openldap (2.4.42+dfsg-2) unstable; urgency=medium

openldap (2.4.42+dfsg-2) unstable; urgency=medium

  [ Ryan Tandy ]
  * Change explicit Pre-Depends: multiarch-support to ${misc:Pre-Depends}, as
    recommended by lintian.
  * Omit slapd, slapd-dbg, and slapd-smbk5pwd from the stage1 build profile.
    This allows the dependency loop with heimdal to be broken for
    bootstrapping, and the dependency on libperl-dev to be avoided for
    cross-building. Thanks Daniel Schepler and Helmut Grohne.
    (Closes: #724518)
  * Apply wrap-and-sort to the Build-Depends field.
  * Drop libncurses5-dev from Build-Depends, no longer needed since the ud
    tool was removed in OpenLDAP 2.1.4.
  * Drop libltdl3-dev as an alternate Build-Depends, since that package was
    removed after lenny.
  * Annotate Build-Depends on perl with :any to allow running the system perl
    interpreter during cross builds.
  * Ensure CC is set correctly for cross builds. Thanks Helmut Grohne.
  * Build-Depend on dpkg-dev (>= 1.17.14) and debhelper (>= 9.20141010) for
    restriction formula support.
  * Override the 'dev-pkg-without-shlib-symlink' lintian tag. The symlink is
    actually in the form libldap_r.so -> libldap_r-2.4.so.xyz and the tag is a
    false positive; see #687022.
  * Include the smbk5pwd man page in the slapd-smbk5pwd package.
  * Allow anonymous read access to the shadowLastChange attribute by default,
    allowing nss-ldap/nss-ldapd to handle password expiry correctly even when
    bound anonymously. This was the only restricted shadow attribute, the
    others were already world-readable. (Closes: #669235)
  * Drop the redundant default ACL for dn.base="" from the database entry.
    It's already covered by the fallback case below.
  * Copy more comments from the slapd.conf template to slapd.init.ldif. Also
    comment the shadowLastChange access rule.
  * Import upstream patch to remove an unnecessary assert(0) that could be
    triggered remotely by an unauthenticated user by sending a malformed BER
    element. (ITS#8240)

  [ Peter Marschall ]
  * Add a manual page slapo-smbk5pwd.5 and update smbk5pwd's Makefile to
    install the new manual page. (Closes: #794998)

[dgit import unpatched openldap 2.4.42+dfsg-2]