mini-httpd (1.30-18) unstable; urgency=high

  * Fix memory exhaustion DoS in header parsing (CVE-2026-68005).
    (Closes: #1144953)
  * Fix potential Slowloris in the same place by removing old alarm(60)
    based timeout mechanism.
  * Update copyright year on debian/

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Tue, 01 Sep 2026 18:05:13 +0300

mini-httpd (1.30-17) unstable; urgency=medium

  * Add salsa NCSA httpd 1-4 mirror location for copyright file reference.
    Previous github mirror is now defunct. Updated copyright reference.
  * Add auto restart on failure to systemd service, with default
    limits of 2 bursts and a 30 seconds interval.
  * Add patch modernizing Makefile flags, which mangled LDFLAGS with CFLAGS.
    Now the .o stage uses $CPPFLAGS and correct $CFLAGS instead of $LDFLAGS.
    Removed compile flags from LDFLAGS, which are now moved to correct CFLAGS.
    Moved DUSE_SSL to SSL_DEFS instead of hardcoding into LDFLAGS
  * Bump Standards-Version to latest 4.7.4
  * Use new format in debian/watch

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Fri, 29 May 2026 12:35:43 +0300

mini-httpd (1.30-16) unstable; urgency=medium

  * Modify all patches headers to specify being forwarded via email to upstream
    by me. Upstream has no official git or mailing list, so I established
    by convention Forwarded: not-needed (sent by email; upstream
    has no public tracker)
    Upstream is rather slow, I forwarded everything and confirmed they were
    received anyway.
  * Declare compliance with Standards-Version 4.7.3.
    (Removed Priority from control).
  * Add patch which fixes compilation warning in mini-httpd and htpasswd.
    Some of those, like silently ignoring the return code of getcwd and system
    could lead to an untraceable, broken program state. A minority I just
    pragma'ed away since modernizing the source there would have a greater
    risk of altering legacy behavior.
  * Remove now redundant Rules-Requires-Root: no

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Fri, 13 Mar 2026 10:02:46 +0200

mini-httpd (1.30-15) unstable; urgency=medium

  * Declares libcrypt-dev in Build-Depends to fix urgent RC bug.
    (Closes: ##1107043)

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Sat, 15 Nov 2025 12:01:49 +0200

mini-httpd (1.30-14) unstable; urgency=medium

  * Closes: #516309. I can't reproduce this at all, it is possible
    another patch related to vhost fixed this in the 16 years it's been open.
    The bug author doesn't reply anymore with another test and since I can't
    see this at all, closing as can't reproduce.
  * Forwarded all remaining patches to upstream and fixed Debian-Bug URL typo
    in debian/patches/0008-fix-ftbfs-kfreebsd-amd64
  * Added debian-watch-does-not-check-openpgp-signature lintian override
    since upstream never has and probably never will provide this.
  * Added missing Repository and Repository-Browse fields in upstream metadata
    file.

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Sat, 13 Sep 2025 17:59:45 +0300

mini-httpd (1.30-13) unstable; urgency=medium

  * Adds chroot syscall exception to SystemCallFilter in the service.
    This allows operation in chroot mode when using the service.
    (Closes:  #1105097)
  * Update copyright years for debian scripts.

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Mon, 12 May 2025 18:25:39 +0300

mini-httpd (1.30-12) unstable; urgency=medium

  * Declare compliance with Standards-Version 4.7.2. (no changes required).
  * Document new systemd service and corresponding init.d
    script in the manpage.

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Sun, 09 Mar 2025 13:51:39 +0200

mini-httpd (1.30-11) unstable; urgency=medium

  * Added patch redirecting CGI script stderr output to /dev/null.
    This fixes CGI stderr output being sent to the client, which is not
    compliant with CGI RFC and breaks some sites.
    (Closes: #437932)
  * Added patch which starts logging CGI script invocations.
    This enables referrer analysis.
    (Closes: #516307)
  * Added a basic upstream/metadata tracking acme.com.

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Wed, 19 Jun 2024 23:02:24 +0300

mini-httpd (1.30-10) unstable; urgency=medium

  * Added patch improving handling of "charset=%s" in error pages
    and directory listing. Before, a literal "%s" was output as opposed to
    the actual charset. Now, the correct charset (UTF-8 for dirs and
    ISO-8859-1 for err) is output. Thanks again, Alexander Foken !
    (Closes: #714549)
  * Added a Systemd DocumentationKey entry fixing lintian warning. This
    points to the manpage for now.
  * Added SystemD hardening features to service. The directives
    I have provided should have no impact. I've confirmed no impact to
    basic functionality, vhosting, error pages and CGI. I managed to
    get the service to a "4.7 - OK" rating by using
    systemd-analyze security mini-httpd (all the way from 9.6).
    I have NOT enabled hardening features which have a high change of
    impacting functionality such as removing CAP_CHROOT which would
    mean mini_httpd's chroot mode of operation is forbidden.
    Help is welcome in improving these options (maybe someone with a
    security background could chip in).
  * Added a NEWS entry informing users of potential breakage due to
    new systemd hardening features.

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Tue, 16 Apr 2024 00:11:43 +0300

mini-httpd (1.30-9) unstable; urgency=medium

  * Added patch fixing NPH scripts (SSL) getting an additional
    HTTP/1.0 200 OK header before the actual expected one. This
    violates the CGI RFC (RFC-3875).
    (Closes: #1064656)
  * Merged branch fixing mini-httpd starting too early after reboot.
    This only happened using the old init.d script. The systemd service
    is not affected. Thanks, Jean !

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Fri, 08 Mar 2024 18:44:18 +0200

mini-httpd (1.30-8) unstable; urgency=medium

  * Modified mini-httpd.postinst to check if we're doing a
    fresh install or upgrading. Secondly, if we're fresh installing,
    the default index.html file is copied into /var/www/html only if
    no other index files are present (ex: index.cgi). This prevents
    the shipped index.html overwriting existing index.ext files.
    If we are upgrading, no files will be touched.
    (Closes: #1061792)
  * Removed erroneous duplicate "-C /etc/mini-httpd.conf" in
    systemd ExecStart. The "-C" call was already present in
    the EnvironmentFile (/etc/default/mini-httpd) read and
    used by the service. This resulted in mini-httpd's
    commandline containing the "-C" call twice.
    Thanks, Alexander Foken.

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Fri, 02 Feb 2024 19:42:56 +0200

mini-httpd (1.30-7) unstable; urgency=medium

  * Modified mini-httpd.postinst to not copy
    /usr/share/doc/mini-httpd/examples/index.html into
    /var/www/html/index.html if it's not readable,
    fixing weird edge cases where docker's dpkg
    cleans up /usr/share/*/examples beforehand,
    (Closes: #1061070)
  * Created 0011-fix-typo-in-documentation-maxage
    which clears confusion regarding the maxage
    config & cli option, the actual name for the
    variable being max_age in mini_httpd.c.
    The patch modifies documentation and
    help output to reflect this reality.
    (Closes: #1018900)

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Fri, 19 Jan 2024 21:09:00 +0200

mini-httpd (1.30-6) unstable; urgency=medium

  * Modified 0003-fix-change-index-document-root and
    0005-cgi-php to push index.mini-httpd.html to the end of known
    index.* array, modified install script to copy the provided
    index.html into /var/www/html/index.html,
    if not present (Closes: #1057842)
  * Moved package provided index.html file to
    /usr/share/doc/mini-httpd/examples, to avoid lintian warning regarding doc
    location

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Tue, 12 Dec 2023 00:00:53 +0200

mini-httpd (1.30-5) unstable; urgency=medium

  * Added patch stripping port numbers in vhost setup. (Closes: #491078).
  * Corrected systemd service not consuming /etc/default/mini-httpd
    configurations.
    Thanks a lot, Johannes Schauer Marin Rodrigues (Closes: #1051374).

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Thu, 21 Sep 2023 01:39:39 +0300

mini-httpd (1.30-4) unstable; urgency=medium

  * New maintainer. (Closes: #927950).
  * Declare compliance with Standards-Version 4.6.2. (no changes required).
  * Added systemd service (fixes lintian W:
    missing-systemd-service-for-init.d-script).
  * Changed rules to accommodate the included systemd service.
  * Removed dependency to empty obsolete package: lsb-base (Safe as we were
    only depending on LSB init scripts, superseded by the added systemd
    service and sysv-rc already depending on lsb-base in existing releases for
    non systemd systems).
  * Added missing Upstream-Contact and updated Copyright to reflect new
    Upstream contact email and added new mainainer copyright notice.
  * Clarified NCSA origins of mini-httpd htpasswd* by adding a corresponding
    copyright entry with proper attribution.

 -- Alexandru Mihail <alexandru.mihail2897@gmail.com>  Tue, 05 Sep 2023 01:29:43 +0300

mini-httpd (1.30-3) unstable; urgency=medium

  * QA upload.
  * Drop d/mini-httpd.manpages, installed with upstream Makefile.
    Closes: #1013614
  * d/rules:
    - Change target from 'override' to 'execute_after'.
    - Install upstream changelog under dh_installchangelogs target.
  * d/control:
    - Bump debhelper to 13.
    - Add space after comma in long description.
    - Document Rules-Requires-Root.
    - Update Standards-Version to 4.6.1
  * d/watch: Bump to version 4.
  * d/copyright: Change to secure URI.
  * d/upstream.changelog: Include missing release information, and remove
    end-of-line whitespace.
  * Change init system to not start on install, ref. lintian tag
    [init.d-script-should-always-start-service]. Default settings remains
    identical.

 -- Håvard F. Aasen <havard.f.aasen@pfft.no>  Wed, 20 Jul 2022 23:46:44 +0200

mini-httpd (1.30-2) unstable; urgency=medium

  * QA upload.
  * Upload to unstable.
  * [9a071ed3] Bump standards version to 4.4.0.
  * [8c12d482] Round-trip patches with gbp-pq.
  * [e89bd419] Do not strip binary during link phase.
  * [3637ba33] Add missing versioned dependency on init-system-helpers.
  * [d8a4302c] Bump debhelper compat to 12.

 -- Dmitry Bogatov <KAction@debian.org>  Fri, 12 Jul 2019 01:47:16 +0000

mini-httpd (1.30-1) experimental; urgency=medium

  * QA upload
  * Trim trailing whitespace.
  * Use secure URI in Homepage field.
  * Use secure copyright file specification URI.
  * Bump debhelper from old 9 to 10.
  * Use secure URI in debian/watch.
  * Remove patches missing from debian/patches/series.
  * Set QA Group as maintainer (orphan bug #927950).
  * Fix typo in "fix-makefile" patch.
  * Include CPPFLAGS into CFLAGS in debian/rules to accommodate
    upstream Makefile, that does not respect CPPFLAGS.
  * Bump standards version to 4.3.0

 -- Dmitry Bogatov <KAction@debian.org>  Sat, 11 May 2019 17:57:35 +0000

mini-httpd (1.30-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix null pointer dereference (Closes: #916190)
    + Thanks: Salva Peiró <speirofr@gmail.com>
  * Fix typo in path to pidfile in `mini_httpd.conf' (Closes: #893996)

 -- Dmitry Bogatov <KAction@debian.org>  Wed, 12 Dec 2018 05:19:14 +0000

mini-httpd (1.30-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream release (Closes: #913095)
  * Fix init.d script (Closes: #902816)
  * Add Vcs-* fields into `debian/control'.

 -- Dmitry Bogatov <KAction@debian.org>  Thu, 15 Nov 2018 16:20:33 +0000

mini-httpd (1.23-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Bring back lost HTTPS support (Closes: #818474).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Thu, 16 Feb 2017 23:14:13 +0100

mini-httpd (1.23-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add patch to fix FTBFS in kfreebsd-amd64.  Closes: #825713

 -- Mattia Rizzolo <mattia@debian.org>  Fri, 17 Jun 2016 10:06:51 +0000

mini-httpd (1.23-1) unstable; urgency=medium

  * New upstream release
  * d/control:
     - Bump Standard-Version to 3.9.7.
  * d/upstream.changelog:
     - Update changes.
  * d/patches:
     - Remove patch fix-add_to_response-buffer-overflow fixed for upstream.
     - Fix support FreeBSD
       thanks Steven Chamberlain <steven@pyro.eu.org> (Closes: #815339)
     - Add patch fix-autobuilders for a problem with package on 64-bit
       thanks Steve Langasek <steve.langasek@ubuntu.com> (Closes: #819125)
  * d/rules:
     - Add hardening
     - Don`t install htpasswd (LP: #943088)

 -- Jose dos Santos Junior <j.s.junior@live.com>  Fri, 01 Apr 2016 17:32:30 -0300

mini-httpd (1.21-1) unstable; urgency=medium

  * New upstream release.
  * New maintainer. (Closes: #780194)
  * Fix CVE-2015-1548
      - Patch fix-add_to_response-buffer-overflow. (Closes: #778925)
  * d/control:
      - Bump Standard-Version to 3.9.6.
      - Bump debhelper to 9.
      - Remove deprecated dpatch.
      - Upgrade packaging format "3.0 (quilt)". (Closes: #664363)
      - Remove article in description synopsis.
      - Add ${misc:Depends}.
  * d/copyright
      - Update to DEP5 format.
      - Formatting copyright.
  * d/rules:
      - Upgrade to dh sequencer.
      - Added upstream changelog extracted from mini-httpd website.
  * d/mini-httpd.init.d:
      - Fix restart error. (Closes: #510905, #755892)
  * d/patches:
      - Fix and add SCRIPT_FILENAME in patch 03-cgi-php. (Closes: #569599)
      - Ensure hardening is enabled for mini_httpd.c.
      - Don't install htpasswd.1.
      - Add index.mini-httpd.html to the list of index names.
  * d/mini-httpd.init.d
      - Source /lib/lsb/init-functions.
      - Add "status" command.
  * d/mini-httpd.postinst
      - Copy index.mini-httpd.html. (Closes: #730373)
      - Use "set -e" and don't install htpasswd. (Closes: #520941)

 -- Jose dos Santos Junior <j.s.junior@live.com>  Thu, 03 Sep 2015 14:59:53 -0300

mini-httpd (1.19-9.3) unstable; urgency=low

  * Non-maintainer upload.
  * Do not install htpasswd, recommend apache2-utils instead.
    (Closes: #674515).
  * Add missing dependencies on $remote_fs to fix a lintian error.

 -- Bernd Zeimetz <bzed@debian.org>  Sat, 16 Jun 2012 01:31:28 +0200

mini-httpd (1.19-9.2) unstable; urgency=medium

  [Jari Aalto]
  * Non-maintainer upload.
  * debian/patches
    - (number 10): New patch to fix htpasswd.c:52: error:
      conflicting types for 'getline'. . Thanks to Ruben Molina
      <rmolina@udea.edu.co>. (FTBFS RC Bug serious; Closes: #552844)

 -- Jari Aalto <jari.aalto@cante.net>  Thu, 07 Jan 2010 11:13:26 +0200

mini-httpd (1.19-9.1) unstable; urgency=low

  * Non-maintainer upload.
  * Fix bashism (Closes: #525366)
  * Fix lintian-detected hyphen-used-as-minus-sign errors.
  * Add watch file.

 -- Raphael Geissert <geissert@debian.org>  Sun, 05 Jul 2009 19:38:05 -0500

mini-httpd (1.19-9) unstable; urgency=low

  * Added kFreeBSD portin patch (Closes: #498368)
    - Thanks to Petr Salinger
  * Enabled CGI by default (Closes: #500708)
  * Fixed init.d script (Closes: #500708, #491083)
  * data_dir will be created if necessary (Closes: #494437)
  * Added example index.html
  * changed default data_dir to /usr/share/mini-httpd/html
  * Fixed typo in 03-cgi-php.dpatch
  * Updated Standards-Version to 3.8.0

 -- Marvin Stark <marv@der-marv.de>  Thu, 15 Jan 2009 15:28:53 +0100

mini-httpd (1.19-8) unstable; urgency=low

  * /etc/mini-httpd.conf:
    - Changed data_dir to /var/www (Closes: #473140)
  * debian/control:
    - Removed Homepage from long description
    - Added Homepage field

 -- Marvin Stark <marv@der-marv.de>  Fri, 28 Mar 2008 19:13:33 +0000

mini-httpd (1.19-7) unstable; urgency=low

  * Patched PHP CGI errors (Closes: #462930)
    Thanks to Thorsten Schmale
  * Changed Standards-Version to 3.7.3
  * Fixed init.d script

 -- Marvin Stark <marv@der-marv.de>  Tue, 05 Feb 2008 08:56:53 +0000

mini-httpd (1.19-6) unstable; urgency=low

  * Changed start behavior in default file (Closes: #454230)
    1 = start; 0 = stop

 -- Marvin Stark <marv@der-marv.de>  Tue, 04 Dec 2007 21:52:32 +0000

mini-httpd (1.19-5) unstable; urgency=low

  * Removed stripping flag from Makefile (Closes: #437570)

 -- Marvin Stark <marv@der-marv.de>  Wed, 15 Aug 2007 13:11:22 +0000

mini-httpd (1.19-4) unstable; urgency=low

  * Removed Daniel from uploaders as wished by him.
  * Fixed init script (Closes: #407775).
    Thanks to Andreas Metzler.

 -- Marvin Stark <marv@der-marv.de>  Sun, 21 Jan 2007 11:52:01 +0000

mini-httpd (1.19-3) unstable; urgency=low

  * Pidfile will be removed, if mini-http gets removed or stopped (Closes: #387941).
  * Changed start behavior of mini-httpd.

 -- Marvin Stark <marv@der-marv.de>  Wed, 25 Oct 2006 21:47:43 +0200

mini-httpd (1.19-2) unstable; urgency=low

  * Resolved conflicts with apache2-utils (Closes: #385268).
  * Added LSB initscript header.
  * Renamed mini_httpd.conf to mini-httpd.conf
  * Renamed mini_httpd.default to mini-httpd.default
  * Renamed mini_httpd.init.d to mini-httpd.init.d

 -- Marvin Stark <marv@der-marv.de>  Wed, 13 Sep 2006 18:11:12 +0200

mini-httpd (1.19-1) unstable; urgency=low

  * Initial release (Closes: #376599, #308660).

 -- Marvin Stark <marv@der-marv.de>  Mon,  3 Jul 2006 20:12:42 +0200
