pyjwt (1.4.2-1ubuntu1) artful; urgency=medium

  * SECURITY UPDATE: symmetric/asymmetric key confusion attacks
    - debian/patches/CVE-2017-11424.patch: Throw if key is an PKCS1
      PEM-encoded public key in jwt/algorithms.py, jwt/api_jws.py,
      jwt/api_jwt.py, tests/keys/testkey_pkcs1.pub.pem,
      tests/test_algorithms.py, tests/test_api_jws.py, tests/test_api_jwt.py.
    - CVE-2017-11424

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Mon, 28 Aug 2017 15:39:22 -0300

pyjwt (1.4.2-1) unstable; urgency=medium

  * New upstream release.

 -- Daniele Tricoli <eriol@mornie.org>  Fri, 09 Sep 2016 01:07:26 +0200

pyjwt (1.4.1-1) unstable; urgency=medium

  * New upstream release.
  * Run "as-installed" tests (DEP8).
  * debian/patches/01_do-not-use-pytest-runner.patch
    - Drop since python{,3}-pytest-runner is in Debian.
  * debian/rules
    - Make the build reproducible. (Closes: #828131, #831868)
      Thanks to Chris Lamb for report and patch.

 -- Daniele Tricoli <eriol@mornie.org>  Thu, 21 Jul 2016 00:07:43 +0200

pyjwt (1.4.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * Fixed VCS URL (https)

  [ Daniele Tricoli ]
  * New upstream release.
  * debian/control
    - Bump Standards-Version to 3.9.8 (no changes needed).
    - Add python{,3}-pytest, python{,3}-pytest-cov and python{,3}-pytest-runner
      to Build-Depends.
  * debian/copyright
    - Update copyright years.
  * debian/rules
    - Run tests at build time.

 -- Daniele Tricoli <eriol@mornie.org>  Sun, 08 May 2016 00:00:12 +0200

pyjwt (1.3.0-1) unstable; urgency=medium

  * New upstream release.
    - Add a check so that asymmetric keys cannot be used as HMAC
      secrets. See for more details:
      https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
  * debian/control
    - Update Homepage field.
    - Add python{,3}-cryptography to Build-Depends and Recommends.
      (Closes: #780630)
    - Add python{,3}-crypto to Suggests.
    - Bump Standards-Version to 3.9.6 (no changes needed).
  * debian/copyright
    - Update Upstream-Contact to reflect new upstream author.
    - Update copyright years.
  * debian/patches/01_do-not-use-pytest-runner.patch
    - Remove pytest-runner form setup_requires since it's not packaged for
      Debian yet.
  * debian/watch
    - Use pypi.debian.net redirector.

 -- Daniele Tricoli <eriol@mornie.org>  Fri, 10 Jul 2015 02:12:06 +0200

pyjwt (0.2.1-1) unstable; urgency=low

  * Initial release (Closes: #755832)

 -- Daniele Tricoli <eriol@mornie.org>  Fri, 29 Aug 2014 04:20:04 +0200
