tar (1.16-2etch1) stable-security; urgency=high

  * Non-maintainer upload by the security team
  * Apply patch from Dmitry V. Levin <ldv@owl.openwall.com> to avoid a
    stack-based buffer overflow while processing certain file names
    (CVE-2007-4476).  Closes: #441444.
  * Apply patch from Dmitry V. Levin to fix double-dot recognition
    in case of duplicate / (CVE-2007-4131).  Closes: #439335.
  * Update the autoconf scripts to the etch version (no functional
    changes, hopefully).

 -- Florian Weimer <fw@deneb.enyo.de>  Wed, 26 Dec 2007 13:30:08 +0100

tar (1.16-2) unstable; urgency=high

  * patch from Kees Cook via upstream to disable handling of GNUTYPE_NAMES 
    by default and add a new command-line switch --allow-name-mangling to 
    re-enable it, as a fix for directory traversal bug (CVE-2006-6097), 
    closes: #399845

 -- Bdale Garbee <bdale@gag.com>  Fri,  1 Dec 2006 09:19:02 -0700

tar (1.16-1) unstable; urgency=medium

  * new upstream version, closes: #376816, #363943, #377124, #377330
  * fix for buffer overflow in test suite, closes: #377557
  * force a clean in the tests directory before running the test suite, seems
    to work around test suite repeatability problems, closes: #377330, #379393
  * accept patch from Raphael Bossek to zero nanoseconds, closes: #329843
  * update man page to reflect change in -l definition and other misc changes
    to options since man page was last updated, 
    closes: #384508, #391718, 361932, #315506
  * stop delivering upstream README, closes: #323232

 -- Bdale Garbee <bdale@gag.com>  Tue, 24 Oct 2006 17:41:51 -0600

tar (1.15.91-2) unstable; urgency=low

  * add a NEWS.Debian file that communicates the change in wildcard processing
  * re-institute the patch for filenames that are exactly 100 characters in 
    length originally reported in #230910, closes: #376909

 -- Bdale Garbee <bdale@gag.com>  Thu,  6 Jul 2006 19:30:46 -0600

tar (1.15.91-1) unstable; urgency=low

  * new upstream version, retrieved from alpha.gnu.org
  * update date in tar.1, closes: #367290
  * support rollbacks in maintainer scripts, drop removal of info since this
    package no longer delivers an info doc, closes: #374461

 -- Bdale Garbee <bdale@gag.com>  Thu, 22 Jun 2006 16:05:21 -0600

tar (1.15.1dfsg-3) unstable; urgency=low

  * revert to upstream auto* products and take a different approach to eliding
    doc/ contents, since I'm clearly just not smart enough to use auto* tools
    without breaking more than I fix, closes: #362249

 -- Bdale Garbee <bdale@gag.com>  Sat, 15 Apr 2006 00:18:42 -0600

tar (1.15.1dfsg-2) unstable; urgency=low

  * run aclocal and automake to get last reference to doc subdir out of
    Makefile.in, closes: #361931

 -- Bdale Garbee <bdale@gag.com>  Thu, 13 Apr 2006 07:33:20 +0900

tar (1.15.1dfsg-1) unstable; urgency=low

  * remove the documentation source from this package, since it is licensed 
    under the GFDL with invariant cover texts that upstream is unwilling or
    unable to to remove, closes: #357259
  * remove install-info call from postinst, since it is no longer relevant
  * include URL for the online version of the tar documentation in the man page
  * run make with same env vars set as configure to avoid situation where
    make re-running configure causes rsh to not be found, etc, closes: #356657
  * another patch from Goswin to fix test failures on amd64, closes: #354847

 -- Bdale Garbee <bdale@gag.com>  Tue, 11 Apr 2006 17:18:12 +0900

tar (1.15.1-6) unstable; urgency=low

  * patch from upstream to fix incorrect listing of a non-existing section as
    invariant in the GFDL license header, closes: #357259

 -- Bdale Garbee <bdale@gag.com>  Fri, 17 Mar 2006 19:09:14 +0100

tar (1.15.1-5) unstable; urgency=low

  * patch from Goswin von Brederlow to sort tar output in test suite to 
    compensate for different file order when ext3 option dir_index is enabled
    on build system, first seen on amd64 autobuilder, closes: #354847

 -- Bdale Garbee <bdale@gag.com>  Fri, 17 Mar 2006 16:02:13 +0100

tar (1.15.1-4) unstable; urgency=low

  * change section from base to utils to resolve override disparity
  * add build dependency on autoconf, closes: #354194

 -- Bdale Garbee <bdale@gag.com>  Fri, 24 Feb 2006 20:09:21 -0700

tar (1.15.1-3) unstable; urgency=high

  * patch for src/xheader.c suggested by Martin Pitt, to fix exploitable
    buffer overflow [CVE-2006-0300], closes: #354091, #314805
  * change default path for rmt in lib/localedir.h to be correct for Debian
    systems, closes: #319635
  * updated Italian translation from Marco d'Itri, closes: #286978
  * patch from Loic Minier fixing wrong matching of file names when special
    characters are present, closes: #272888
  * patch suggested by Stephen Frost to convert fatal error to warning when
    an archive spanning multiple volumes contains a filename longer than
    100 characters, closes: #330187
  * patch from Peter Samuelson to fix hard link handling in the presence
    of the --strip-components option, closes: #343062
  * update debhelper compat level to 5

 -- Bdale Garbee <bdale@gag.com>  Thu, 23 Feb 2006 13:02:09 -0600

tar (1.15.1-2) unstable; urgency=low

  * patch from LaMont to fix gcc-4.0 error in the test suite, 
    closes: #308815, #310830
  * patch for de.po from Jens Seidel, closes: #313900
  * fix amanda upstream URL in the info pages, closes: #310158
  * patch from NIIBE Yutaka to support cross builds, closes: #283723

 -- Bdale Garbee <bdale@gag.com>  Tue, 14 Jun 2005 23:42:40 -0600

tar (1.15.1-1) unstable; urgency=low

  * new upstream version, closes: #292255, #287251, #255067
  * fetch tests/append.at from CVS since it was omitted from the 1.15.1 
    tarball, and update the regression test invocation in debian/rules
  * tweaks to man page, closes: #265615
  * add --libexecdir definition to configure call, closes: #307070, #291068
  * stop trying to link /sbin/rmt, closes: #287217, #156550
  * add --owner to man page, closes: #204848
  * only mention --totals once in man page, closes: #288002

 -- Bdale Garbee <bdale@gag.com>  Sun,  8 May 2005 22:41:15 -0600

tar (1.14-2) unstable; urgency=low

  * patch from Paul Eggert that does a better job of eliminating the 
    dependency on (buggy) valloc, closes: #234422, #248897
  * patch for typo in upstream po/de.po, closes: #154511
  * switch from dh_installmanpages to dh_installman

 -- Bdale Garbee <bdale@gag.com>  Tue,  3 Aug 2004 08:22:17 -0600

tar (1.14-1) unstable; urgency=low

  * new upstream version, closes: #252491, #242231
  * eliminate autoconf and automake build dependencies
  * fix a bash-ism in the prerm for POSIX shell users
  * change valloc to malloc when allocating record_start, closes: #234422

 -- Bdale Garbee <bdale@gag.com>  Mon,  2 Aug 2004 08:02:18 -0700

tar (1.13.93-4) unstable; urgency=high

  * patch to stop issuing lone zero block warnings, closes: #235820
  * patch to clean up hyphenation in man page, closes: #185670
  * clean up manpage discussion of exclude and exclude-from, closes: #146196
  * turn on regression tests in the build process

 -- Bdale Garbee <bdale@gag.com>  Sat, 24 Apr 2004 15:38:32 -0600

tar (1.13.93-3) unstable; urgency=high

  * patch from upstream converts lone zero block errors to warnings, 
    closes: #235821

 -- Bdale Garbee <bdale@gag.com>  Fri, 12 Mar 2004 17:02:47 -0700

tar (1.13.93-2) unstable; urgency=high

  * recover portion of patch from Ingo Saitz included in 1.13.92-4 that got
    lost when merging 1.13.93 upstream (argh!), closes: 230910

 -- Bdale Garbee <bdale@gag.com>  Wed,  3 Mar 2004 13:22:49 -0700

tar (1.13.93-1) unstable; urgency=low

  * new upstream version

 -- Bdale Garbee <bdale@gag.com>  Sat, 28 Feb 2004 20:10:13 -0700

tar (1.13.92-5) unstable; urgency=low

  * patch from Paul Eggert to revert bogus behavior where POSIXLY_CORRECT 
    set in the environment forced 'pax' format archives, closes: #230872
  * add a lintian override for rmt's man page, since delivering it as an
    alternative makes the filename no longer match the script and symlink
    delivered for the binary

 -- Bdale Garbee <bdale@gag.com>  Sun, 15 Feb 2004 16:03:20 -0700

tar (1.13.92-4) unstable; urgency=low

  * patch from Ingo Saitz to avoid creating archives with shortnames of 100
    characters, since it can cause dpkg problems, closes: #230910
  * fix typo in info page, closes: #222569

 -- Bdale Garbee <bdale@gag.com>  Thu, 12 Feb 2004 01:17:10 -0700

tar (1.13.92-3) unstable; urgency=low

  * freshen build dependencies to use automaken
  * lose /usr/share/info/dir*gz, closes: #230418
  * reinstate content for mime-support, closes: #111893
  * implement alternatives for rmt, the version provided with dump will get
    higher priority than the one in tar since it's better - see #183901

 -- Bdale Garbee <bdale@gag.com>  Sat, 31 Jan 2004 16:55:29 -0700

tar (1.13.92-2) unstable; urgency=low

  * patches from CVS to stop stripping './' prefix from filenames, and to fix
    --no-recursion, closes: #230431, #230434

 -- Bdale Garbee <bdale@gag.com>  Sat, 31 Jan 2004 01:11:04 -0700

tar (1.13.92-1) unstable; urgency=low

  * new upstream version, closes: #229827

 -- Bdale Garbee <bdale@gag.com>  Fri, 30 Jan 2004 02:02:08 -0700

tar (1.13.25-6) unstable; urgency=low

  * accept patch from Goswin Brederlow to hard-code RSH definition in rules 
    file, eliminating rsh-client from build deps, closes: #185594, #200042
  * patch from Marc SCHAEFER <schaefer@alphanet.ch> to fix symlink extraction
    as empty files, closes: #149532

 -- Bdale Garbee <bdale@gag.com>  Sun, 14 Sep 2003 10:55:42 -0600

tar (1.13.25-5) unstable; urgency=low

  * include fresher config.sub/guess, update in debian/rules, closes: #165778

 -- Bdale Garbee <bdale@gag.com>  Tue, 22 Oct 2002 16:09:43 -0600

tar (1.13.25-4) unstable; urgency=high

  * apply patch for path vulnerabilities documented in CVE CAN-2002-0399,
    make urgency high since this is a security issue, closes: #163152
  * include improved tar.1 man page from Andrew Moise <moise@nauticom.net>

 -- Bdale Garbee <bdale@gag.com>  Wed, 16 Oct 2002 11:16:44 -0600

tar (1.13.25-3) unstable; urgency=low

  * apply patch to the Debian-originated tar manpage from Pedro Zorzenon Neto
    <pzn@terra.com.br> to clarify the value of using --bzip2 in scripts instead
    of -j to ensure compatibility with both old and new versions of tar.
    closes: #142242, #83233
  * fix capitalization concern in the control file, closes: #125629

 -- Bdale Garbee <bdale@gag.com>  Wed, 10 Apr 2002 14:14:40 -0600

tar (1.13.25-2) unstable; urgency=medium

  * add a README.Debian that clarifies the situation with respect to 'compress'
    in Debian and the impact on the -Z and related options, closes: #122336
  * patch from Mark Eichin to fix archive corruption in special cases, which
    has been accepted upstream for next release.  closes: #126274

 -- Bdale Garbee <bdale@gag.com>  Fri,  1 Feb 2002 08:49:26 -0700

tar (1.13.25-1) unstable; urgency=medium

  * new upstream version (bug fixes), closes: #113531
  * start having tar provide rmt, which means conflicting with and replacing
    cpio versions prior to the cutover, closes: #94257, #90794
  * make medium urgency, since we really want this and the associated cpio
    upload to both be in woody!

 -- Bdale Garbee <bdale@gag.com>  Fri, 23 Nov 2001 09:20:40 -0700

tar (1.13.22-1) unstable; urgency=medium

  * new upstream version, released specifically to help close bugs in woody
    upstream (Paul Eggert) says:
      regarding 1.13.22
        This fixes Debian bug 92106, in addition to the bug fixes I already
        reported to you for GNU tar 1.13.20 and 1.13.21.  It also fixes a
        core-dump bug for tar 1.13.19 and later, reported to bug-tar.
      regarding 1.13.21
        This fixes Debian bug 95984, in addition to the bug fixes I already
        reported to you for 1.13.20.  It also upgrades tar to use gettext
        0.10.39.
      regarding 1.13.20
        I haven't had time to fix all or even most of the bugs, but I suggest
        closing out or modifying the following bug reports:
        13312 I changed tar to avoid the problem (I hope; I can't test it).
        52092 Fixed.
        58890 Fixed, I think -- at least, I can't reproduce it now.
        65719 Not a bug? last message in that bug report says it works for him.
        77664 Not a bug.  In that context FOO:BAR means 'file BAR on host FOO'.
        78179 Sorry, I don't follow this report.  Tar does strip leading '/'s 
        	for me.
        83458 Fixed.
        83735 Fixed.
        85400 Fixed for the info page only.  The man page is not part of 
        	tar-1.13.20.
        90794 This partly seems to be a Debian packaging problem; see 94257.
        94287 Fixed.
        95344 Fixed.
        95984 Not fixed in 1.13.20, but will be fixed in next version.
        99655 Fixed.
        100883 This bug report applies to the Debian distribution only.
        100885 Not a bug; see its last message.
        105744 Not a bug; see its last message.
    closes: #92106, #95984, #13312, #52092, #58890, #65719, #77664, #78179
    closes: #83458, #83735, #94287, #95344, #99655, #100885, #105744
  * add documentation for --rsh-command to the Debian-provided man page,
    closes: #85400
  * fix Debian-provided man page's reference to --exclude, closes: #100883

 -- Bdale Garbee <bdale@gag.com>  Fri, 31 Aug 2001 01:13:49 -0600

tar (1.13.19-1) unstable; urgency=low

  * new upstream version, -I no longer a valid option, closes: #81556
  * freshen debian/copyright

 -- Bdale Garbee <bdale@gag.com>  Tue, 23 Jan 2001 09:42:13 -0700

tar (1.13.18-2) unstable; urgency=low

  * update (Debian-only, not part of upstream release) man page for tar to
    reflect change from -I to -j for bzip2 support, closes: #80331

 -- Bdale Garbee <bdale@gag.com>  Fri, 22 Dec 2000 14:18:51 -0700

tar (1.13.18-1) unstable; urgency=low

  * new upstream version, closes: #57436, #51889
  * add suggestion for bzip2, closes: #64279
  * this package is pristine upstream source plus the debian/ directory, so
    there should be no issues compiling on any platform, closes: #58171

 -- Bdale Garbee <bdale@gag.com>  Wed, 20 Dec 2000 13:09:44 -0700

tar (1.13.17-2) frozen unstable; urgency=low

  * reconfigure, recompile to fix compile from source problem, closes: #60824

 -- Bdale Garbee <bdale@gag.com>  Thu, 23 Mar 2000 09:27:16 -0700

tar (1.13.17-1) unstable; urgency=low

  * new upstream source from alpha.gnu.org recommended by uptream maintainer
    Paul Eggert.  
  * this version should handle multibyte encoded filenames, closes: #25140
  * upstream says the problem reported with -g is unreproducible in this
    version, closes: #23511
  * this version excludes sockets when building archives, closes: #51064

 -- Bdale Garbee <bdale@gag.com>  Fri,  7 Jan 2000 22:57:34 -0700

tar (1.13.15-1) unstable; urgency=low

  * new upstream source from alpha.gnu.org recommended by uptream maintainer
    Paul Eggert.
  * update to current policy
  * can't reproduce problem with remote host access reported in 1.13.11-2,
    assuming it's fixed, closes: #45647
  * upstream has not picked up our tar.1 manpage, so we'll try to keep it
    up to date, closes: #50856

 -- Bdale Garbee <bdale@gag.com>  Fri,  3 Dec 1999 13:29:41 -0700

tar (1.13.14-5) unstable; urgency=low

  * minor tweaks to clean up our diff, pointed out by the upstream maintainer

 -- Bdale Garbee <bdale@gag.com>  Tue, 23 Nov 1999 09:23:56 -0700

tar (1.13.14-4) unstable; urgency=low

  * update upstream maintainer and copyright references, etc

 -- Bdale Garbee <bdale@gag.com>  Sun, 21 Nov 1999 09:56:26 -0700

tar (1.13.14-3) unstable; urgency=low

  * fix default device in man page, closes: 50856

 -- Bdale Garbee <bdale@gag.com>  Sun, 21 Nov 1999 09:45:32 -0700

tar (1.13.14-2) unstable; urgency=low

  * fold in Torsten's work that closes: #50553
  * upstream folks indicate that $TAPE does not override -f in 1.13.14,
    closes: #47664
  * 1.13.14 has an updated man page that closes: #48603
  * the -X stuff has supposedly been fixed since 1.13.12, closes: #43826
  * rename upstream ChangeLog to changelog in the Debian package to satisfy
    lintian/policy

 -- Bdale Garbee <bdale@gag.com>  Sat, 20 Nov 1999 22:07:46 -0700

tar (1.13.14-1.1) unstable; urgency=low

  * Non maintainer upload.
  * Moved the AC_LINK_FILES in configure.in inside the if (closes: #50553)

 -- Torsten Landschoff <torsten@debian.org>  Sun, 21 Nov 1999 04:25:10 +0100

tar (1.13.14-1) unstable; urgency=low

  * new upstream source from alpha.gnu.org recommended by uptream maintainer
    Paul Eggert.

 -- Bdale Garbee <bdale@gag.com>  Thu, 11 Nov 1999 01:56:54 -0700

tar (1.13.11-2) unstable; urgency=low

  * fix error in man page, closes: #44610
  * patch from upstream that closes: #44827

 -- Bdale Garbee <bdale@gag.com>  Tue, 14 Sep 1999 20:58:23 -0600

tar (1.13.11-1) unstable; urgency=low

  * new upstream source from alpha.gnu.org recommended by uptream maintainer
    Paul Eggert.
  * move to FHS compliance with new debhelper

 -- Bdale Garbee <bdale@gag.com>  Mon,  6 Sep 1999 16:49:51 -0600

tar (1.13.6-1) unstable; urgency=medium

  * new upstream source from alpha.gnu.org recommended by uptream maintainer
    Paul Eggert.
  * bzip2 support is back, now with option '-y' instead of '-I'... rejoice!
    Closes: #42428, #42562, #42572, #42661, #42772
  * Paul claims that the -X option is fixed again, Closes: #42552
  * add mime-support goo, Closes: #26706
  * close bug reports I forgot to close last time, Closes: #33134, #37659

 -- Bdale Garbee <bdale@gag.com>  Wed, 11 Aug 1999 09:20:48 -0600

tar (1.13-3) unstable; urgency=low

  * include more docs in /usr/doc/tar, closes 33134
  * minor tweak to tar.1, closes 37659

 -- Bdale Garbee <bdale@gag.com>  Mon,  2 Aug 1999 00:48:44 -0600

tar (1.13-2) unstable; urgency=low

  * back out hacks we had made to 1.12 that seem to be causing problems in
    1.13, getting essentially to pristine 1.13 source plus debian control files

 -- Bdale Garbee <bdale@gag.com>  Mon,  2 Aug 1999 00:26:49 -0600

tar (1.13-1) unstable; urgency=low

  * new upstream source

 -- Bdale Garbee <bdale@gag.com>  Sun,  1 Aug 1999 23:33:29 -0600

tar (1.12-9) unstable; urgency=low

  * fix some issues with the contest of the po directory in my CVS repository

 -- Bdale Garbee <bdale@gag.com>  Sun,  1 Aug 1999 18:02:35 -0600

tar (1.12-8) unstable; urgency=low

  * update to handle changes in automake

 -- Bdale Garbee <bdale@gag.com>  Wed,  9 Jun 1999 20:15:15 -0600

tar (1.12-7) frozen unstable; urgency=low

  * merge new version of Italian translation, closes 30284
  * merge README.debian with copyright, closes 22370

 -- Bdale Garbee <bdale@gag.com>  Wed,  6 Jan 1999 23:56:47 -0700

tar (1.12-6) frozen unstable; urgency=low

  * update manpage to document -I, closes 21224

 -- Bdale Garbee <bdale@gag.com>  Fri, 17 Apr 1998 23:37:02 -0600

tar (1.12-5) frozen unstable; urgency=low

  * fix for erroneous time reports from --totals from Rob Browning, 
    closes 18345
  * add --numeric-owner to man page, closes 20801
  * add some examples to the man page, closes 20290

 -- Bdale Garbee <bdale@gag.com>  Fri, 10 Apr 1998 00:30:17 -0600

tar (1.12-4) unstable; urgency=low

  * move from debmake to debhelper
  * address lintian error reports
  * apply patch from amanda distribution to fix read errors on sparse files.
    This should close 16694.
  * updated dds2tar patch to restore proper operation of 'v' option.  This was
    causing corrupted archives when stdout was used.  Closes 17857, 17916.

 -- Bdale Garbee <bdale@gag.com>  Mon,  9 Feb 1998 23:52:05 -0700

tar (1.12-3) unstable; urgency=low

  * apply patch to support dds2tar-2.4.15, closes bug 10774
  * apply patch to support use of bzip2, closes bugs 16280, 17221

 -- Bdale Garbee <bdale@gag.com>  Wed,  4 Feb 1998 04:05:43 -0700

tar (1.12-2) unstable; urgency=low

  * libc6
  * Folded in some of Michael Dorman's changes for alpha, which are really
    libc6 changes.  Closes bug 8823.

 -- Bdale Garbee <bdale@gag.com>  Fri,  5 Sep 1997 00:13:00 -0600

tar (1.12-1) unstable; urgency=low

  * New upstream version.

 -- Bdale Garbee <bdale@gag.com>  Fri, 25 Apr 1997 21:15:44 -0600

tar (1.11.8-11) stable frozen unstable; urgency=low

  * back out the change made for 1.11.8-8, since it isn't really effective,
    and caused several folks grief.  Closes bug 8040.

 -- Bdale Garbee <bdale@gag.com>  Tue, 18 Mar 1997 01:38:10 -0700

tar (1.11.8-10) stable frozen unstable; urgency=low

  * rework debian/rules for CFLAGS as per policy.  Closes bug 8065.

 -- Bdale Garbee <bdale@gag.com>  Fri, 14 Mar 1997 21:22:50 -0700

tar (1.11.8-9) unstable; urgency=medium

  * debmake shoved a man page for a porting utility (ansi2knr) that
    is in the tar source tree into the package.  Fixes bug 7408.

 -- Bdale Garbee <bdale@gag.com>  Thu, 27 Feb 1997 01:30:56 -0700

tar (1.11.8-8) unstable; urgency=medium

  * patch from the net for a quasi-security issue.  changes the behavior
    during extracts, so that tar won't create inappropriate setuid files
    from nonexistent users.

 -- Bdale Garbee <bdale@gag.com>  Thu, 6 Feb 1997 23:06:17 -0700

tar (1.11.8-7) unstable; urgency=medium

  * updated to current package standards
  * patch from the net that fixes sporadic multi-vol seg faults

 -- Bdale Garbee <bdale@gag.com>  Sun, 17 Nov 1996 19:37:43 -0700

Fri May 24 08:05:55 MDT 1996	Bdale Garbee	<bdale@gag.com>

  * fold in changes from 1.11.9 configure.in so that we properly
    recognize that it's ok to build 'rmt'
  * administrivia

Sun Apr 14 21:50:21 MDT 1996	Bdale Garbee	<bdale@gag.com>

  * add architecture and section fields to the control file
  * add a man page to squelch the frequent bug reports

Wed Dec 27 00:29:37 MST 1995	Bdale Garbee	<bdale@gag.com>

  * fixed a null pointer dereference when the username on a remote
    tape reference was omitted... this closes several essentially 
    duplicate bug reports about segmentation violation core dumps.

Sun Dec  3 01:13:19 MST 1995	Bdale Garbee	<bdale@gag.com>

  * ELF build
  * add libc5 dependency
  * new maintainer

Local variables:
mode: debian-changelog
End: