Merge version 1:2.4.1+dfsg1-6+rpi1 and 1:2.4.1+dfsg1-6+deb13u2 to produce 1:2.4.1+dfsg1-6+rpi1+deb13u2

Merge dovecot (1:2.4.1+dfsg1-6+deb13u2) import into refs/heads/workingbranch

[PATCH] lib-sieve/sieve-script.c: sieve_script_create_common: Correctly handle errors.

Fixes null pointer deref (e.g. in case of absent file).

Gbp-Pq: Name lib-sieve_sieve-script_c_sieve_script_create_common_Correctly_handle_errors.patch

[PATCH] auth: Terminate properly auth_oauth2_post_setting_defines list

Fixes:
Error: xoauth2: oauth2 failed: Local validation failed: auth_oauth2_fields settings: Failed to parse configuration: settings struct auth_oauth2_fields #1 key mismatch

Gbp-Pq: Name auth__Terminate_properly_auth_oauth2_post_setting_defines.patch

[PATCH] auth: Use AUTH_CACHE_KEY_USER instead of per-database constants

Fixes cache key issue where users would end up overwriting
each other in cache due to cache key being essentially static
string because we no longer support %u.

Forgotten in 2e298e7ee98b6df61cf85117f000290d60a473b8

Gbp-Pq: Name auth__Use_AUTH_CACHE_KEY_USER_instead_of_per-database.patch

[PATCH] Fix LDAP SASL auth support

961275fdb54878fdfa4ee1b9f1a4f00e82bf4a83 moved code without creating a
way to have HAVE_LDAP_SASL defined there.

Copy the preprocessor block from src/auth/db-ldap.c to fix this.

Gbp-Pq: Name bug1106784_Fix-LDAP-SASL-auth-support.patch

Fix groff errors in upstream manpages

Forwarded: no
Last-Update: 2025-05-02

Last-Update: 2025-05-02
Gbp-Pq: Name fix-man-errors.patch

Fix GSSAPI regression

Origin: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/O54EAGLIXXHMOH7BQCCKHHB3Z32HDWVR/
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104549
Last-Update: 2025-05-02

Dovecot 2.4 introduced a regression that broke GSSAPI authentication for
some clients.  This patch contains a fix provided by the upstream maintainers.
Last-Update: 2025-05-02
Gbp-Pq: Name bug1104549-gssapi-regression.patch

fit-32-bit-test-integers

===================================================================

Gbp-Pq: Name fit-32-bit-test-integers.patch

Use _FORTIFY_SOURCE level 3

Forwarded: not-needed

Gbp-Pq: Name Use-_FORTIFY_SOURCE-level-3.patch

[PATCH] lda: Default mail_home=$HOME environment if not using userdb lookup

The previous code to do this was removed by
e57d5b9002f910c095ee5b55821395fcf1da016a

Gbp-Pq: Name 0002-lda-Default-mail_home-HOME-environment-if-not-using-.patch

[PATCH] lda: Fix using USER environment if -d hasn't been specified

This became broken at some point.

Gbp-Pq: Name 0001-lda-Fix-using-USER-environment-if-d-hasn-t-been-spec.patch

Don't try to build doc/rfc subdir components

Forwarded: not-needed

Forwarded: not-needed
Gbp-Pq: Name skip-rfc-subdir.patch

dovecot (1:2.4.1+dfsg1-6+deb13u2) trixie; urgency=medium

  * [6ac2883] Clean up a few typos in default/example config (Closes: #1112667)
  * [7feb544] Ensure default lmtpd auth_username_format matches the global value
    (Closes: #1111469)
  * [216ec20] import upstream patch for improperly terminated auth_oauth2_post_setting_defines
    (Closes: #1116328)
  * [46eab61] lib-sieve/sieve-script.c: sieve_script_create_common: Correctly handle errors.
    (Closes: #1116070)

[dgit import unpatched dovecot 1:2.4.1+dfsg1-6+deb13u2]

Import dovecot_2.4.1+dfsg1-6+deb13u2.debian.tar.xz

[dgit import tarball dovecot 1:2.4.1+dfsg1-6+deb13u2 dovecot_2.4.1+dfsg1-6+deb13u2.debian.tar.xz]

Merge dovecot (1:2.4.1+dfsg1-6+deb13u1) import into refs/heads/workingbranch

[PATCH] auth: Use AUTH_CACHE_KEY_USER instead of per-database constants

Fixes cache key issue where users would end up overwriting
each other in cache due to cache key being essentially static
string because we no longer support %u.

Forgotten in 2e298e7ee98b6df61cf85117f000290d60a473b8

Gbp-Pq: Name auth__Use_AUTH_CACHE_KEY_USER_instead_of_per-database.patch

[PATCH] Fix LDAP SASL auth support

961275fdb54878fdfa4ee1b9f1a4f00e82bf4a83 moved code without creating a
way to have HAVE_LDAP_SASL defined there.

Copy the preprocessor block from src/auth/db-ldap.c to fix this.

Gbp-Pq: Name bug1106784_Fix-LDAP-SASL-auth-support.patch

Fix groff errors in upstream manpages

Forwarded: no
Last-Update: 2025-05-02

Last-Update: 2025-05-02
Gbp-Pq: Name fix-man-errors.patch

Fix GSSAPI regression

Origin: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/O54EAGLIXXHMOH7BQCCKHHB3Z32HDWVR/
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104549
Last-Update: 2025-05-02

Dovecot 2.4 introduced a regression that broke GSSAPI authentication for
some clients.  This patch contains a fix provided by the upstream maintainers.
Last-Update: 2025-05-02
Gbp-Pq: Name bug1104549-gssapi-regression.patch

fit-32-bit-test-integers

===================================================================

Gbp-Pq: Name fit-32-bit-test-integers.patch

Use _FORTIFY_SOURCE level 3

Forwarded: not-needed

Gbp-Pq: Name Use-_FORTIFY_SOURCE-level-3.patch

[PATCH] lda: Default mail_home=$HOME environment if not using userdb lookup

The previous code to do this was removed by
e57d5b9002f910c095ee5b55821395fcf1da016a

Gbp-Pq: Name 0002-lda-Default-mail_home-HOME-environment-if-not-using-.patch

[PATCH] lda: Fix using USER environment if -d hasn't been specified

This became broken at some point.

Gbp-Pq: Name 0001-lda-Fix-using-USER-environment-if-d-hasn-t-been-spec.patch

Don't try to build doc/rfc subdir components

Forwarded: not-needed

Forwarded: not-needed
Gbp-Pq: Name skip-rfc-subdir.patch

dovecot (1:2.4.1+dfsg1-6+deb13u1) trixie-security; urgency=high

  * Import upstream fix for an issue with authentication cache management that
    could result in users being logged in as the wrong user in certain
    configurations. (Closes: #1115964)

[dgit import unpatched dovecot 1:2.4.1+dfsg1-6+deb13u1]

Import dovecot_2.4.1+dfsg1-6+deb13u1.debian.tar.xz

[dgit import tarball dovecot 1:2.4.1+dfsg1-6+deb13u1 dovecot_2.4.1+dfsg1-6+deb13u1.debian.tar.xz]

Merge version 1:2.4.1+dfsg1-5+rpi1 and 1:2.4.1+dfsg1-6 to produce 1:2.4.1+dfsg1-6+rpi1

Merge version 1:2.4.1+dfsg1-4+rpi1 and 1:2.4.1+dfsg1-5 to produce 1:2.4.1+dfsg1-5+rpi1

Merge dovecot (1:2.4.1+dfsg1-6) import into refs/heads/workingbranch

[PATCH] Fix LDAP SASL auth support

961275fdb54878fdfa4ee1b9f1a4f00e82bf4a83 moved code without creating a
way to have HAVE_LDAP_SASL defined there.

Copy the preprocessor block from src/auth/db-ldap.c to fix this.

Gbp-Pq: Name bug1106784_Fix-LDAP-SASL-auth-support.patch

Fix groff errors in upstream manpages

Forwarded: no
Last-Update: 2025-05-02

Last-Update: 2025-05-02
Gbp-Pq: Name fix-man-errors.patch

Fix GSSAPI regression

Origin: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/O54EAGLIXXHMOH7BQCCKHHB3Z32HDWVR/
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104549
Last-Update: 2025-05-02

Dovecot 2.4 introduced a regression that broke GSSAPI authentication for
some clients.  This patch contains a fix provided by the upstream maintainers.
Last-Update: 2025-05-02
Gbp-Pq: Name bug1104549-gssapi-regression.patch

fit-32-bit-test-integers

===================================================================

Gbp-Pq: Name fit-32-bit-test-integers.patch

Use _FORTIFY_SOURCE level 3

Forwarded: not-needed

Gbp-Pq: Name Use-_FORTIFY_SOURCE-level-3.patch

[PATCH] lda: Default mail_home=$HOME environment if not using userdb lookup

The previous code to do this was removed by
e57d5b9002f910c095ee5b55821395fcf1da016a

Gbp-Pq: Name 0002-lda-Default-mail_home-HOME-environment-if-not-using-.patch

[PATCH] lda: Fix using USER environment if -d hasn't been specified

This became broken at some point.

Gbp-Pq: Name 0001-lda-Fix-using-USER-environment-if-d-hasn-t-been-spec.patch

Don't try to build doc/rfc subdir components

Forwarded: not-needed

Forwarded: not-needed
Gbp-Pq: Name skip-rfc-subdir.patch

dovecot (1:2.4.1+dfsg1-6) unstable; urgency=medium

  * [8c6ba88] Fix LDAP SASL auth support (Closes: #1106784)
  * [fac9131] Avoid -fstack-clash-protection on hppa architecture
    (Closes: #1107609)
  * [071beb5] d/control: update Uploaders to reflect the current reality

[dgit import unpatched dovecot 1:2.4.1+dfsg1-6]

Import dovecot_2.4.1+dfsg1-6.debian.tar.xz

[dgit import tarball dovecot 1:2.4.1+dfsg1-6 dovecot_2.4.1+dfsg1-6.debian.tar.xz]

Merge dovecot (1:2.4.1+dfsg1-5) import into refs/heads/workingbranch

Fix groff errors in upstream manpages

Forwarded: no
Last-Update: 2025-05-02

Last-Update: 2025-05-02
Gbp-Pq: Name fix-man-errors.patch

Fix GSSAPI regression

Origin: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/O54EAGLIXXHMOH7BQCCKHHB3Z32HDWVR/
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104549
Last-Update: 2025-05-02

Dovecot 2.4 introduced a regression that broke GSSAPI authentication for
some clients.  This patch contains a fix provided by the upstream maintainers.
Last-Update: 2025-05-02
Gbp-Pq: Name bug1104549-gssapi-regression.patch

fit-32-bit-test-integers

===================================================================

Gbp-Pq: Name fit-32-bit-test-integers.patch

Use _FORTIFY_SOURCE level 3

Forwarded: not-needed

Gbp-Pq: Name Use-_FORTIFY_SOURCE-level-3.patch

[PATCH] lda: Default mail_home=$HOME environment if not using userdb lookup

The previous code to do this was removed by
e57d5b9002f910c095ee5b55821395fcf1da016a

Gbp-Pq: Name 0002-lda-Default-mail_home-HOME-environment-if-not-using-.patch

[PATCH] lda: Fix using USER environment if -d hasn't been specified

This became broken at some point.

Gbp-Pq: Name 0001-lda-Fix-using-USER-environment-if-d-hasn-t-been-spec.patch

Don't try to build doc/rfc subdir components

Forwarded: not-needed

Forwarded: not-needed
Gbp-Pq: Name skip-rfc-subdir.patch

dovecot (1:2.4.1+dfsg1-5) unstable; urgency=medium

  * [e6e5ef7] Fix typo in conf.d/auth-passwdfile.conf.ext (Closes: #1106072)
  * [2a34ed0] Import upstream fix for dovecot-lda data loss (Closes: #1106485)
  * [6c287ea] Fix typo in doveadm-fetch(1) (Closes: #1106533)
  * [11f8b62] Fix invalid metadata in debian/patches/skip-rfc-subdir.patch

[dgit import unpatched dovecot 1:2.4.1+dfsg1-5]

Import dovecot_2.4.1+dfsg1-5.debian.tar.xz

[dgit import tarball dovecot 1:2.4.1+dfsg1-5 dovecot_2.4.1+dfsg1-5.debian.tar.xz]

Merge version 1:2.3.21.1+dfsg1-1+rpi1 and 1:2.4.1+dfsg1-4 to produce 1:2.4.1+dfsg1-4+rpi1

Merge dovecot (1:2.4.1+dfsg1-4) import into refs/heads/workingbranch

Fix groff errors in upstream manpages

Forwarded: no
Last-Update: 2025-05-02

Last-Update: 2025-05-02
Gbp-Pq: Name fix-man-errors.patch

Fix GSSAPI regression

Origin: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/message/O54EAGLIXXHMOH7BQCCKHHB3Z32HDWVR/
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104549
Last-Update: 2025-05-02

Dovecot 2.4 introduced a regression that broke GSSAPI authentication for
some clients.  This patch contains a fix provided by the upstream maintainers.
Last-Update: 2025-05-02
Gbp-Pq: Name bug1104549-gssapi-regression.patch

fit-32-bit-test-integers

===================================================================

Gbp-Pq: Name fit-32-bit-test-integers.patch

Use _FORTIFY_SOURCE level 3

Forwarded: not-needed

Gbp-Pq: Name Use-_FORTIFY_SOURCE-level-3.patch

Don't try to build doc/rfc subdir components

Forwarded: no (Debian-specific)

Gbp-Pq: Name skip-rfc-subdir.patch

dovecot (1:2.4.1+dfsg1-4) unstable; urgency=medium

  * [235de56] managesieved: lintian: suppress library-not-linked-against-libc
  * [74e7dcd] Ensure we use a 32-bit time_t on i386
  * [461bc68] dovecot-core: postinst: fix purge of obsolete ucf conf files
    (Closes: #1105003)

[dgit import unpatched dovecot 1:2.4.1+dfsg1-4]

Import dovecot_2.4.1+dfsg1-4.debian.tar.xz

[dgit import tarball dovecot 1:2.4.1+dfsg1-4 dovecot_2.4.1+dfsg1-4.debian.tar.xz]

Import dovecot_2.4.1+dfsg1.orig.tar.gz

[dgit import orig dovecot_2.4.1+dfsg1.orig.tar.gz]

Import dovecot_2.4.1+dfsg1.orig-pigeonhole.tar.gz

[dgit import orig dovecot_2.4.1+dfsg1.orig-pigeonhole.tar.gz]

Merge version 1:2.3.21+dfsg1-3+rpi1 and 1:2.3.21.1+dfsg1-1 to produce 1:2.3.21.1+dfsg1-1+rpi1

Merge dovecot (1:2.3.21.1+dfsg1-1) import into refs/heads/workingbranch

Silence prototype conflicts

Forwarded: https://github.com/dovecot/core/pull/206

    program-client.c:705:5: warning: conflicting types for 'program_client_run' due to enum/integer mismatch; have 'int(struct program_client *)' [-Wenum-int-mismatch]
      705 | int program_client_run(struct program_client *pclient)
          |     ^~~~~~~~~~~~~~~~~~
    In file included from program-client-private.h:4,
                     from program-client.c:17:
    program-client.h:93:1: note: previous declaration of 'program_client_run' with type 'enum program_client_exit_status(struct program_client *)'
       93 | program_client_run(struct program_client *pclient);
          | ^~~~~~~~~~~~~~~~~~

    db-lua.c:599:1: warning: conflicting types for 'auth_lua_call_password_verify' due to enum/integer mismatch; have 'enum passdb_result(struct dlua_script *, struct auth_request *, const char *, const char **)' [-Wenum-int-mismatch]
      599 | auth_lua_call_password_verify(struct dlua_script *script,
          | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from db-lua.c:28:
    db-lua.h:14:5: note: previous declaration of 'auth_lua_call_password_verify' with type 'int(struct dlua_script *, struct auth_request *, const char *, const char **)'
       14 | int auth_lua_call_password_verify(struct dlua_script *script,
          |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Gbp-Pq: Name Silence-prototype-conflicts.patch

Cleanup temporary build files

Forwarded: https://github.com/dovecot/core/pull/207

Support building twice:

    dpkg-source: info: local changes detected, the modified files are:
     source/src/plugins/quota/rquota.h.tmp
     source/src/plugins/quota/rquota_xdr.c.tmp

Gbp-Pq: Name Cleanup-temporary-build-files.patch

Use _FORTIFY_SOURCE level 3

Forwarded: not-needed

Gbp-Pq: Name Use-_FORTIFY_SOURCE-level-3.patch

Fix uninitialized read in doveadm-oldstats

The third argument to doveadm_cmd_param_bool() is only set on a return
value of TRUE.
Since disk_input_field and disk_output_field should be set if the value
of show-disk-io is specified and specified to true, fix the condition.

    doveadm-oldstats.c: In function 'cmd_stats_top':
    doveadm-oldstats.c:551:63: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized]
      551 |         if (!doveadm_cmd_param_bool(cctx, "show-disk-io", &b) && b) {
          |                                                               ^
    doveadm-oldstats.c:545:14: note: 'b' was declared here
      545 |         bool b;
          |              ^

Gbp-Pq: Name Fix-uninitialized-read-in-doveadm-oldstats.patch

auth: Add a comment about updating userdb_find()

Gbp-Pq: Name auth-Add-a-comment-about-updating-userdb_find.patch

auth: Fix handling passdbs with identical driver/args but different mechanisms/username_filter

The passdb was wrongly deduplicated in this situation, causing wrong
mechanisms or username_filter setting to be used. This would be a rather
unlikely configuration though.

Fixed by moving mechanisms and username_filter from struct passdb_module
to struct auth_passdb, which is where they should have been in the first
place.

Gbp-Pq: Name auth-Fix-handling-passdbs-with-identical-driver-args-but-.patch

Avoid usage of PATH_MAX not available on hurd

Forwarded: https://github.com/dovecot/core/pull/208

Gbp-Pq: Name Avoid-usage-of-PATH_MAX-not-available-on-hurd.patch

Debug flaky unit test

See #1007744

Gbp-Pq: Name Debug-flaky-unit-test.patch

Support openssl 3.0

Forwarded: not-needed

Gbp-Pq: Name Support-openssl-3.0.patch

md4/md5: disable optimization causing unaligned access

This restores unit tests with GCC 11 and LTO.

    md5.c:92:23: warning: cast from 'const unsigned char *' to 'const uint32_t *' (aka 'const unsigned int *') increases required alignment from 1 to 4 [-Wcast-align]
                    STEP(F, a, b, c, d, SET(0), 0xd76aa478, 7)
                    ~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~
    md5.c:51:4: note: expanded from macro 'SET'
            (*(const uint32_t *)&ptr[(n) * 4])
              ^
    md5.c:37:29: note: expanded from macro 'STEP'
            (a) += f((b), (c), (d)) + (x) + (t); \
                                       ^

    md5.c:92:3: runtime error: load of misaligned address 0x61900000008b for type 'const uint32_t' (aka 'const unsigned int'), which requires 4 byte alignment
    0x61900000008b: note: pointer points here
     41  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41 41  41 41 41 41 41 41 41
                  ^

Gbp-Pq: Name md4-md5-disable-optimization-causing-unaligned-access.patch

Silence LTO related compiler warning

master-service-settings-cache.c: In function 'master_service_settings_cache_init_filter':
master-service-settings-cache.c:94:3: warning: 'error' may be used uninitialized in this function [-Wmaybe-uninitialized]
   94 |   i_error("master-service: cannot get filters: %s", error);
      |   ^
master-service-settings-cache.c:89:14: note: 'error' was declared here
   89 |  const char *error;
      |              ^

Gbp-Pq: Name Silence-LTO-related-compiler-warning.patch

Improve cross-compile support

The check for the signedness of size_t really doesn't have to be run as
that is a compile time property.

Beyond that, dovecot uses mysql_config. I've looked into that and
mysql_config is unfixably broken during cross builds. It will not be
fixed. Instead, please use pkg-config. My patch implements that with a
fallback to mysql_config to avoid breaking other users.

Last but not least, src/lib-lua/Makefile.am adds $(LUA_LIBS) to
libdovecot_lua_la_DEPENDENCIES. As it happens, LUA_LIBS contains a -L
flag and when that flag shows up in a dependency, make gives up. I have
no clue why one would add LUA_LIBS to DEPENDENCIES as it already is
being correctly added to LIBADD. My patch suggests to quite simply drop
that.

Gbp-Pq: Name Improve-cross-compile-support.patch

Fix 32bit sign comparisons

sieve-binary.c: In function 'sieve_binary_get_resource_usage':
sieve-binary.c:199:54: warning: comparison of integer expressions of different signedness: 'time_t' {aka 'long int'} and 'unsigned int' [-Wsign-compare]
  199 |  if (update_time != 0 && (ioloop_time - update_time) > timeout)
      |                                                      ^

Gbp-Pq: Name Fix-32bit-sign-comparisons.patch

doveadm-director.1: drop acute accent

Found by Lintian:

    This manual page uses the \' groff sequence. Usually, the intent to
    generate an apostrophe, but that sequence actually renders as a an acute
    accent.

    For an apostrophe or a single closing quote, use plain '. For single
    opening quote, i.e. a straight downward line ' like the one used in
    shell commands, use \(aq.

Gbp-Pq: Name doveadm-director.1-drop-acute-accent.patch

Updates the symbol to check for in the backtrace unit tests

Updates the symbol to check for in the backtrace unit tests to
something that appears in all the traces on the platforms we support.

Also dump the actual backtrace for debugging buildd failures.

Gbp-Pq: Name test-backtrace.patch

Correct misspellings

Found by Lintian

Gbp-Pq: Name Correct-misspellings.patch

Don't try to build doc/rfc subdir components

Forwarded: no (Debian-specific)

Gbp-Pq: Name skip-rfc-subdir.patch

Set DH params location

Forwarded: not-needed

This is mandatory for SSL support in 2.3

Gbp-Pq: Name ssl-dh-params-location.patch

Update Dovecot name to include Distribution in login greeting message

This patch was found at: https://blueprints.launchpad.net/ubuntu/+spec/servercloud-s-server-app-banner-updates
and originally provided by Ubuntu for their 2.1.7 package.  The original
author is  Yolanda Robla <yolanda.robla@canonical.com>.  I updated it
for Debian's 2.2.5 package.

Last-Update: 2020-05-23

Gbp-Pq: Name dovecot_name.patch

policy 22.6 compliant mbox write locking

For NFS safety, prefer fcntl to dotlocks.
Dovecots default is the other way around.

Bug: #720502

Gbp-Pq: Name mboxlocking.patch

default location for user mailboxes

Bug: #623440
Last-Update: 2017-09-20

Set a default for the case where a user has no mail so auto-
detection of mailboxes doesn't work.

Gbp-Pq: Name default-mail_location.patch

Add TCP wrapper support

Bug: #685850

Configuration file for TCP wrapper support.

Gbp-Pq: Name tcpwrapper.patch

SSL cert location

Last-Update: Sun, 30 Nov 2014 23:59:07 -0500
Bug: #608719

Move dovecots generated X.509 certificate out of /etc/ssl where
it doesn't belong.

Gbp-Pq: Name ssl-cert-location.patch

fix mail_plugin_dir default

Bug: #624294

Fix mail_plugin_dir default value in conf.d/10-mail.conf

Gbp-Pq: Name fix-mail_plugin_dir-default.patch

split-protocols

Updated: Mon, 25 Nov 2013 20:11:59 -0500
Forwarded: no (Debian-specific)

Set default protocols value as empty and enable each
protocol in its own configuration file

Gbp-Pq: Name split-protocols.patch

dovecot (1:2.3.21.1+dfsg1-1) unstable; urgency=medium

  [ Noah Meyerhans ]
  * [452a10b] Move systemd unit files to /usr (Closes: #1071915)

  [ Niels Thykier ]
  * [a9caf51] Avoid unnecessary implicit requirement for `(fake)root`

  [ Christian Göttsche ]
  * [8c253d1] salsa-ci: enable build_twice job
  * [47122cd] Bump to standards version 4.7.0 (no further changes)
  * [4062094] Replace obsolete build-dependency pkg-config with pkgconf
  * [f1221b8] Split overlong line in changelog
  * [dd876aa] Annotate Debian patches
  * [590287e] Fix typos in changelog

  [ Noah Meyerhans ]
  * [a212eb8] New upstream version 2.3.21.1+dfsg1
    - Fix CVE-2024-23185 (Closes: #1078877)
    - Fix CVE-2024-23185 (Closes: #1078877)

[dgit import unpatched dovecot 1:2.3.21.1+dfsg1-1]

Import dovecot_2.3.21.1+dfsg1.orig.tar.gz

[dgit import orig dovecot_2.3.21.1+dfsg1.orig.tar.gz]

Import dovecot_2.3.21.1+dfsg1.orig-pigeonhole.tar.gz

[dgit import orig dovecot_2.3.21.1+dfsg1.orig-pigeonhole.tar.gz]

Import dovecot_2.3.21.1+dfsg1-1.debian.tar.xz

[dgit import tarball dovecot 1:2.3.21.1+dfsg1-1 dovecot_2.3.21.1+dfsg1-1.debian.tar.xz]

Merge dovecot (1:2.3.21+dfsg1-3+rpi1) import into refs/heads/workingbranch

Silence prototype conflicts

Forwarded: https://github.com/dovecot/core/pull/206

    program-client.c:705:5: warning: conflicting types for 'program_client_run' due to enum/integer mismatch; have 'int(struct program_client *)' [-Wenum-int-mismatch]
      705 | int program_client_run(struct program_client *pclient)
          |     ^~~~~~~~~~~~~~~~~~
    In file included from program-client-private.h:4,
                     from program-client.c:17:
    program-client.h:93:1: note: previous declaration of 'program_client_run' with type 'enum program_client_exit_status(struct program_client *)'
       93 | program_client_run(struct program_client *pclient);
          | ^~~~~~~~~~~~~~~~~~

    db-lua.c:599:1: warning: conflicting types for 'auth_lua_call_password_verify' due to enum/integer mismatch; have 'enum passdb_result(struct dlua_script *, struct auth_request *, const char *, const char **)' [-Wenum-int-mismatch]
      599 | auth_lua_call_password_verify(struct dlua_script *script,
          | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from db-lua.c:28:
    db-lua.h:14:5: note: previous declaration of 'auth_lua_call_password_verify' with type 'int(struct dlua_script *, struct auth_request *, const char *, const char **)'
       14 | int auth_lua_call_password_verify(struct dlua_script *script,
          |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Gbp-Pq: Name Silence-prototype-conflicts.patch

Cleanup temporary build files

Forwarded: https://github.com/dovecot/core/pull/207

Support building twice:

    dpkg-source: info: local changes detected, the modified files are:
     source/src/plugins/quota/rquota.h.tmp
     source/src/plugins/quota/rquota_xdr.c.tmp

Gbp-Pq: Name Cleanup-temporary-build-files.patch

Use _FORTIFY_SOURCE level 3

Gbp-Pq: Name Use-_FORTIFY_SOURCE-level-3.patch

Fix uninitialized read in doveadm-oldstats

The third argument to doveadm_cmd_param_bool() is only set on a return
value of TRUE.
Since disk_input_field and disk_output_field should be set if the value
of show-disk-io is specified and specified to true, fix the condition.

    doveadm-oldstats.c: In function 'cmd_stats_top':
    doveadm-oldstats.c:551:63: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized]
      551 |         if (!doveadm_cmd_param_bool(cctx, "show-disk-io", &b) && b) {
          |                                                               ^
    doveadm-oldstats.c:545:14: note: 'b' was declared here
      545 |         bool b;
          |              ^

Gbp-Pq: Name Fix-uninitialized-read-in-doveadm-oldstats.patch

auth: Add a comment about updating userdb_find()

Gbp-Pq: Name auth-Add-a-comment-about-updating-userdb_find.patch

auth: Fix handling passdbs with identical driver/args but different mechanisms/username_filter

The passdb was wrongly deduplicated in this situation, causing wrong
mechanisms or username_filter setting to be used. This would be a rather
unlikely configuration though.

Fixed by moving mechanisms and username_filter from struct passdb_module
to struct auth_passdb, which is where they should have been in the first
place.

Gbp-Pq: Name auth-Fix-handling-passdbs-with-identical-driver-args-but-.patch

Avoid usage of PATH_MAX not available on hurd

Forwarded: https://github.com/dovecot/core/pull/208

Gbp-Pq: Name Avoid-usage-of-PATH_MAX-not-available-on-hurd.patch