-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 08 Nov 2026 09:13:18 +0000 Source: ppp Architecture: source Version: 2.5.5-1+1 Distribution: unstable Urgency: medium Maintainer: Chris Boot <bootc@debian.org> Changed-By: Chris Boot <bootc@debian.org> Closes: 511013 1135816 1138827 1148816 1148821 Changes: ppp (2.5.5-1+1) unstable; urgency=medium . [ Pascal Hambourg ] * ppp-udeb: Rework hostname handling: - Validate the domain name, and accept a fully-qualified hostname, splitting it into hostname and domain. - Reject backslashes, and hyphens or dots at the start or end of a label. - Write /etc/hostname and /etc/hosts with printf, adding the missing trailing newline. . [ Chris Boot ] * Switch to debhelper compat level 14, and drop the now-redundant ${misc:Depends} and ${shlibs:Depends} from debian/control. * ppp-udeb: Handle hostnames and domains more like netcfg: - Reset an invalid hostname or domain answer after reporting it, so an invalid preseeded value no longer loops forever when the questions are not shown. - Accept 1-character hostnames and domains. - Store the domain taken from a fully-qualified hostname in netcfg/get_domain. * Convert debian/watch to format version 5. * New patch ipv6cp-utf8.patch: convert pppd/ipv6cp.[ch] from ISO-8859-1 to UTF-8, so the installed ipv6cp.h header is no longer national-encoding. * Update lintian overrides for the ${HOSTNAME%%.*} expansions in the udeb postinst, and override false positives for the French licence text in debian/copyright. * Upload to unstable. . ppp (2.5.5-1+1~exp1) experimental; urgency=medium . * New upstream release. (Closes: #1138827) - Fixes several security issues, including CVE-2026-75883 and CVE-2026-85495. See the advisories at https://github.com/ppp-project/ppp/security/advisories for details. (Closes: #1148816, #1148821) - Fixes the link sometimes coming up without MPPE encryption despite require-mppe, require-mppe-40 or require-mppe-128. - Fixes validation of received frames in the RADIUS plugin. - Fixes hook scripts such as /etc/ppp/ip-up sometimes not being run. - pppd now refuses to use secrets files that are readable by group or other, and scripts, privileged options files and secrets files whose path is not owned by root or is writable by non-root users. This replaces the duplicated warning about readable secrets files. (Closes: #511013) - The defaultroute option now always adds a default route, even if one already exists. replacedefaultroute is no longer supported. - EAP-TLS: OpenSSL engine support is disabled, and MPPE key generation with TLS 1.3 now matches Windows (incompatible with older pppd). - EAP-SRP support has been removed. - New dhcpv6relay plugin and vrf option. * Drop chat_man: upstream now documents the TIMEOUT directive in chat(8). * Drop pppoatm_resolver_light: upstream has removed the ATM name service lookup and SVC address parsing from the pppoatm plugin, and the QoS parsing that remains is small and makes the qos option usable again. * Drop pppd.8-fix-groff-warning.patch and the pppdump GCC 15 build fix backport, both included in this upstream release. * Refresh zzz_config and pppd-soname-hack.patch. * Update symbols for the new upstream release. * Check symbols with dpkg-gensymbols -c4, so that a changed pppd SONAME fails the build instead of silently skipping the symbols comparison. * New patch pppd.8-fix-typos-and-groff-warning.patch: fix two typos and a duplicated .TP macro in pppd(8). * Add DEP-3 headers to pppoe_noads and resolv.conf_no_log. * Update lintian overrides for the new /etc/ppp/peers and /etc/chatscripts permissions and pppd no longer being setuid, and drop unused overrides. * Remove redundant Priority: optional field from debian/control. * Stop installing /usr/sbin/pppd setgid. Practically all users start pppd via some kind of networking or service supervisor, and this is an unnecessary security risk in modern times. * Change the permissions on /etc/ppp/peers to 0700, and also use dpkg-statoverride to set the permissions to root:root 0700. (Closes: #1135816) * Also change the permissions on /etc/chatscripts to root:root. * Update README.Debian and add a NEWS entry describing the above. * Clarify the error message when pon is run as an unprivileged user. * Remove Rules-Requires-Root: binary-targets. * Remove unused shlibs:Depends from Depends in ppp-dev. * Import upstream from signed git tags instead of release tarballs. * Ignore .github/ in debian/source/options: upstream's .gitattributes excludes it from orig tarballs generated with git archive. * Update standards version to 4.7.4, no changes needed. * Convert debian/copyright to the machine-readable DEP-5 format. * Add an autopkgtest running upstream's integration testsuite against the installed pppd. * Upload to experimental. Checksums-Sha1: 8ee5f55fc9ea1192e0da8fb8ae3ebef529f72bee 2361 ppp_2.5.5-1+1.dsc ffef59f47a82b7053b78009c8726198a90426ceb 91944 ppp_2.5.5-1+1.debian.tar.xz 88614499439b20b1598d3cf235d08c94622ff204 1798344 ppp_2.5.5-1+1.git.tar.xz fd97ae25a55ada94114c31ce63880d0fb9ee1b76 17729 ppp_2.5.5-1+1_source.buildinfo Checksums-Sha256: e28ad1340f3b03751f5f451914364e3da36b1c401c9cf75739547f696ad86ff7 2361 ppp_2.5.5-1+1.dsc b12e694b07ad92117e7d27eb177fa4416919feb3c817cfb5232885873898fc96 91944 ppp_2.5.5-1+1.debian.tar.xz 0dbb44de7e337433fb2260117a00f338fe878aef846d8521d5b82c648a9309ff 1798344 ppp_2.5.5-1+1.git.tar.xz df414bf0911e2afe8a2a80a487ccaae9526e0c4f7a8c90d7487ceca942cb0a8e 17729 ppp_2.5.5-1+1_source.buildinfo Files: e68c0f697140d7350f772133f7f104d2 2361 admin optional ppp_2.5.5-1+1.dsc 02d2c572878ad3ccdcbac3e16710a67b 91944 admin optional ppp_2.5.5-1+1.debian.tar.xz 13cea51868354f8129e2ef5419257d79 1798344 admin None ppp_2.5.5-1+1.git.tar.xz 40614277c4888781feaf2e061e554d72 17729 admin optional ppp_2.5.5-1+1_source.buildinfo Git-Tag-Info: tag=497b6c907f52c430f76ba4a08fa11ec0bbcbf633 fp=da8a90f57ffb1d647e4034da411a733e67d64ffe Git-Tag-Tagger: Chris Boot <bootc@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrwPfIACgkQYG0ITkaD wHkmEw//chFmuAXKoWDqIDQfa2JsqGzcTQQrKA9G2uvZRN0E7KHs4IR5G0A3hDDo Rg8tV+wtuhJMDOCZhYzabQ7UDywUAuKt9RXxSWfXszDxtS1koH4+ybV0tcV/IHFH 1wikc28vwMRS1edF+WJiNvFYae2XfxIiuvruXoCfgs81wbG+Ve+vfaSCfO7LlSQU pjhvEm94JeK9feqK9L/g4eZ1r82oosofCYEkvvi8nKQqeaQXPoPPRduYjBJBqrt1 LpR0wRiibyhlJPxI44Cdy/SEfe2pRVy85Adgazhb9mrz3IZEeVk3ZiWmauzVbAGV oX8pUKx6SMx5hwIU4PzMnePrOme+TKoxNhqUr6OlhVD92JCtIhOwv6Cc82wMx7PL fwKu0eu5B/0xavqR0b9kpChxZ/zQb/aGuvctBLehVd0e7NbNQs/NSgu5RGWcKZQA pou8HZgLb3B4QIX6puuTMFVgZXi/rY62Bxk+kAbgBr/KP4GOxGs480DH/afeZWKz /OwDRMA/S+T9xNvSIjB9iPmPy3z0IIsmOoG2H6GLah2hiZzjglFmmOZDnz/liGQM LiI2uFmObdLVCmZ6L1eio+6yGMzubOS5+iD/z2AVlCpQWUXA4yI7M4rb8BJxMH42 UzQYK9nAr5XM05EKboZCE6L2AOfiPGqOMvJDXNj5O/nIEbRy0ks= =4pg9 -----END PGP SIGNATURE-----
