lrzsz (0.12.21rc-5) unstable; urgency=medium

  * Fix a series of security-related bugs. Thanks to Daniel Birtwhistle for
    bringing these to our attention and for his support during patch
    verification:
    * 01-rz-reject-absolute-paths.diff: reject sender-supplied absolute paths
      in rz restricted mode.
    * 02-rz-terminate-received-strings.diff: reject over-length received file
      names, fixing an out-of-bounds read and a one-byte heap overwrite on
      maximum-length ZFILE names; also terminate the receiver buffer.
    * 03-rz-junk-path-double-free.diff: fix a double-free and a use-after-free
      when a --junk-path name ends in '/'.
    * 04-rz-null-flag-use-after-free.diff: fix use-after-free with -D/--null.

 -- Martin A. Godisch <godisch@debian.org>  Sun, 23 Aug 2026 10:17:41 +0200

lrzsz (0.12.21rc-4) unstable; urgency=low

  * Added salsa repository.
  * debian/control: added Vcs-Git and Vcs-Browser fields, closes: #733721.

 -- Martin A. Godisch <godisch@debian.org>  Fri, 19 Jun 2026 08:32:57 +0200

lrzsz (0.12.21rc-3) unstable; urgency=low

  * Drop the lsz.1 documentation of the sz -T/-TT test and diagnostic modes.
    These were inherited from Chuck Forsberg's original sz but do not exist in
    lrzsz, where -T is bound solely to --turbo. A user following the manual's
    "sz -TT" diagnosis instructions therefore only ran --turbo twice and got a
    normal, failing transfer to the terminal. Add new patch
    618357_manpage_remove_test_mode.diff removing the stale -TT synopsis form,
    the "sixth form" paragraph, the "TESTING FEATURE" section and the orphaned
    BUGS sentence, closes: #618357.
  * Clarify in lsz.1 that the advertised YMODEM-g support only applies when the
    receiving program requests it (by sending 'G'), and that lrzsz's own rb/rz
    cannot do so, hence a separate receiver is required. This explains why the
    feature seemed missing. Add new patch 206499_ymodemg_doc.diff,
    closes: #206499.
  * Make debian/watch usable again. ohse.de does not index the packaged
    0.12.21rc tarball on any browsable page, but upstream's GitHub repository
    README links it directly; scan that page for the release and fetch the
    tarball from its canonical ohse.de location.

 -- Martin A. Godisch <godisch@debian.org>  Fri, 19 Jun 2026 05:56:36 +0200

lrzsz (0.12.21rc-2) unstable; urgency=low

  * Fix FTBFS with "make --shuffle=reverse". The upstream src/Makefile.am
    install-exec-local hook hard-links the installed binaries but does not
    depend on install-binPROGRAMS, so under shuffled prerequisite order it ran
    before the binaries were installed and ln aborted. Add new patch
    1105467_shuffle_install_order.diff declaring the dependency explicitly,
    closes: #1105467.
  * Keep syslog timestamps locale-independent. setlocale(LC_ALL, "") in lrz/lsz
    also set LC_TIME, which the C library's syslog() used for the message
    timestamp, so log lines from sz/rz showed a translated month name while the
    rest of the log stayed English. Add new patch
    57884_syslog_locale_timestamp.diff resetting LC_TIME to "C", closes: #57884.
  * Fix the XMODEM "Blocks received" counter for files larger than 255 blocks.
    wcrx() displayed the raw one-byte block number, which wraps at 255, so the
    on-screen count restarted at 0 (showing "055", "155", ... due to the
    carriage-return redraw) instead of continuing 256, 257, ... Add new patch
    156249_xmodem_block_counter.diff reporting the running sector total instead,
    closes: #156249.
  * Silence the only remaining C compiler warning: siginterrupt() is deprecated
    (-Wdeprecated-declarations). Add new patch fix_siginterrupt_deprecation.diff
    installing the SIGALRM handlers via sigaction() with sa_flags = 0 instead,
    preserving the "interrupt blocking syscalls on timeout" behaviour.
  * Bump Standards-Version to 4.7.4 (no further changes required).
  * Switch to debhelper compat level 13.
  * Add ${misc:Depends} to the binary package's Depends.
  * Update debian/watch to format version 4.
  * Refresh the debian/copyright header (current maintainer, upstream URL).
  * Packaging QA: add DEP-3 Description/Forwarded headers to all quilt patches;
    drop the obsolete debian/source/include-binaries (its entries no longer
    exist in the tree) and the stray, non-series patch
    206499_ymodemg.diff.unchecked.

 -- Martin A. Godisch <godisch@debian.org>  Thu, 18 Jun 2026 14:02:51 +0200

lrzsz (0.12.21rc-1) unstable; urgency=medium

  * Fix FTBFS with gettext 0.26 / modern autopoint. configure.in used
    AM_GNU_GETTEXT without any version declaration, so autopoint assumed the
    obsolete gettext-0.10.32 infrastructure and aborted autoreconf. Add new
    patch gettext_require_version.diff declaring
    AM_GNU_GETTEXT_REQUIRE_VERSION([0.19.8]), closes: #1126976, #1136751.
  * The modern gettext infrastructure pulled in that way needs po/Makevars
    and po/LINGUAS, which upstream never shipped. Add both via new patch
    po_makevars_linguas.diff (LINGUAS lists "de" to keep the German
    catalogue).
  * Make "debian/rules clean" idempotent. dh_autoreconf installs automake's
    maintainer-mode rebuild rules, so a second build re-ran automake during
    "make clean" and failed (automake >= 1.16 rejects the old configure.in).
    Neutralise ACLOCAL/AUTOCONF/AUTOMAKE/AUTOHEADER for that clean invocation.
  * Also remove the configure/config.status output (Makefile, config.h,
    config.status, sub-directory Makefiles, Specfile, systype, ...) in the
    clean target. "make clean" left these behind, so a rebuild aborted in
    dpkg-source -b with unexpected changes to the 3.0 (quilt) tree.
  * Fix the remaining C compiler warnings via new patch compiler_warnings.diff:
    a real -Wformat= bug in src/lsyslog.c (int passed for %ld) and the
    -Wunused-result warnings for write()/system()/vasprintf() in src/.

 -- Martin A. Godisch <godisch@debian.org>  Thu, 04 Jun 2026 03:24:56 +0200

lrzsz (0.12.21rc-0.3) unstable; urgency=medium

  * Non-maintainer upload.
  * Build with -std=gnu17 to workaround FTBFS with GCC 15.
    (Closes: #1097316)

 -- Adrian Bunk <bunk@debian.org>  Fri, 17 Oct 2025 21:38:08 +0300

lrzsz (0.12.21rc-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Remove need for root when building the package.
    (Closes: #1089380)

 -- Niels Thykier <niels@thykier.net>  Wed, 01 Jan 2025 12:16:48 +0000

lrzsz (0.12.21rc-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream version, closes: #206639.
  * Build with dh_autoreconf, without native language support, closes: #1075238.

  [ Helmut Grohne ]
  * Make cross compilation work, closes: #873810.

 -- Bastian Germann <bage@debian.org>  Fri, 13 Sep 2024 08:57:20 +0200

lrzsz (0.12.21-11) unstable; urgency=low

  * Fixed FTBFS, closes: #1066514.
  * Fixed typo in manpage, closes: #1037046.
  * Added DOS-style DSZLOG support, closes: #206648. Thanks to Ryan Underwood.
  * Fixed some compiler warnings.

 -- Martin A. Godisch <godisch@debian.org>  Sun, 17 Mar 2024 07:12:52 +0100

lrzsz (0.12.21-10) unstable; urgency=high

  * Fixed possible sz data leak, CVE-2018-10195, closes: #897010.
    Patch from the Fedora project,
    https://src.fedoraproject.org/cgit/rpms/lrzsz.git/tree/lrzsz-0.12.20.patch

 -- Martin A. Godisch <godisch@debian.org>  Tue, 01 May 2018 15:34:22 +0200

lrzsz (0.12.21-9) unstable; urgency=medium

  * Non-maintainer upload.

  [ Reiner Herrmann ]
  * Make the build reproducible (Closes: #828856)

 -- Andrej Shadura <andrewsh@debian.org>  Sun, 22 Apr 2018 11:24:40 +0200

lrzsz (0.12.21-8) unstable; urgency=low

  * Fixed reproducible builds, closes: #787995, thanks to Dhole.

 -- Martin A. Godisch <godisch@debian.org>  Sun, 07 Jun 2015 18:43:33 +0200

lrzsz (0.12.21-7) unstable; urgency=low

  * Fixed file permissions.

 -- Martin A. Godisch <godisch@debian.org>  Mon, 30 Dec 2013 16:50:38 +0100

lrzsz (0.12.21-6) unstable; urgency=low

  * Changed source format to v3.0 (quilt).
  * Updated build script.
  * Fixed copyright file.
  * Added watch file.
  * Updated standards version.

 -- Martin A. Godisch <godisch@debian.org>  Sat, 28 Dec 2013 17:32:43 +0100

lrzsz (0.12.21-5) unstable; urgency=low

  * New maintainer upload, closes: #556238.
    Thanks to Josip Rodin for his work.
  * Removed build-dependency on debhelper.
  * Added build-dependency on autotools-dev.
  * Cut Debian diff.gz into pieces.
  * Updated FSF address in copyright file.
  * Updated German po file, added build-dependency on gettext.
    Closes: #313992, thanks to Jens Seidel and Tobias Toedter.
  * Fixed missing includes (compiler warnings).
  * Fixed typo in sz manpage.
  * Fixed linking to libnsl.
  * Removed changelog emacs settings.
  * Updated standards version.

 -- Martin A. Godisch <godisch@debian.org>  Sun, 22 Nov 2009 09:35:13 +0100

lrzsz (0.12.21-4.1) unstable; urgency=low

  * Non-maintainer upload.
  * Rebuilt with current debhelper, finishing the /usr/doc transition.
    Closes: #322762
  * Rebuilt with a current toolchain, now it's prelinkable.
    Closes: #288084
  * Appled man page typo fix patch from A Costa. Closes: #311459

 -- Joey Hess <joeyh@debian.org>  Tue, 10 Jan 2006 01:35:00 -0500

lrzsz (0.12.21-4) unstable; urgency=low

  * Updated for Standards-Version: 3.5.2.
  * Added touch stamp-h.in before make invocation in order to stop
    autoheader from running.

 -- Josip Rodin <jrodin@jagor.srce.hr>  Sun, 25 Mar 2001 19:48:18 +0200

lrzsz (0.12.21-3) unstable; urgency=low

  * Newish upstream version, (990823 in CVS).
  * Updated for Policy 3.x.
  * Misc. fixes for debian/*.

 -- Josip Rodin <jrodin@jagor.srce.hr>  Sun, 19 Sep 1999 17:55:38 +0200

lrzsz (0.12.21-2) unstable; urgency=low

  * Removed definition of strstr, advised by upstream maintainer, to
    get it to compile on glibc2.1, as John Goerzen and Bart Warmerdam
    noticed (fixes: #39429 #39812).

 -- Josip Rodin <jrodin@jagor.srce.hr>  Sun, 20 Jun 1999 21:38:07 +0200

lrzsz (0.12.21-1) unstable; urgency=low

  * New upstream version (990604 in CVS).
  * Cleaned up the diff by removing unneeded .deps/ files and not changing
    aclocal et al.

 -- Josip Rodin <jrodin@jagor.srce.hr>  Sun,  6 Jun 1999 21:01:50 +0200

lrzsz (0.12.20-2) unstable; urgency=low

  * Don't install ansi2knr.1 manpage, closing bug #33121

 -- Josip Rodin <jrodin@jagor.srce.hr>  Sun,  7 Feb 1999 01:32:31 +0100

lrzsz (0.12.20-1) unstable; urgency=low

  * New maintainer.
  * Althought version number doesn't indicate that, this version is
    today's CVS snapshot from ftp://tirka.ohse.de/uwe/cvs-trees
  * This release fixes following bugs: #8373 #11208 #16170 #16744 #17210.
  * Package is lintian clean.

 -- Josip Rodin <jrodin@jagor.srce.hr>  Sun,  7 Feb 1999 01:32:31 +0100

lrzsz (0.12.17) unstable; urgency=low

  * sorry, see ../ChangeLog. automagically generated debian/changelog

 -- Uwe Ohse <uwe@ohse.de>  Mon, 02 Jun 1997 10:06:05 +0200

lrzsz (0.12.16) unstable; urgency=low

  * sorry, see ../ChangeLog. changelog is here just to make
    dpkg happy.
  * initial release

 -- Uwe Ohse <uwe@ohse.de>  Sun, 2 Jun 1997 21:00:00 +0200

lrzsz (0.12b-1.1) unstable; urgency=low

  * Non-maintainer release.
  * Libc6 compile.

 -- Martin Mitchell <martin@debian.org>  Sat, 18 Oct 1997 01:58:54 +1000

lrzsz (0.12b-1) unstable; urgency=low

  * Converted to new source packaging format.
  * New upstream version.

 -- Michael Alan Dorman <mdorman@calder.med.miami.edu>  Tue, 17 Sep 1996 13:39:23 -0400
