  [ terrafrost ]
  * 1.0.12 release

  [ David Prévot ]
  * Use debhelper-compat 11
  * Use https in Format
  * Drop get-orig-source target
  * Use Standards-Version 4.2.1

 -- David Prévot <taffit@debian.org>  Thu, 08 Nov 2018 20:44:45 +1300

php-phpseclib (2.0.11-1) unstable; urgency=medium

  [ terrafrost ]
  * 1.0.11 release

  [ David Prévot ]
  * Update Standards-Version to 4.1.4

 -- David Prévot <taffit@debian.org>  Tue, 24 Apr 2018 08:26:11 -1000

php-phpseclib (2.0.10-1) unstable; urgency=medium

  * Move project repository to salsa.d.o
  * Update Standards-Version to 4.1.3

 -- David Prévot <taffit@debian.org>  Wed, 07 Mar 2018 13:33:33 -1000

php-phpseclib (2.0.9-1) unstable; urgency=medium

  [ terrafrost ]
  * 1.0.9 release

  [ David Prévot ]
  * Update Standards-Version to 4.1.2

 -- David Prévot <taffit@debian.org>  Sun, 03 Dec 2017 06:17:21 -1000

php-phpseclib (2.0.7-1) unstable; urgency=medium

  * New upstream release
  * Update Standards-Version to 4.1.1

 -- David Prévot <taffit@debian.org>  Mon, 23 Oct 2017 15:35:16 -1000

php-phpseclib (2.0.6-1) unstable; urgency=medium

  * New upstream release
  * Update Standards-Version to 4.0.0

 -- David Prévot <taffit@debian.org>  Fri, 04 Aug 2017 22:30:19 -0400

php-phpseclib (2.0.4-1) unstable; urgency=medium

  * New upstream release

 -- David Prévot <taffit@debian.org>  Thu, 20 Oct 2016 15:34:04 -1000

php-phpseclib (2.0.3-1) unstable; urgency=medium

  * New upstream release

 -- David Prévot <taffit@debian.org>  Thu, 22 Sep 2016 15:09:52 -1000

php-phpseclib (2.0.2-1) unstable; urgency=medium

  [ Andreas Fischer ]
  * Add bootstrap.php checking environment (MB_OVERLOAD_STRING).

  [ David Prévot ]
  * Load new bootstrap file
  * Update Standards-Version to 3.9.8

 -- David Prévot <taffit@debian.org>  Sun, 05 Jun 2016 16:16:47 -0400

php-phpseclib (2.0.1-2) unstable; urgency=medium

  * Drop ownCloud for Debian maintainers from uploaders
  * Rebuild with recent pkg-php-tools for the PHP 7.0 transition
    (Closes: #817272)

 -- David Prévot <taffit@debian.org>  Wed, 09 Mar 2016 14:18:28 -0400

php-phpseclib (2.0.1-1) unstable; urgency=medium

  * Drop inadequate Replaces, Conflicts and Provides
  * Rename version 2 as php-phpseclib.
    Use the “proper” Composer name, and allow one to install it along with
    php-seclib (version 1). Both versions are still supported, and various
    packages still depending of version 1 are unlikely to be ready to use
    version 2 in time for Stretch.
  * Update Standards-Version to 3.9.7

 -- David Prévot <taffit@debian.org>  Wed, 03 Feb 2016 14:34:47 -0400

phpseclib (2.0.1-1) experimental; urgency=medium

  [ Andreas Fischer ]
  * Correct indentation on pvno array definition.

  [ terrafrost ]
  * composer.json: rm pear-pear/PHP_Compat
  * CHANGELOG: add 1.0.1 changes

  [ Michele Locati ]
  * Exclude some dirs and files from repository auto-generated ZIP archives

  [ Prayag Verma ]
  * Update license year range to 2016

  [ David Prévot ]
  * Adapt packaging to removed tests
  * Restore upstream changelog
  * Update copyright
  * Drop now useless override for php-compat

 -- David Prévot <taffit@debian.org>  Mon, 18 Jan 2016 22:32:34 -0400

phpseclib (2.0.0-1) experimental; urgency=medium

  * Upload new 2. branch to experimental

  [ Andreas Fischer ]
  * Require PHP 5.3 in composer.json
  * PHP 5.3+: Replace custom autoloader with composer autoloader.
  * Add PSR4 namespace to composer.json.
  * Add namespace statement. Rename class.

  [ David Prévot ]
  * Revert "Track the 1. branch"
  * Adapt packaging to namespace change
  * Update tests

 -- David Prévot <taffit@debian.org>  Sat, 26 Sep 2015 17:47:29 -0400

phpseclib (1.0.0-2) unstable; urgency=medium

  * Upload 1. branch to unstable since no (negative) feedback was shared

 -- David Prévot <taffit@debian.org>  Sat, 26 Sep 2015 16:42:01 -0400

phpseclib (1.0.0-1) experimental; urgency=medium

  * Upload 1. branch to experimental, so that it can be tested in advance

  [ terrafrost ]
  * update phpseclib to 1.0.0

  [ Andreas Fischer ]
  * Update PHP Code Sniffer to 2.3.3

  [ David Prévot ]
  * Track the 1. branch
  * Handle Blowfish renaming at build time
  * Revert "Drop phpcs call from tests"
  * Update copyright (years)
  * Use php5-mcrypt to pass more tests

 -- David Prévot <taffit@debian.org>  Sun, 30 Aug 2015 18:24:32 -0400

phpseclib (0.3.10-3) unstable; urgency=medium

  * Provide php-math-biginteger (= 1.0.2+phpseclib), and also declare a
    conflict (and replace) with it to document that they can’t be installed
    together (Closes: #785281)
  * Additional provides for php-phpseclib*

 -- David Prévot <taffit@debian.org>  Sat, 16 May 2015 15:50:12 -0400

phpseclib (0.3.10-2) unstable; urgency=medium

  * Upload to unstable since Jessie has been released
  * Provide homemade autoload.php
  * Drop phpcs call from tests

 -- David Prévot <taffit@debian.org>  Sat, 02 May 2015 13:11:14 -0400

phpseclib (0.3.10-1) experimental; urgency=medium

  * New upstream release

 -- David Prévot <taffit@debian.org>  Mon, 09 Feb 2015 10:59:09 -0400

phpseclib (0.3.9-1) experimental; urgency=medium

  * Upload to experimental to respect the current freeze

  [ terrafrost ]
  * ASN1: fix issue with non-constructed context-specific tags
  * BigInteger: accommodate GMP change in PHP 5.6
  * SSH2: fix issues with RSA key verification
  * add CHANGELOG.md

  [ Andreas Fischer ]
  * Restore compatibility with PHP 5.6.1 by using explicit array indexes.

  [ David Prévot ]
  * Drop now useless XS-Testsuite
  * Bump standards version to 3.9.6
  * Refresh patch header

 -- David Prévot <taffit@debian.org>  Wed, 12 Nov 2014 15:54:30 -0400

phpseclib (0.3.8-1) unstable; urgency=medium

  * Install OpenSSL example configuration

 -- David Prévot <taffit@debian.org>  Sun, 14 Sep 2014 11:31:44 -0400

phpseclib (0.3.7-1) unstable; urgency=medium

  * Grab source from GitHub
  * Use phpcomposer build helper
  * Update patch
  * Update copyright
  * Run tests during build
  * Run more tests during build
  * Add DEP-8 compliant tests

 -- David Prévot <taffit@debian.org>  Wed, 23 Jul 2014 16:36:00 -0400

phpseclib (0.3.6-1) unstable; urgency=medium

  [ Hans-Jürgen Petrich ]
  * Crypt_Base

  [ Patrick Monnerat ]
  * Add Crypt RC2 algorithm.

  [ terrafrost ]
  * SSH2: add ssh-agent support

  [ David Prévot ]
  * Add ownCloud for Debian to uploaders
  * Bump standards version to 3.9.5
  * Remove self from copyright holders
  * Update copyright years
  * Update patch, now handled via gbp pq
  * Install new System/SSH_Agent.php file

 -- David Prévot <taffit@debian.org>  Tue, 04 Mar 2014 08:31:38 -0300

phpseclib (0.3.5-2) unstable; urgency=low

  * Fix Crypt_Blowfish conflict
  * Revert "Replace and provide php-crypt-blowfish"

 -- David Prévot <taffit@debian.org>  Sun, 14 Jul 2013 11:04:49 -0400

phpseclib (0.3.5-1) unstable; urgency=low

  * New upstream version
  * Use canonical Vcs- fields
  * Update Description: add Blowfish and Twofish
  * Replace and provide php-crypt-blowfish

 -- David Prévot <taffit@debian.org>  Sat, 13 Jul 2013 17:57:40 -0400

phpseclib (0.3.1-1) unstable; urgency=low

  * Initial release. (Closes: #704700)

 -- David Prévot <taffit@debian.org>  Thu, 04 Apr 2013 19:05:03 -0400
