Change log for asterisk package in Debian

asterisk (1:1.6.2.6-1) unstable; urgency=low


  * New upstream release.
    - Fixes AST-2010-003 - CVE-2010-1224 (Closes: #576560).
  * Patch h323-fix-makefile dropped: merged upstream.
  * Patch safe_asterisk-config: Mostly merged upstream. 
  * Patch moh_datadir: Make the datadir the default base for moh files
    if a relative path is used.
  * Patch dahdi-fxsks-hookstate: a newer version. 
  * sounds/en/ is now an alternative. English sounds installed to
    en_US_f_Allison .
  * Removed empty es/ and fr/ directories under sounds/ 
  * Patch settings_show_dirs: display the user values of more configurable
    items. 
  * Patch dahdi_fxs_false_ringing: Fix having Astribank FXS-s keep ringing if
    answered too soon. 
  * Patch followme_prompts: set proper vars when reading followme.conf
  * Patch sqlite3_func_rename: Avoid issues with the name sqlite3_log . 
  * Patch h323-extra-target: Allow manuallly generate channels/h323/Makefile.ast
  * And use it to generate the file before building, as otherwise some libs
    are missing from the link command, resulting in chan_h323.so load fail.

 -- Tzafrir Cohen <email address hidden>  Sat, 10 Apr 2010 21:18:39 +0300

asterisk (1:1.6.2.2-1) unstable; urgency=medium


  [ Faidon Liambotis ]
  * Relax Debian revision parsing regexp in debian/rules to help with parsing
    derivatives (e.g. Ubuntu) and backports.org revisions.
  * Urgency medium because of a security fix upload.
  * Bump Standards-Version to 3.8.4, no changes needed.
  * Add ${misc:Depends} on all packages; no functional change, just makes
    lintian happier.
  * Use $remote_fs instead of $local_fs in init script's Required-{Start,Stop}
    since we use /usr. Thanks lintian!

  [ Tzafrir Cohen ]
  * New upstream release. Fixes CVE-2010-0441 (AST-2010-001).
  * Patch sound_files: configure asterisk not to download the new MoH files.
  * Move sound files tarball to a safe place, as the patch we used to
    protect them is aparantly not in effect at clean time.

 -- Faidon Liambotis <email address hidden>  Sun, 07 Feb 2010 15:13:47 +0200

asterisk (1:1.4.21.2~dfsg-3+lenny1) stable-security; urgency=high


  * Multiple security fixes:
    - "Information leak in IAX2 authentication", AST-2009-001, CVE-2009-0041.
    - "Remote Crash Vulnerability in SIP channel driver", AST-2009-002.
    - "SIP responses expose valid usernames", AST-2009-003, CVE-2008-3903.
      (Closes: #522528)
    - "SIP responses expose valid usernames", AST-2009-008, CVE-2009-3727.
      (Closes: #554487)
    - Stop shipping old static-http code in examples. Among other things, it
      includes a vulnerable version of the prototype Javascript library.
      AST-2009-009, CVE-2008-7220. (Closes: #554486)
    - "RTP Remote Crash Vulnerability", AST-2009-010, CVE-2009-4055.
      (Closes: #559103)

 -- Faidon Liambotis <email address hidden>  Mon, 14 Dec 2009 01:11:44 +0200

asterisk (1:1.6.2.0-1) unstable; urgency=low


  * New upstream release.
  * Use DEP3 to tag all of our patches and their merge status.

 -- Faidon Liambotis <email address hidden>  Mon, 21 Dec 2009 06:19:38 +0200

asterisk (1:1.6.2.0~rc7-1) unstable; urgency=high


  * New upstream release candidate.
    - Fixes RTP comfort noise issues: CVE-2009-4055 (Closes: #559103).

 -- Tzafrir Cohen <email address hidden>  Wed, 02 Dec 2009 20:47:02 +0200

asterisk (1:1.6.2.0~rc3-2) unstable; urgency=high


  [ Faidon Liambotis ]
  * Really ship MoH sounds, as mentioned in the rc1 upload.
  * Move dahdi to Should-Start instead of Required-Start in the init script.
    (Closes: #552604)
  * Security fix: "ACL check not present for verifying SIP INVITEs",
    AST-2009-007. (Closes: #552756)
  * Urgency high because of security fix upload.

  [ Tzafrir Cohen ]
  * Add a sample startup init script. Not installed.
  * Add mysql and postgresql to Should-Start/Stop: Asterisk may use them
    in real-time mode.

 -- Faidon Liambotis <email address hidden>  Thu, 29 Oct 2009 21:38:55 +0200

asterisk (1:1.6.2.0~rc3-1) unstable; urgency=low


  * New upstream RC.
    - Session timer is not activated if Supported header field in INVITE has
      both "timer" and other option(s) (Closes: #552336)
    - Adapt patches/hack-multiple-app-voicemail.
  * Switch from libreadline5-dev to libreadline-dev build dependency.
  * Switch from libc-client2007b-dev to libc-client2007e-dev build dependency.
  * No need for repacking anymore; upstream removed the last piece of non-free
    material (IAXy's firmware) from the tarball upon our request.
    Thanks Digium!
  * Remove patches/debian-banner, no need to warn users to use our BTS
    anymore as we don't diverge that much nowadays.
  * Multiple fixes to init script: call 'core stop now' instead of 'stop now',
    kill the canary on stop, don't print the banner on start.
  * Temporarily remove OSP support, Asterisk needs a new version (3.5) that
    isn't yet in Debian.
  * Add sox to Recommends, used by res_monitor.
  * Remove ekiga, ohphone, twinkle, kphone from Suggests.
  * Cleanup the documentation provided in the asterisk-doc package.
    (Closes: #499215)
  * Cleanup cruft present in diff.gz after a double build.
  * Stop shipping old static-http code in examples. Among other things, it
    includes a vulnerable version of the prototype Javascript library.
  * Remove obsolete debian/backports/{etch,edgy,feisty}.

 -- Faidon Liambotis <email address hidden>  Mon, 26 Oct 2009 02:03:45 +0200

asterisk (1:1.6.2.0~dfsg~rc1-1) unstable; urgency=low


  [ Faidon Liambotis ]
  * New upstream release.
    - Fixes CVE-2009-2726 aka AST-2009-005 (Closes: #541441).
    - Ship CC BY-SA 3.0 licensed music-on-hold sounds, replacing the old
      non-free FreePlay Music that were never distributed by Debian.
    - Removed patches/makefile_appdocs_dtd (merged upstream) and
      patches/disable_moh (obsoleted, see above).
  * Fix FTBFS on armel. (Closes: #532971)
  * Bump Standards-Version to 3.8.3, no changes needed.
  * Provides: asterisk-1.6.2, instead of 1.6.1; there are no ABI gurantees
    between 1.6.x releases.
  * Remove references of Section: comm in individual binary packages as it is
    inherited from the source package.

  [ Tzafrir Cohen ]
  * Patch hardware_dtmf_mute_fix removed: Applied upstream.
  * No need for a separate app_directory_odbc (will use app_voicemail_odbc).
  * Fix name of voicemail 'openssl' dep. (Thomas Renard) (Closes: #539150)
  * Patch AST-2009-006: breaks IAX2 compatibility, note it in NEWS.Debian.
    (Closes: #539473)

 -- Faidon Liambotis <email address hidden>  Sun, 13 Sep 2009 02:22:17 +0300

asterisk (1:1.6.2.0~dfsg~beta3-1) unstable; urgency=low


  [ Faidon Liambotis ]
  * New upstream release.
    - Drop patches astvarrundir, pubkey_jnctn; merged upstream (finally!).
    - Adapt patch safe_asterisk-nobg.
  * Switch to downloads.asterisk.org instead of downloads.digium.com.
  * Add depends on libxml2-dev for the new XML documentation.
  * Remove Conflicts/Replaces with asterisk-classic, asterisk-bristuff,
    asterisk-chan-capi (<< 1.1.1-1~), since those are pre-lenny.
  * Revert upstream's r190830 that ported app_osplookup to OSP Toolkit 3.5;
    the API is not backwards compatible and Debian still has 3.4.2.
  * Accommodate for the rename of libcap2-dev to libcap-dev (Closes: #532971).
  * Add dependency to libspandsp to build the fax applications.
  * Update Standards-Version to 3.8.2, no changes needed.
  * Remove init script's "zaptel-fix" action; there's no zaptel anymore and
    was also lintian-buggy in its current form.
  * Don't include /var/run/asterisk in the package, it is created at boot-time
    by the init script (thanks lintian).
  * Remove asterisk-progdocs: it is of very limited use but a) is enormous in
    size and b) takes too long to build.
  * Re-enable and port to 1.6 the h323 segfault patch, apparently it's still
    needed.
  * Fix asterisk's Makefiles so that the openh323/libpt dependencies are added
    to chan_h323.so instead of the main asterisk binary.
  * Fix astgenkey to respect system's umask. Thanks Jonas Smedegaard.
    (Closes: #531730) 
  * Create /var/log/asterisk/* directories if non-existent, for /var/log on
    tmpfs scenarios. Thanks martin f krafft! (Closes: #524015)
  * Use the lsb-base standard way of gathering and reporting status in the
    init script. Thanks Dustin Kirkland and Ubuntu! (Closes: #506453)
  * Fix debian/rules so that configure isn't called twice during a build.
  * Install Zaptel-to-DAHDI.txt, explains the migration procedure from Zaptel
    to DAHDI and is therefore useful when upgrading from lenny.

  [ Tzafrir Cohen ]
  * New upstream release.
    - Fixes that bashism in safe_asterisk (Closes: #530047) (not dashism).
    - Dropped patch astcanary_startup: merged upstream.
  * Patch makefile_appdocs_dtd: fix location of DTD installation.
  * Register the HTML docs with doc-base as well.

 -- Faidon Liambotis <email address hidden>  Tue, 28 Jul 2009 03:42:54 +0300

asterisk (1:1.6.1.0~dfsg-1) unstable; urgency=low


  * New upstream release (Closes: #522528).

  [ Tzafrir Cohen ]
  * Depend explicitly on dahdi.
  * Patch apptest_sleep dropped: merged upstream.
  * Patch libtonezone_libm dropped: merged upstream.
  * Patch h323-make-fix dropped: merged upstream.
  * Use upstream's asterisk.conf rather than our bogus one.
  * Also add the version-specific release summary. 
  * Patch dahdi_ptmp_nt: (not really) chan_dahdi PtMP NT support 
    (Kristijan Vrban).
  * Patch dahdi_pri_debug_spannums: add span number in PRI trace. 
  * Patch astcanary_startup: Avoid a false death of the canary 
    (Closes: #528497).
  * Patch hardware_dtmf_mute_fix: Fix muting of DAHDI channels with hardware
    DTMF detection.

 -- Mark Purcell <email address hidden>  Wed, 20 May 2009 08:00:23 +1000

asterisk (1:1.4.21.2~dfsg-3.1) unstable; urgency=low


  * Non-maintainer upload.
  * Fix for IAX2 encrypted channels dropping out due to normal packet loss
    (closes: #521641)

 -- Francois Marier <email address hidden>  Sun, 26 Apr 2009 12:12:20 +1200

asterisk (1:1.6.1.0~dfsg~rc3-1) experimental; urgency=low


  [ Tzafrir Cohen ]
  * Experimental 1.6.x branch.
  * Remove bristuff for now.
  * Also drop zap-fix-deadlock and zap-fix-cause34 that are in bristuff code.
  * And likewise the example agi/xagi-test.c .
  * Drop patch silence-buildsum-warning - a legitimate change for 1.6.x .
  * Refresh patch debian-banner.
  * Slightly rework patch hack-multiple-app-voicemail
  * Drop patch h323 fixes as they fails and I don't fully understand them.
  * drop patch func_devstate: was backport from 1.6.
  * drop patch feature-bridge: was backport from 1.6.
  * Drop vpb-handle-nocards that is not needed anymore.
  * Patch disable_moh: Disable MOH file through the XML spec.
  * Don't do ant makeopts manipulation in the rules, as makeopts gets 
    regenerated when running 'make install', rendering build-*-stamp 
    useless.
  * Patch libtonezone_libm: libtonezone requires -lm .
  * Separate API documentation to the progdoc package.
  * Move configuration files to the doc package, as they are reference.
  * Include the new asterisk.pdf .
  * Depend on libgmime: allows uploads in the built-in httpd.
  * Depend on libjack. Though app_jack also depends on libresample.
  * Depend on liblua: For pbx_lua (dialplan in lua).
  * Depend on libss7 and newer libpri (1.4.7) for latest chan_dahdi abilities.
  * Depend on libtonezone from dahdi (ver. 2.0).
  * Includes fix for AST-2009-001 (Closes: #513413).
  * Remove hashtest and hashtest2: debugging utilities.
  * Patch zap-fix-timing-source removed: Problem fixed.
  * Build-Depends on libopenais-dev (for res_ais.so)
  * Build-Depends on libosptk3-dev (for app_osplookup.so)
  * Patch dahdi-fxsks-hookstate: Fix FXO dialout issue.
  * Patch h323-make-fix: No, we should not need to run 'make' twice.

  [ Victor Seva ]
  * Drop patch misdn_FOP. Applied upstream (r112521 branches/1.6.0/).

  [ Mark Purcell ]
  * Update debian/watch
  * asterisk-dbg -> Section: debug

 -- Mark Purcell <email address hidden>  Sun, 29 Mar 2009 22:21:47 +1100

asterisk (1:1.4.21.2~dfsg-3) unstable; urgency=medium


  [ Faidon Liambotis ]
  * Fix a segfault that occured on AEL parsing on amd64 systems.
    (Closes: #507883)
  * Remove bristuff/app-meetme-avoid-overflows patch as it apparently causes
    more problems than it solves (if any).
    (Closes: #505310)
  * Urgency medium because of the RC bugfix.

  [ Patrick Matthäi ]
  * Bumped Standards-Version to 3.8.0.

  [ Mark Purcell ]
  * Update debian/watch

 -- Faidon Liambotis <email address hidden>  Sun, 04 Jan 2009 21:07:37 +0200

asterisk (1:1.4.21.2~dfsg-2) unstable; urgency=low


  [ Victor Seva ]
  * support DEB_BUILD_OPTION noopt used to produce non-optimized builds.
    (Closes: #492941).
  * Depend on libcap2-dev instead of libcap-dev because libcap1 is no longer
    maintained upstream. Thanks to Torsten Werner <email address hidden>.
    (Closes: #492620).
  * Backport script fixes:
    - Depend on debhelper >=5 on backport etch script.
    - replace libcap2-dev by libcap-dev.
    - remove lib-client2007b-dev. (Closes: #494405)

  [ Tzafrir Cohen ]
  * Patch chan_zap so that asterisk starts even without a Zaptel timing
    source. (Closes: #491310)

  [ Lionel Elie Mamane ]
  * /etc/default/asterisk: Bring comments on AST_DUMPCORE_DIR in sync with
    reality of implementation in /etc/init.d/asterisk. Change suggested
    CORE_PATTERN to more secure ones.
  * /etc/init.d/asterisk: Use the value of AST_DUMPCORE_DIR if it is a
    directory, not if the value if DUMPCORE_DIR is a directory.

  [ Faidon Liambotis ]
  * Backport a patch from Xorcom's tree fixing a deadlock situation caused
    by the bristuff patch. (Closes: #493055)
  * Backport a patch from Xorcom's tree fixing an occasional "Cause 34" error
    on BRIs.
  * Don't write /root/.asterisk_history when stopping asterisk with the init
    script. (Closes: #500294)
  * Eliminate warnings when calling some actions of the init script by
    replacing obsolete asterisk commands with their newer counterpart.

 -- Faidon Liambotis <email address hidden>  Sat, 04 Oct 2008 01:21:40 +0300