Change log for cupsys package in Ubuntu

cupsys (1.3.0-4ubuntu1) gutsy; urgency=low

  * Merge bugfixes from Debian.
  * debian/local/apparmor-profile: Append slashes to directory names, since
    AppArmor 2.1 wants it that way.
  * debian/local/apparmor-profile: Open up the profile for third-party printer
    drivers (like Turboprint, and other stuff in /usr/local/). This requires
    opening up the profile much more than necessary, due to AppArmor bug
    #139105. (LP: #133818)

cupsys (1.3.0-3ubuntu1) gutsy; urgency=low

  * Merge bugfixes from Debian.
  * debian/local/apparmor-profile: Allow dac_override for now; this is
    slightly nasty, but cups chowns a lot of files (e. g. in
    /var/spool/cups/tmp) to 'lp' and thus cannot read/write them any more
    afterwards. Since we confine file access pretty tightly, this should not
    be much of a problem. (LP: #133015)
  * debian/local/apparmor-profile: cupsd should manage /etc/printcap.
    (LP: #132969)

cupsys (1.3.0-2ubuntu2) gutsy; urgency=low

  * debian/local/postscript.ppd: New generic PostScript PPD file for
    unknown PostScript printers added.

 -- Till Kamppeter <email address hidden>   Thu, 16 Aug 2007 18:01:06 +0100

cupsys (1.3.0-2ubuntu1) gutsy; urgency=low

  * Merge from debian unstable, remaining changes:
    - TearDown (fast shutdown):
      + debian/control: Add sysv-rc (>= 2.86.ds1-14.1ubuntu2) dependency.
      + debian/rules: Use 'multiuser' update-rc.d mode.
    - debian/control, debian/rules: Drop cupsys-dbg package.
    - debian/cupsys.postinst: Various transitions that need to be kept until
      the next LTS:
      + Auto-enable snmp, scsi, and serial backends on upgrade.
      + Revert to single cupsd.conf file.
      + Remove obsolete rc.d links.
    - debian/patches/ubuntu-default-error-policy-retry-job.dpatch: Retry a
      failed job instead of stopping the print queue.
    - debian/patches/ubuntu-disable-browsing.dpatch: Disable browsing by
      default.
    - Add AppArmor profile:
      + debian/local/apparmor-profile
      + debian/cupsys.postinst: Reload AA profile on configuration.

cupsys (1.3.0-0ubuntu1) gutsy; urgency=low

  [ Till Kamppeter ]
  * New upstream release (first release of 1.3.x generation)
  * 90_include_krb5_h_in_job_h.dpatch: Added a missing "#include <krb5.h>" to
    the scheduler/job.h file (upstream bug).
  * Regenerated patches: 44_fixconfdirperms.dpatch, 47_pid.dpatch,
    70_reactivate_recommended_driver.dpatch, ubuntu-disable-browsing.dpatch,
    ubuntu-default-error-policy-retry-job.dpatch
  * Removed patches (fixed upstream): 53_usr_share_ppd_support.dpatch,
    55_ppd_okidata_name.dpatch, 68_edit-config.dpatch
  * debian/control: Added "libkrb5-dev", and "libavahi-compat-libdnssd-dev"
    to the build dependencies, so that the new Kerberos and DNS Service
    Discovery support of CUPS gets compiled.
  * debian/libcupsys2-dev.files: Removed /usr/include/cups/md5.h This file is
    not provided any more by CUPS
  * debian/cupsys.install, debian/cupsys-client.files: Added new files.
  * debian/rules: Added more files to "clean::" rule which upstream has
    forgotten in "make clean".

  [ Martin Pitt ]
  * debian/local/apparmor-profile: Some more updates to work with third-party
    printer drivers (also under /opt).
  * Bump library shlibs to >= 1.3.0.

 -- Martin Pitt <email address hidden>   Tue, 14 Aug 2007 20:00:00 +0200

cupsys (1.2.12-3ubuntu3) gutsy; urgency=low

  * debian/local/apparmor-profile: Allow unrestricted access to hplip. This
    has not been confined before and unbreaks hplip until we get an actual
    profile for it. (LP: #131470)

 -- Martin Pitt <email address hidden>   Tue, 14 Aug 2007 17:08:50 +0200

cupsys (1.2.12-3ubuntu2) gutsy; urgency=low

  * cupsys.logrotate: Fix last occurence of 'cupsys' user.
  * Moved all Debian specific filters to debian/local/filters.
  * Cleaned up debian/rules, moved some file installs to
    debian/cupsys.install.
  * Merge debian/cupsys.files into debian/cupsys.install and remove the
    former. Two different files are just too confusing.
  * debian/local/filters/pdftops: Do not pass /etc/cups/pdftops.conf to
    pdftops if it does not exist (poppler-utils does not have this file).
    (LP: #125300)
  * debian/local/apparmor-profile: Unbreak library access (for e. g.
    ghostscript and gutenprint) and allow execution of pdftops and pstops.
  * debian/local/apparmor-profile: Update profile to work with cups-pdf.

 -- Martin Pitt <email address hidden>   Sat, 11 Aug 2007 16:44:13 +0200

cupsys (1.2.2-0ubuntu0.6.06.3) dapper-proposed; urgency=low

  * Add debian/patches/59_title_escaping.dpatch:
    - Escape non-ASCII characters in comment fields in the filters.
    - This fixes printing of documents with titles containing non-ASCII
      characters, line breaks, etc.
    - Patch backported from upstream SVN (dropped the formatting changes):
      http://www.cups.org/strfiles/1988/str1988.patch
    - LP #57445.
  * Skipping version number to .3 since .2 is in proposed and didn't verify.

 -- Martin Pitt <email address hidden>   Fri, 10 Aug 2007 12:47:32 +0200

cupsys (1.2.12-3ubuntu1) gutsy; urgency=low

  * Merge latest fixes from Debian unstable. (LP: #29050)
  * debian/local/apparmor-profile:
    - Use abstractions/authentication and drop the passwd/shadow/pam rules.
    - Drop the redundant "/usr/lib/** mr" rule (already in 'base').
    - Enforce by default, so that we get actual protection.

 -- Martin Pitt <email address hidden>   Thu, 09 Aug 2007 21:16:34 +0200

cupsys (1.2.12-2ubuntu2) gutsy; urgency=low

  * cupsys.init.d: Remove stray chown'ing to 'cupsys' which does not exist any
    more.'

 -- Martin Pitt <email address hidden>   Wed, 08 Aug 2007 12:56:01 +0200

cupsys (1.2.12-2ubuntu1) gutsy; urgency=low

  * Merge from debian unstable, remaining changes:
    - TearDown (fast shutdown):
      + debian/control: Add sysv-rc (>= 2.86.ds1-14.1ubuntu2) dependency.
      + debian/rules: Use 'multiuser' update-rc.d mode.
    - debian/control, debian/rules: Drop cupsys-dbg package.
    - debian/cupsys.postinst: Various transitions that need to be kept until
      the next LTS:
      + Auto-enable snmp, scsi, and serial backends on upgrade.
      + Revert to single cupsd.conf file.
      + Remove obsolete rc.d links.
    - debian/patches/ubuntu-default-error-policy-retry-job.dpatch: Retry a
      failed job instead of stopping the print queue.
    - debian/patches/ubuntu-disable-browsing.dpatch: Disable browsing by
      default.
    - Add AppArmor profile:
      + debian/local/apparmor-profile
      + debian/cupsys.postinst: Reload AA profile on configuration.

cupsys (1.2.12-1ubuntu3) gutsy; urgency=low

  * debian/rules: Install the D-Bus config file so that CUPS reports
    job progress to the applet of sytem-config-printer
  * debian/rules, devian/textonly.ppd, debian/textonly.filter: Added text-only
    printer driver from Red Hat.

 -- Till Kamppeter <email address hidden>   Sun,  5 Aug 2007 20:22:06 +0100

cupsys (1.2.12-1ubuntu2) gutsy; urgency=low

  * Drop our derooting changes. It still has some regressions, and with
    upstream not even acknowledging the need for improving cupsys' security we
    will sit on this forever. (LP: #119289, LP: #129634)
    - Drop derooting related patches:
      06_disable_backend_setuid.dpatch
      10_external_pam_helper.dpatch
      09_runasuser.dpatch
      09_runasuser_autoconf.dpatch
    - debian/cupsys{,-client}.postinst: Drop the 'cupsys' user setup and file
      permission juggling.
    - debian/rules:
      + Drop --with-cups-user and --enable-privilege-dropping configure
        options.
      + Do not modify the upstream default backend permissions.
    - debian/cupsys.init.d: Do not touch log file permissions any more.
    - debian/cupsys.files: Drop cups-check-pam-auth.
    - debian/NEWS: Drop description of derooting changes.
    - debian/control: Drop adduser dependency.
  * debian/patches/44_fixconfdirperms.dpatch: Do not create
    /var/run/cups/certs as lp:lpadmin, but as root:lpadmin, so that cupsd
    does not need CAP_DAC_OVERRIDE. This will make it possible to create a
    sensible AppArmor profile.
  * debian/cupsys.preinst: Fix file permissions on upgrades (owner cupsys ->
    root).
  * Add debian/local/apparmor-profile: AppArmor profile for cupsys, to replace
    the former derooting patches. This uses complain mode for now, until we
    got some more testing. Install it to /etc/apparmor.d/usr.sbin.cupsd in
    debian/rules and reload apparmor in debian/cupsys.postinst on configure.

 -- Martin Pitt <email address hidden>   Thu, 02 Aug 2007 14:06:05 +0200

cupsys (1.2.12-1ubuntu1) gutsy; urgency=low

  * Merge to Debian's svn head to get upstream fixes.
  * debian/patches/10_external_pam_helper.dpatch: Close pipes in the case of
    errors, too. This can not really be responsible for the mess in #112803,
    but should be fixed anyway.

cupsys (1.2.11-2ubuntu2) gutsy; urgency=low

  * debian/oopstops*, debian/rules: Added Helge Bliscke's
    oopstops filter to work around the bugs in the PostScript output of
    OpenOffice.org (from http://www.srz.de/Members/bla/cups/filter/oopstops).

 -- Till Kamppeter <email address hidden>   Mon,  4 Jun 2007 11:22:06 +0100

cupsys (1.2.11-2ubuntu1) gutsy; urgency=low

  * Merge ipp fix from Debian unstable.

cupsys (1.2.11-1ubuntu1) gutsy; urgency=low

  * Synchronize to Debian; remaining Ubuntu changes:
    - Snakeoil SSL cert support:
      + debian/control: Add ssl-cert dependency.
      + debian/cupsys.postinst: Symlink snakeoil SSL certificate if present.
      + debian/cupsys.preinst: Fix global SSL certificate owner/mode breakage
        (see 1.2.1-2ubuntu2); this needs to be kept until the next LTS
        release.
    - TearDown (fast shutdown):
      + debian/control: Add sysv-rc (>= 2.86.ds1-14.1ubuntu2) dependency.
      + debian/cupsys.postinst: Remove obsolete rc.d links.
      + debian/rules: Use 'multiuser' update-rc.d mode.
    - debian/control: Drop cupsys-dbg.
    - debian/cupsys.{config,postinst}: Transition to enable additional
      backends on upgrades. Needs to be kept until next LTS release.
    - debian/patches/ubuntu-default-error-policy-retry-job.dpatch: Retry a
      failed job instead of stopping the print queue.
    - debian/patches/ubuntu-disable-browsing.dpatch: Disable browsing by
      default.
  * Drop patches which are upstream now:
    - 80_brother_no_backchannel.dpatch
    - 92_texttops-prettyprint-crash.dpatch
    - 94_doc-port-in-client-conf.dpatch
    - 96_more-bug-fixes-between-cups-1.2.8-1.2.9.dpatch
    - 90_testpage-on-large-paper-sizes.dpatch

cupsys (1.2.8-0ubuntu8) feisty; urgency=low

  * debian/cupsys.postinst: Clean up the mess which cupsys_1.2.8-0ubuntu3 and
    later caused by activating all the CUPS backends (closes: LP#92042).
  * debian/cupsys.postinst, debian/rules: Removed directories /opt/share/ppd
    and /usr/local/share/ppd. LSB 3.2 will only require /usr/share/ppd
    (PPD files and directories at other places should be symlinked to here)
    to not conflict with FHS (closes: LP#94353).

 -- Till Kamppeter <email address hidden>   Tue,  3 Apr 2007 17:22:06 +0100

cupsys (1.2.8-0ubuntu7) feisty; urgency=low

  * debian/cupsys.postinst: Sync /usr/lib/cups/backend always with the
    debconf settingsm, as otherwise sooner or later the backend directory
    will be empty (closes: LP#92042).
  * 96_more-bug-fixes-between-cups-1.2.8-1.2.9.dpatch: Generated some garbage
    files. Fixed.

 -- Till Kamppeter <email address hidden>   Tue, 14 Mar 2007 16:22:06 +0000

cupsys (1.2.8-0ubuntu6) feisty; urgency=low

  * 98_search_mime_files_in_usr_share.dpatch: CUPS failed reading the
    *.types and *.convs files in /etc/cups when /usr/share/cups/mime
    did not exist. Fixed (closes: LP#92205).

 -- Till Kamppeter <email address hidden>   Tue, 13 Mar 2007 12:22:06 +0000

cupsys (1.2.8-0ubuntu5) feisty; urgency=low

  * debian/cupsys.postinst: Assure that special permissions of lpd backend
    are always correctly set for the link in /usr/lib/cups/backend (closes:
    LP#91382).
  * 98_search_mime_files_in_usr_share.dpatch: Let CUPS also search for
    *.types and *.convs files in /usr/share/cups/mime. This way packages can
    provide *.types and *.convs files which do not get considered as conffiles
    (All files in /etc get considered as conffiles, closes: LP#36532).
  * 96_more-bug-fixes-between-cups-1.2.8-1.2.9.dpatch: Keep up with upstream
    bug fixes:
     o cupsd crash in get_jobs: In get_jobs when my-jobs is set, we compare
       the job username before it is loaded (upstream STR #2288).
     o Fixed messed-up french translation (upstream STR #2287).
     o The scheduler's openssl certificate generation code was
       broken on some platforms (upstream STR #2282).
     o The scheduler's log rotation check for devices was
       broken (upstream STR #2278).
     o The LPD mini-daemon did not handle the document-format
       option correctly (upstream STR #2266).

 -- Till Kamppeter <email address hidden>   Mon, 12 Mar 2007 15:22:06 +0000

cupsys (1.2.8-0ubuntu4) feisty; urgency=low

  * debian/cupsys.postinst: (De)activate backends also if the user initially
    installs cupsys (no update from older cupsys package).
  * 96_more-bug-fixes-between-cups-1.2.8-1.2.9.dpatch: Keep up with upstream
    bug fixes:
     o The pdftops filter ignored the "match" size option in the
       pdftops.conf file (upstream STR #2285)
     o cupstestppd now validates UTF-8 text strings in
       globalized PPD files (STR #2283)
     o The outputorder=reverse option did not work with all
       printers (STR #2279)

 -- Till Kamppeter <email address hidden>   Sun, 11 Mar 2007 17:22:06 +0000

cupsys (1.2.8-0ubuntu3) feisty; urgency=low

  * debian/cupsys.templates: Re-activated CUPS backeds "snmp", "serial", and
    "scsi" which were deactivated by Debian. With these backends activated
    many more printers can be easily set up with the printer setup tools.
    Especially network printers get auto-detected and the correct URI gets
    assigned to them (doing this manually is a non-trivial task for most
    users.
  * debian/cupsys.config, debian/cupsys.postinst: (De)activate only if the
    user has called the configuration interface (eg by calling
    "dpkg-reconfigure cupsys") and changed something there.
  * debian/cupsys.postinst: On an update from any older cupsys package to
    this one or newer activate the snmp, scsi, and serial backends.
  * 96_more-bug-fixes-between-cups-1.2.8-1.2.9.dpatch: Keep up with upstream
    bug fixes:
     o Classes containing other classes did not always work (upstream STR
       #2255)
     o Printer location and description information was lost if the
       corresponding string contained the "#" character (upstream STR #2254)
     o cupsRemoveOption() did not work properly (upstream STR #2264)

 -- Till Kamppeter <email address hidden>   Mon,  5 Mar 2007 19:22:06 +0000

cupsys (1.2.8-0ubuntu2) feisty; urgency=low

  * 70_reactivate_recommended_driver.dpatch: Upstream CUPS filters the
    "(recommended)" marking from the NickNames of the PPD files when listing
    PPDs. These are an important orientation for the user and they are also
    made use of by some printer setup tools. We need them at least until a
    better solution for recommending drivers gets available.
  * 80_brother_no_backchannel.dpatch: Brother printers are not accessible
    any more when they have printed one job through the CUPS "usb" backend.
    The problem is solved by letting the backend not querying the backchannel
    on these printers any more (closes: LP#57050, upstream STR #2243).
  * 90_testpage-on-large-paper-sizes.dpatch: The labels at the rulers on the
    borders of the CUPS test page got too big on large paper sizes (closes:
    LP#85339, upstream STR #2252).
  * 92_texttops-prettyprint-crash.dpatch: The plain text filter of CUPS
    crashed when using the prettyprint option (upstream STR #2158).
  * 94_doc-port-in-client-conf.dpatch: The documentation did not tell
    how to specify a port in client.conf.

 -- Till Kamppeter <email address hidden>   Thu, 22 Feb 2007 12:22:06 +0000

cupsys (1.2.8-0ubuntu1) feisty; urgency=low

  * New upstream bugfix release.
  * Removed patches: 00_NNstrXXXX.dpatch, 65_detect_http_shutdown.dpatch:
    These were backported from SVN and are now part of 1.2.8.
  * debian/patches/09_runasuser_autoconf.dpatch: Adapt to new upstream
    version.
  * debian/control: Set Ubuntu maintainer.

 -- Martin Pitt <email address hidden>   Wed, 21 Feb 2007 14:22:44 +0100

cupsys (1.2.2-0ubuntu0.6.06.2~proposed1) dapper-proposed; urgency=low

  * debian/patches/99-svn5875.dpatch: reverts some changes from CUPS STR 1795
    (Closes LP#55828)

 -- Ante Karamatic <email address hidden>   Thu, 24 Aug 2006 21:38:58 +0200

cupsys (1.2.7-4ubuntu2) feisty; urgency=low

  * debian/local/enable_sharing: Fix regex to find both 127.0.0.1 and
    'localhost' to fix enabling sharing the second time. Closes: LP#75903
  * debian/patches/09_runasuser.dpatch: Drop root privileges of cups-polld
    after creating the socket. This allows cupsd to kill polld on shutdown,
    and has the nice side effect of improving security. Closes: LP#30965

 -- Martin Pitt <email address hidden>   Wed,  7 Feb 2007 17:48:28 +0100

cupsys (1.2.7-4ubuntu1) feisty; urgency=low

  * Merge from debian unstable, remaining changes:
    - Snakeoil SSL cert support:
      + debian/control: Add ssl-cert dependency.
      + debian/cupsys.postinst: Symlink snakeoil SSL certificate if present.
    - TearDown (fast shutdown):
      + debian/control: Add sysv-rc (>= 2.86.ds1-14.1ubuntu2) dependency.
      + debian/cupsys.postinst: Remove obsolete rc.d links.
      + debian/rules: Use 'multiuser' update-rc.d mode.
    - debian/control: Drop libcupsys2-gnutls10 and cupsys-dbg packages.
    - Run cupsd as system user 'cupsd' instead of root to confine impact of
      security vulnerabilities:
      + cupsys{,-client}.postinst: Set up cupsys user and put it into the
        appropriate groups.
      + debian/cupsys.init.d: Set up proper permissions of log files.
      + debian/cupsys.init.d: Disable 'reload', force-reload does restart,
        since cupsd cannot reload as non-root.
      + debian/cupsys.logrotate: Own the log files to cupsys:lpadmin.
      + Add debian/patches/ubuntu-external-pam-helper.dpatch: Helper program
        cups-check-pam-auth which performs PAM authentication and returns the
        status as exit code.
      + debian/cupsys.files: Install cups-check-pam-auth.
      + debian/cupsys.postinst: Set permissions of cups-check-pam-auth to
        cupsys:shadow 2754.
      + debian/rules: Configure with --enable-privilege-dropping.
      + debian/rules: Install lpd backend suid root so that it can bind to a
        privileged port.
    - Support user-installed PPDs:
      - debian/cupsys.dirs: Add usr/share/ppd/custom.
      - debian/cupsys.init.d: Set up this dir as root:lpadmin 03775.
    - debian/patches/14_dont_force_ssl.dpatch: Do not require SSL for the web
      frontend since gnome-cups-manager does not cope with that.
    - debian/patches/58_cupsd.conf-AllowLocal.dpatch: Allow access to local
      ethernet by default. This just affects the ACL, for actually enabling
      access cupsd needs to be switched to not only listen on localhost. (So
      this does not need to be configured in two different places).
    - debian/patches/ubuntu-default-error-policy-retry-job.dpatch: Retry a
      failed job instead of stopping the print queue.
    - debian/patches/ubuntu-disable-browsing.dpatch: Disable browsing by
      default.
    - Changed dependency in cupsys-bsd for netbase into update-inetd.
    - Removed obsolete emacs config settings at the end of changelog.
  * debian/cupsys.init.d: Fixed parallel port module loading in the
    init script, the "ppdev" module got only loaded when the "lp"
    module was not loaded yet (closes LP#29050).
  * debian/cupsys.init.d: Set permissions of log files again after
    starting the CUPS daemon, as the daemon sets them to a bad state
    so that it cannot log after dropping privileges (closes LP#54277).

cupsys (1.2.7-2ubuntu1) feisty; urgency=low

  * Merge from debian unstable, remaining changes:
    - Snakeoil SSL cert support:
      + debian/control: Add ssl-cert dependency.
      + debian/cupsys.postinst: Symlink snakeoil SSL certificate if present.
    - TearDown (fast shutdown):
      + debian/control: Add sysv-rc (>= 2.86.ds1-14.1ubuntu2) dependency.
      + debian/cupsys.postinst: Remove obsolete rc.d links.
      + debian/rules: Use 'multiuser' update-rc.d mode.
    - debian/control: Drop libcupsys2-gnutls10 and cupsys-dbg packages.
    - Run cupsd as system user 'cupsd' instead of root to confine impact of
      security vulnerabilities:
      + cupsys{,-client}.postinst: Set up cupsys user and put it into the
        appropriate groups.
      + debian/cupsys.init.d: Set up proper permissions of log files.
      + debian/cupsys.init.d: Disable 'reload', force-reload does restart,
        since cupsd cannot reload as non-root.
      + debian/cupsys.logrotate: Own the log files to cupsys:lpadmin.
      + Add debian/patches/ubuntu-external-pam-helper.dpatch: Helper program
        cups-check-pam-auth which performs PAM authentication and returns the
        status as exit code.
      + debian/cupsys.files: Install cups-check-pam-auth.
      + debian/cupsys.postinst: Set permissions of cups-check-pam-auth to
        cupsys:shadow 2754.
      + debian/rules: Configure with --enable-privilege-dropping.
      + debian/rules: Install lpd backend suid root so that it can bind to a
        privileged port.
    - Support user-installed PPDs:
      - debian/cupsys.dirs: Add usr/share/ppd/custom.
      - debian/cupsys.init.d: Set up this dir as root:lpadmin 03775.
    - debian/patches/14_dont_force_ssl.dpatch: Do not require SSL for the web
      frontend since gnome-cups-manager does not cope with that.
    - debian/patches/58_cupsd.conf-AllowLocal.dpatch: Allow access to local
      ethernet by default. This just affects the ACL, for actually enabling
      access cupsd needs to be switched to not only listen on localhost. (So
      this does not need to be configured in two different places).
    - debian/patches/ubuntu-default-error-policy-retry-job.dpatch: Retry a
      failed job instead of stopping the print queue.
    - debian/patches/ubuntu-disable-browsing.dpatch: Disable browsing by
      default.
    - Changed dependency in cupsys-bsd for netbase into update-inetd.
    - Removed obsolete emacs config settings at the end of changelog.

  * Added directories and links for PPD files according to the FHS
    extension for a distribution-independent printer driver location:
    http://lists.freestandards.org/pipermail/printing-architecture/2006/001512.html
    (Debian bug #408154).

cupsys (1.2.7-1ubuntu2) feisty; urgency=low

  * Change dependency in cupsys-bsd for netbase into update-inetd.
  * Remove obsolete emacs config settings at the end of changelog.

 -- Tollef Fog Heen <email address hidden>   Thu, 14 Dec 2006 11:37:58 +0100

cupsys (1.2.7-1ubuntu1) feisty; urgency=low

  * Merge to Debian unstable to get new upstream bugfix release.

cupsys (1.2.5-1ubuntu1) feisty; urgency=low

  * Merge to Debian svn head. Remaining Ubuntu changes:
    - Snakeoil SSL cert support:
      + debian/control: Add ssl-cert dependency.
      + debian/cupsys.postinst: Symlink snakeoil SSL certificate if present.
    - TearDown (fast shutdown):
      + debian/control: Add sysv-rc (>= 2.86.ds1-14.1ubuntu2) dependency.
      + debian/cupsys.postinst: Remove obsolete rc.d links.
      + debian/rules: Use 'multiuser' update-rc.d mode.
    - debian/control: Drop libcupsys2-gnutls10 and cupsys-dbg packages.
    - Run cupsd as system user 'cupsd' instead of root to confine impact of
      security vulnerabilities:
      + cupsys{,-client}.postinst: Set up cupsys user and put it into the
        appropriate groups.
      + debian/cupsys.init.d: Set up proper permissions of log files.
      + debian/cupsys.init.d: Disable 'reload', force-reload does restart,
        since cupsd cannot reload as non-root.
      + debian/cupsys.logrotate: Own the log files to cupsys:lpadmin.
      + Add debian/patches/ubuntu-external-pam-helper.dpatch: Helper program
        cups-check-pam-auth which performs PAM authentication and returns the
        status as exit code.
      + debian/cupsys.files: Install cups-check-pam-auth.
      + debian/cupsys.postinst: Set permissions of cups-check-pam-auth to
        cupsys:shadow 2754.
      + debian/rules: Configure with --enable-privilege-dropping.
      + debian/rules: Install lpd backend suid root so that it can bind to a
        privileged port.
    - Support user-installed PPDs:
      - debian/cupsys.dirs: Add usr/share/ppd/custom.
      - debian/cupsys.init.d: Set up this dir as root:lpadmin 03775.
    - debian/patches/14_dont_force_ssl.dpatch: Do not require SSL for the web
      frontend since gnome-cups-manager does not cope with that.
    - debian/patches/58_cupsd.conf-AllowLocal.dpatch: Allow access to local
      ethernet by default. This just affects the ACL, for actually enabling
      access cupsd needs to be switched to not only listen on localhost. (So
      this does not need to be configured in two different places).
    - debian/patches/ubuntu-default-error-policy-retry-job.dpatch: Retry a
      failed job instead of stopping the print queue.
    - debian/patches/ubuntu-disable-browsing.dpatch: Disable browsing by
      default.

cupsys (1.2.4-2ubuntu3) edgy; urgency=low

  * Add debian/patches/15_usb-devname.dpatch:
    - Removing the first USB printer caused other USB printers to be
      inaccessible.
    - Upstream: STR#2017
    - Closes: LP#64725

 -- Matthias Urlichs <email address hidden>   Sun,  8 Oct 2006 18:06:23 +0200

cupsys (1.2.4-2ubuntu2) edgy; urgency=low

  * debian/rules: Do not install http/ipp backend with 0700 permissions
    (regression from 1.2.4-2). Closes: LP#63707
  * Add debian/patches/00_dsc-comment-encoding.dpatch:
    - Fix printing of jobs with invalid/misinterpreted characters in the name.
    - Patch taken from upstream SVN, thanks to Till Kamppeter for porting it
      to 1.2.4. (STR#1988)
    - Closes: LP#57445

 -- Martin Pitt <email address hidden>   Thu,  5 Oct 2006 10:30:24 +0200

cupsys (1.2.4-2ubuntu1) edgy; urgency=low

  * Merge recent Debian changes to get some bug fixes and new upstream version
    1.2.4 (UVF exception approved by Matt Zimmerman):
    - The --with-printcap configure option did not work (STR #1984)
    - The character set reported by cupsLangGet() did not always reflect the
      default character set of a given locale (STR #1983)
    - Older Lexmark and Tektronix printers did not work with IPP (STR #1980)
    - Failsafe printing did not work (PR #6328)
    - Some web interface redirects did not work (STR #1978)
    - The web interface change settings button could introduce a "Port 0" line
      in cupsd.conf if there was no loopback connection available (STR #1979)
    - The web interface change settings and edit configuration file buttons
      would truncate the cupsd.conf file (STR #1976)
    - The German web interface used the wrong printer icon images (STR #1973)
    - (The other changes of 1.2.4 were already present as patch in the
      previous version.)
    - Remove transitional PPD symlink which is not necessary any more and just
      causes loops. Closes: LP#62198
    - Fix CPU hogging of gnome-cups-manager. Closes: LP#44196
  * Add debian/patches/ubuntu-default-error-policy-retry-job.dpatch:
    - Do not stop the printer if a job failed, just reattempt it. The default
      policy might be suitable for large offices with an admin, but it
      puts home users at loss. Thanks to Till Kamppeter for the patch!
      Closes: LP#41313

cupsys (1.2.3-1ubuntu3) edgy; urgency=low

  * debian/control: Bump Conflicts/Replaces of cupsys-common to also apply to
    dapper-updates, to fix dapper-updates->edgy upgrade.

 -- Martin Pitt <email address hidden>   Fri, 22 Sep 2006 13:37:04 +0200

cupsys (1.2.2-0ubuntu0.6.06.1) dapper-proposed; urgency=low

  * debian/cupsys.init.d: Always make sure that log files have proper
    permissions. Closes: LP#54277

 -- Martin Pitt <email address hidden>   Wed, 20 Sep 2006 05:51:00 +0000

cupsys (1.2.3-1ubuntu2) edgy; urgency=low

  * debian/patches/56_dirsvc.dpatch: Update patch so that a patch/unpatch
    cycle restores the source properly instead of breaking dirsvc.c in two
    different places.
  * debian/rules: Install 'lpd' backend suid root (root:lp 4754), so that
    cupsd can print to RFC compliant lpd servers (which require the source
    port to be < 1024). Closes: LP#47773

 -- Martin Pitt <email address hidden>   Fri, 15 Sep 2006 19:50:29 +0200

cupsys (1.2.3-1ubuntu1) edgy; urgency=low

  * Merge recent bug fixes from Debian (see Kenshi's changes in 1.2.3-1 for
    Ubuntu-relevant details). 00_r5958.dpatch has the following fixes from
    upstream:
    - The "All Documents" link in the on-line help was missing a trailing
      slash (STR #1971)
    - The Polish web interface translation used the wrong URLs for the job
      history (STR #1963)
    - The "reprint job" button did not work (STR #1956)
    - The scheduler did not always report printer or job events properly (STR
      #1955)
    - The scheduler always stopped the queue on error, regardless of the exit
      code, if the error policy was set to "stop-printer" (STR #1959)
    - ppdEmitJCL() included UTF-8 characters in the JCL job name, which caused
      problems on some printers (STR #1959)
    - Fixed a buffering problem that cause high CPU usage (STR #1968)
      (Closes: LP#59542)
    - The command-line applications did not convert command-line strings to
      UTF-8 as needed (STR #1958)
    - cupsDirRead() incorrectly aborted when reading a symbolic link that
      pointed to a file/directory that did not exist (STR #1953)
    - The cupsInterpretRasterPPD() function did not handle custom page sizes
      properly.
  * debian/cupsys.init.d: Always make sure that log files have proper
    permissions. Closes: LP#54277

cupsys (1.2.3-0ubuntu1) edgy; urgency=medium

  * New upstream bugfix release (UVF exception approved by Colin Watson).
  * Merged with Debian sid.
  * debian/control: Revert Debian's addition of -dbg package, since we will
    have ddebs soon.
  * debian/patches/44_fixconfdirperms.dpatch: Fix file mode specification:
    3755 -> 03755 (regression of svn commit 353).

cupsys (1.2.2-0ubuntu4) edgy; urgency=low

   * Add appropriate Replaces: to cupsys-common to unbreak upgrades.

 -- Martin Pitt <email address hidden>   Mon,  4 Sep 2006 08:53:07 +0200

cupsys (1.2.2-0ubuntu3) edgy; urgency=low

  * Rebuild against dbus 0.90

 -- Sebastian Dröge <email address hidden>   Thu, 24 Aug 2006 17:30:02 +0200

cupsys (1.2.2-0ubuntu0.6.06) dapper-updates; urgency=low

  * New upstream bugfix release:
     - Fixes printing to 1.1.x servers. Closes: LP#42513, LP#42802
     - Fixes parsing of some PostScript files which previously generated empty
       pages. Closes: LP#51432
     - Fixes parsing of network masks. Closes: LP#52390
     - Lots of more fixes, see upstream changelog.
  * Dropped debian/patches/00_r{5643,5660}.dpatch: Upstream now.
  * debian/patches/02_configure.dpatch,
    debian/patches/09_runasuser_autoconf.dpatch: Adapted to new upstream
    version (taken from current edgy package).

 -- Martin Pitt <email address hidden>   Thu, 27 Jul 2006 06:38:01 +0000

cupsys (1.2.2-0ubuntu2) edgy; urgency=low

  * debian/patches/ubuntu-disable-browsing.dpatch: Re-add BrowseAddress
    @LOCAL@ to fix browsing.
  * Enable web interface by default:
    - Add debian/patches/ubuntu-external-pam-helper.dpatch:
      + Add a helper program 'cups-check-pam-auth' which performs PAM
        authentication and returns the status as exit code.
      + scheduler/auth.c, cupsdAuthorize(): Attempt to use
        cups-check-pam-auth before trying native PAM.
    - debian/cupsys.files: Install helper.
    - debian/cupsys.postinst: Set permissions of helper to cupsys:shadow 2754.
  * Remove debian/patches/ubuntu-nowebadmin.dpatch, remove explanation of
    disabled web interface from debian/README.Debian. This version enables the
    web interface by default. Closes: LP#50886
  * debian/cupsys.postinst: Remove cupsys from the shadow group on upgrades,
    so that users who previously enabled the web interface get the benefit of
    privilege separation as well.

 -- Martin Pitt <email address hidden>   Wed, 26 Jul 2006 18:11:22 +0200

cupsys (1.2.2-0ubuntu1) edgy; urgency=low

  * Merge to Debian unstable:
    - This gets rid of /etc/cups/conf.d/ again and re-merges the separate
      browsing and ports settings to /etc/cups/cupsd.conf again. Separating
      was nice for preserving an unchanged conffile for the most important
      settings, but it broke KDE and the web interface and generated way too
      many bugs. Closes: LP#37892, LP#50804, LP#53582
   * Update to new upstream version 1.2.2 (UVF exception granted by by Matt
     Zimmerman):
     - Fixes printing to 1.1.x servers. Closes: LP#42513, LP#42802
     - Fixes parsing of some PostScript files which previously generated empty
       pages. Closes: LP#51432
     - Fixes parsing of network masks. Closes: LP#52390
     - Lots of more fixes, see upstream changelog.
  * debian/cupsys.preinst: Drop some obsolete migration bits for
    Breezy->Dapper upgrade.
  * debian/control: Add libdbus-1-dev build dependency to enable dbus support.
  * debian/cupsys.examples: Do not ship .svn files (upstream Makefiles install
    them).
  * cupsys.postinst: Fix permissions of cupsd.conf to be writable by user
    cupsys world-readable.
  * debian/local/enable_{sharing,browsing}, {sharing,browsing}_status: Adapt
    to new single configuration file format.
  * debian/rules: Clean cups/raster.h symlink to unbreak source package build.
  * Add debian/patches/ubuntu-disable-browsing.dpatch: Disable browsing by
    default to avoid open port and stay compatible to previous releases.

cupsys (1.2.1-2ubuntu4) edgy; urgency=low

  * Add forgotten versioned-dependency on sysv-rc to get new update-rc.d
    behaviour.  Go me.

 -- Scott James Remnant <email address hidden>   Fri, 21 Jul 2006 01:20:39 +0100

cupsys (1.2.1-2ubuntu3) edgy; urgency=low

  * Remove stop links from rc0 and rc6

 -- Scott James Remnant <email address hidden>   Thu, 20 Jul 2006 22:13:25 +0100

cupsys (1.2.1-0ubuntu2) dapper-updates; urgency=low

  * Add debian/patches/00_r5660.dpatch
    - Fix for 11.22.33.* network masks (STR #1769), Closes: LP#52390
  * Fixed debian/patches/05_avoidunknowngroup
    - Don't create .rej files
  * Fixed debian/rules
    - Delete backend/*.o on clean

 -- Ante Karamatic <email address hidden>   Sun,  9 Jul 2006 08:05:12 +0200

cupsys (1.2.1-0ubuntu1) dapper-updates; urgency=low

  * Upgrade to new upstream version 1.2.1 (backported from edgy):
    - fix for printing on Xerox IPP printers; Closes: LP#47387
    - fix for banners on single page
    - fix for custom page sizes (cups ignores them now in some cases)
    - fix for -u and -U switches for lpadmin
    - fix for printing on some Canon printers
    - fix for printing on CUPS server < 1.1.17 (RHEL3 and older)
      (partly fixes LP bug #42802)
    - couple of fixes for imagetoraster
  * Add debian/patches/00_r5643.dpatch: Pull some fixes from upstream SVN
    scheduled to go into 1.2.2:
    - The lpstat command did not use the correct character
      set when reporting the date and time (STR #1751)
    - The cupsaddsmb command and web interface did not update
      the Windows PPD files properly, resulting in corrupt
      PPD files for the Windows client to use (STR #1750)
    - The cupsd.conf man page didn't describe the Listen
      domain socket syntax (STR #1753)
    - The scheduler no longer tries to support more than
      FD_SETSIZE file descriptors.
    - The USB backend now reports a "no such device" error
      when using the old filename-based USB URIs instead of
      the "success" error.
    - Increased the HTTP and IPP read timeouts to 10 seconds,
      as 1 second was too short on congested networks (STR
      #1719)
    - Fixed another file descriptor leak when printing raw
      files (STR #1736)
    - The scheduler didn't always choose the least costly
      filter.
    - Fixed parsing of IPv6 addresses in Allow, Deny,
      BrowseAllow, BrowseDeny, and BrowseRelay directives
      (STR #1713)
    - Special cases for the "localhost" hostname did not
      work, causing printing to not work when the /etc/hosts
      file did not contain a localhost entry (STR #1723)
    - Updated the Spanish translation (STR #1720)
    - Reverse-order page output was broken when N-up or
      landscape orientations were used (STR #1725)
    - The parallel, serial, socket, and USB backends needed
      print data before they would report back-channel data,
      causing problems with several new drivers (STR #1724)
  * Ship /etc/cups/ssl directory. Closes: LP#44931
  * Removed debian/patches/svn*.dpatch, these were backported from 1.2.1 in
    1.2.0-0ubuntu3.
  * debian/cupsys.init.d: Add missing log_end_msg. Closes: LP#48116
  * Bump up shlibs to >= 1.2.1 for compatibility safety.

 -- Martin Pitt <email address hidden>   Thu,  6 Jul 2006 19:25:04 +0200

cupsys (1.2.1-2ubuntu2) edgy; urgency=low

  * debian/patches/44_fixconfdirperms.dpatch:
    - Do not change owner and mode of SSL certificate, in order to not break
      the SSL snakeoil cert/key (and customized global ones). (Grrr, cups, no,
      you cannot own the world!)
  * debian/cupsys.preinst: Add transitional code to fix snakeoil SSL cert/key
    owner and mode.

 -- Martin Pitt <email address hidden>   Tue, 27 Jun 2006 16:05:38 +0200

cupsys (1.2.1-2ubuntu1) edgy; urgency=low

  * Merge to current SVN head of Debian.
  * Removed debian/patches/svn*.dpatch, these were backported from 1.2.1 in
    1.2.0-0ubuntu3.
  * Do not build libcupsys2-gnutls10 any more (it was a transitional package).
  * snakeoil SSL certificate support:
    - debian/cupsys.postinst: Symlink snakeoil SSL certificate/key to
      /etc/cups/ssl/ and put cupsys into ssl-cert on upgrades or fresh
      installs.
    - debian/control: Depend on ssl-cert.

cupsys (1.2.0-0ubuntu5) dapper; urgency=low

  * Remove debian/patches/56_revert_svn_5438.dpatch: The reason for this
    reversion has now been fixed in gnome-cups-manager 0.31-1.1ubuntu8. This
    fixes the handling of spaces in manufacturer names. Closes: LP#33545

 -- Martin Pitt <email address hidden>   Wed, 17 May 2006 13:18:05 +0200

cupsys (1.2.0-0ubuntu4) dapper; urgency=low

  * Add debian/patches/svn5530_str1667_octet_stream.dpatch: Fix printing of
    application/octet-stream jobs (usually from Windows clients with locally
    installed driver). (STR #1667) Closes: LP#43145

 -- Martin Pitt <email address hidden>   Wed, 17 May 2006 08:58:16 +0200

cupsys (1.2.0-0ubuntu3) dapper; urgency=low

  * Pull some bug fixes from SVN head:
  * Add debian/patches/svn5512_KCMYcm_fix.dpatch: Fix bug in KCMYcm handling
    (typo in variable name).
  * Add debian/patches/svn5518_12bitraster.dpatch: Make sure we swap 12/16 bit
    chunky data in raster filter.
  * Add debian/patches/svn5523_1_2_4bit_raster.dpatch:
    - Fix imagetoraster generation of 1/2/4-bit raster data.
    - Fix cupsRasterWritePixels() - bad double line termination.
  * Add debian/patches/svn5526_str1676_stopped_jobs_active.dpatch: Fix stopped
    jobs to be considered active (STR #1676).
  * Add debian/patches/svn5527_LDAP_define.dpatch: Fix typo in #ifdef:
    s/OPENDAP/OPENLDAP/.
  * Add debian/patches/svn5527_str1683_lpstaterror.dpatch: The lpstat command
    displayed the wrong error message for a missing destination (STR #1683).
  * Add debian/patches/svn5527_str1689_printeroptions.dpatch: "Set Printer
    Options" in the web interface did not update the DefaultImageableArea or
    DefaultPaperDimension attributes in the PPD file (STR #1689).
  * Add debian/patches/svn5528_str1680_load_custom_options.dpatch: ppdOpen*()
    did not load custom options properly (STR #1680).

 -- Martin Pitt <email address hidden>   Tue, 16 May 2006 12:39:35 +0200

cupsys (1.2.0-0ubuntu2) dapper; urgency=low

  * debian/cupsys.init:
    - Load the 'lp' module. Earlier installers did not put it in /etc/modules
      and we keep getting dozens of bug reports about that, so let's just fix it
      here once and for all.
    - Load the 'ppdev' module. This should fix detection of parallel printers.
      Closes: LP#29050

 -- Martin Pitt <email address hidden>   Thu, 11 May 2006 11:09:59 +0200

cupsys (1.2.0-0ubuntu1) dapper; urgency=low

  * Final 1.2.0 upstream release (bug fixes only). Closes: LP#43898
  * Remove debian/patches/01_cupsimage.dpatch, fixed upstream.
  * Remove debian/patches/57_svn_5461.dpatch, fixed upstream.
  * debian/patches/58_cupsd.conf-AllowLocal.dpatch: Fix typo: @LOCAL@ ->
    @LOCAL. Closes: LP#43933

 -- Martin Pitt <email address hidden>   Wed, 10 May 2006 12:09:54 +0200

cupsys (1.1.99.rc3-0ubuntu4) dapper; urgency=low

  * Add debian/patches/58_cupsd.conf-AllowLocal.dpatch: Add 'Allow @LOCAL'
    to server ACL to actually allow LAN computers to access the printer if
    sharing is enabled. This avoid having to change two things for enabling
    printer sharing (a source of much confusion and a FAQ). This does not
    change the default behavior (port only listens on localhost by default).

 -- Martin Pitt <email address hidden>   Tue,  9 May 2006 17:53:02 +0200

cupsys (1.1.99.rc3-0ubuntu3) dapper; urgency=low

  * debian/cupsys.config: Print migration note to stderr, not stdout, to not
    confuse debconf. Closes: LP#41716
  * debian/cupsys.postinst: Fix ownership of files in /var/cache/cups/ so that
    they are writable by non-root cupsd. Earlier dapper versions got the
    ownership wrong, so fix this for intra-dapper upgrades. Closes: LP#40795
  * Add debian/local/{sharing_status,enable_sharing}: Scripts to control
    printer sharing (by opening or closing the TCP port). Thanks to Ante
    Karamatić for his initial scripts and research!

 -- Martin Pitt <email address hidden>   Tue,  9 May 2006 16:33:19 +0200

cupsys (1.1.99.rc3-0ubuntu2) dapper; urgency=low

  * debian/cupsys.init.d: Fix log creation for real. Closes: LP#41267
  * debian/cupsys.logrotate: Create files as cupsys:lpadmin, not root:lp.
    (Also part of LP#41267)

 -- Martin Pitt <email address hidden>   Tue,  2 May 2006 19:36:22 +0200

cupsys (1.1.99.rc3-0ubuntu1) dapper; urgency=low

  * New upstream bug fix release 1.2RC3, UVF exception approved by Matt
    Zimmerman.
  * Add debian/patches/56_revert_svn_5438.dpatch: Revert upstream svn commit
    5438 (fixed handling of products/manufacturers with spaces in the name)
    for now since it causes regressions in gnome-cups-add. Will be reactivated
    later when the issue is sorted out with upstream.
  * Update patches for new upstream release.
  * Remove debian/patches/20_httpGetHostname_crash.dpatch, fixed upstream.
  * Add debian/patches/14_dont_force_ssl.dpatch: Upstream now requires
    encryption by default for accessing /admin/, but our GUI frontends do not
    yet cope with that. Disable SSL requirement for now to revert to the old
    behaviour.
  * debian/patches/08_cupsd.conf.conf.d.dpatch:
    - Set "BrowseAddress @LOCAL"; without this, sending browsing information
      does not work (Browsing still has to be enabled). Since enable_browsing
      now works for exporting printers, too, this Closes: LP#17981
    - Add some comments to point out that the Port and Browsing settings are
      moved to /etc/cups/cups.d/.
  * debian/cupsys.postrm: Clean up passwd.md5 on purge.
  * debian/cupsys.init.d: Pre-create error_log, too, and clean up code a bit.
    Closes: LP#41267
  * debian/cupsys.postinst: If upgrading from Breezy, adapt the inclusion of
    external browsing configuration in cupsd.conf to retain the correct
    setting for modified cupsd.conf files.
  * debian/cupsys.config:
    - Fix handling of cupsd-browsing.conf -> cups.d/browse.conf transition for
      breezy->dapper upgrades.
    - Fix browse.conf parsing to set the correct debconf default value, so
      that the browse setting is not reset to 'off' on upgrades.
      Closes: LP#38704
  * Add debian/patches/57_svn_5461.dpatch:
    - Properly HTML-quote the printer name so that names containing e. g. '+'
      work properly in the web interface.
    - Upstream svn commit 5461.
    - Closes: LP#37018

 -- Martin Pitt <email address hidden>   Tue, 25 Apr 2006 20:09:37 +0200

cupsys (1.1.99.rc2-0ubuntu2) dapper; urgency=low

  * debian/cupsys-client.links: Fix cupsenable/cupsdisable manpage link.
    Closes: LP#40725
  * debian/patches/09_runasuser.dpatch: Do not drop additional group
    privileges in scheduler/process.c. This should fix a range of bugs
    concerning detection of parallel port printers and other 'permission
    denied' bugs.

 -- Martin Pitt <email address hidden>   Mon, 24 Apr 2006 19:17:12 +0200

cupsys (1.1.99.rc2-0ubuntu1) dapper; urgency=low

  * Many changes have been applied in Debian now; reapply remaining Ubuntu
    changes from scratch to clean up some cruft (see below for details). Also,
    maintain Ubuntu package as SVN branch of the Debian one.
  * debian/rules: Enable --with-cups-user=cupsys and
    --enable-privilege-dropping to not run cupsd as root.
  * debian/control: Remove libdbus-1-dev build dependency, dbus support is not
    something for dapper.
  * debian/cupsys.init.d: Disable reload (it doesn't work as normal user),
    change force-reload to restart.
  * debian/cupsys.init.d: Pre-create access_log and error_log since cupsd
    can't create them as normal user.
  * debian/rules: Set rc runlevel priority to 19.
  * debian/cupsys.{postinst,postrm}, debian/cupsys-client.postinst:
    Setup/remove cupsys user and its needed groups.
  * debian/cupsys.templates: Disable browsing by default due to our 'no open
    ports in the default install' policy.
  * debian/README.Debian: Explain disabling of administrative functions in web
    interface and describe how to re-enable it.
  * debian/cupsys.preinst:
    - Migrate /etc/cups/cupsd-browsing.conf to /etc/cups/cups.d/browse.conf
      for smooth upgrades from Hoary.
    - Fix owner of /etc/cups/ppd/* on upgrades.
  * debian/patches/ubuntu-nowebadmin.dpatch: Explain disabling of
    administrative functions in the web interface and point to doc how to
    reenable it.
  * debian/patches/55_ppd_okidata_name.dpatch: Change "Oki" manufacturer name
    to "Okidata" to be consistent with other PPD files.
  * Implement http://wiki.debian.org/PpdFileStructureSpecification:
    - debian/dirs: Create /usr/share/ppd/cups-included/.
    - debian/rules: Install shipped PPDs into
      /usr/share/ppd/cups-included/<Manufacturer>/ and provide a symlink to
      the old /usr/share/cups/model directory for backwards compatibility.
  * debian/libcupsys2.shlibs: Remove Debian revision to allow -0ubuntuN
    number.
  * Support custom PPD installation by lpadmin members (through e. g.
    gnome-cups-manager):
    - debian/cupsys.dirs: Create /usr/share/ppd/custom/.
    - debian/cupsys.init.d: Fix permissions of that dir to root:lpadmin 3775.
    - debian/rules: Install compatibility symlink
      /usr/share/cups/model/custom.
  * debian/cupsys.dirs: Ship /usr/lib/cups/driver/ to avoid error messages if
    it's missing.
  * debian/patches/09_runasuser.dpatch, scheduler/cert.c: Change root
    certificate permissions from 0440 to 0240, so that the CGI programs cannot
    read it any more. Without this patch, cupsd presented its own certificate
    to itself, and *every* user could do admin tasks without authentication.

cupsys (1.1.99.b1.r4929-0ubuntu9) dapper; urgency=low

  * Correct permissions of /var/run/cups in the init script.

 -- Scott James Remnant <email address hidden>   Wed, 19 Apr 2006 14:15:14 +0100

cupsys (1.1.20final+cvs20040330-4ubuntu16.11) warty-security; urgency=low

  * SECURITY UPDATE: Buffer overflows.
  * Add debian/patches/47CVE-2006-1244.patch:
    - xpdf/JBIG2Stream.cc, xpdf/Stream.h: Fix various integer overflows.
    - Upstream patch from Derek Noonburg.
  * CVE-2006-1244

 -- Martin Pitt <email address hidden>   Wed, 12 Apr 2006 10:18:37 +0200

cupsys (1.1.99.b1.r4929-0ubuntu8) dapper; urgency=low

  * Disable 53_usr_share_ppd_support.dpatch again, too many
    packages still have /usr/share/cups/model hardcoded.
  * Symlink /usr/share/cups/model/cups-included to /usr/share/ppd/cups-included.
  * Place ppd files in manufacturer specific subdirectories.
  * Change "Oki" manufacturer name to "Okidata".
  * Symlink /usr/share/cups/model/custom to /usr/share/ppd/custom.

 -- Matthias Klose <email address hidden>   Wed, 12 Apr 2006 19:26:18 +0200

cupsys (1.1.99.b1.r4929-0ubuntu7) dapper; urgency=low

  * debian/cupsys.init.d: Move log_end_msg to the right place again.
  * Add debian/patches/53_usr_share_ppd_support.dpatch:
    - Look for PPDs in /usr/share/ppd, according to
      http://wiki.debian.org/PpdFileStructureSpecification.
    - Fixes Debian bug #358186.
  * debian/rules: Install PPD files into /usr/share/ppd/cups-included,
    according to above specification.
  * debian/patches/54_cups-config_modeldir.dpatch: Add --modeldir to
    cups-config so that other packages can use it to figure out the correct
    PPD base path.
  * debian/libcupsys2.shlibs: Bump version number so that other packages can
    rely on cups-config's modeldir.
  * Re-add debian/patches/51_dont_log_ipp_printer_query.dpatch, since these
    log messages are routed through a different code path.
  * debian/cupsys.init.d: Change custom PPD path from /usr/share/cups/ppd to
    /usr/share/ppd/custom.

 -- Martin Pitt <email address hidden>   Fri,  7 Apr 2006 17:14:25 +0200

cupsys (1.1.99.b1.r4929-0ubuntu6) dapper; urgency=low

  * Add debian/patches/51_ipp_log_severity_info.dpatch: Drop successful IPP
    messages to log level 'debug' and unsuccessful ones to 'info'. This is a
    more generic approach to avoid ridiculously huge logs due to polling by
    gnome-cups-icon and friends.
  * Drop debian/patches/51_dont_log_ipp_printer_query.dpatch, obsoleted by
    above patch.
  * Add debian/patches/52_default_log_level_warning.dpatch: Raise default log
    level from info to warning. Closes: LP#38042

 -- Martin Pitt <email address hidden>   Thu,  6 Apr 2006 12:05:45 +0200

cupsys (1.1.99.b1.r4929-0ubuntu5) dapper; urgency=low

  * debian/patches/51_dont_log_ipp_printer_query.dpatch: Suppress logging of
    successful CUPS_GET_DEFAULT messages, too. Closes: LP#29895
  * debian/pdftops: Fix reading from stdin. Closes: LP#17124

 -- Martin Pitt <email address hidden>   Thu, 30 Mar 2006 19:52:20 +0200

cupsys (1.1.99.b1.r4929-0ubuntu4) dapper; urgency=low

  * debian/cupsys.postinst: Make sure that the scanner group exists before
    trying to add the cupsys user to it.

 -- Colin Watson <email address hidden>   Thu,  9 Mar 2006 08:20:02 +0000

cupsys (1.1.99.b1.r4929-0ubuntu3) dapper; urgency=low

  * debian/rules: Do not install dangling pdftops.conf symlink. (Malone #26785)
  * debian/cupsys.preinst: Remove a dangling pdftops.conf symlink on upgrades
    to this version.
  * debian/cupsys.postinst: Add cupsys to group 'scanner' to be able to access
    printer/scanner combined devices. (Malone #29050)
  * debian/patches/44_fixconfdirperms.dpatch: Make /etc/cups/ppd group
    writable. (Malone #31533)
  * debian/cupsys.init.d: Make sure that page_log exists with the right
    permissions. (Malone #33409)
  * Add debian/patches/51_dont_log_ipp_printer_query.dpatch: Do not flood
    access_log with successful CUPS-Get-Printers and Get-Printer-Attributes
    queries (which are generated by gnome-cups-icon every 3 seconds). This is
    a hideous and hackish patch, but it has to do until we dbusify cupsys
    properly. (Malone #29895)

 -- Martin Pitt <email address hidden>   Mon,  6 Mar 2006 16:08:32 +0100

cupsys (1.1.99.b1.r4929-0ubuntu2) dapper; urgency=low


  * Add 50_truncate_ppd.dpatch:
    - cups/file.c: Do not forget to write the pending uncompressed tail when
      copying a compressed file. Fixes cropped PPD files in /etc/cups/ppd.
    - Patch taken from upstream svn commit 4942.
    - Malone #28642
  * debian/cupsys.init.d: Create access_log with proper permissions if it does
    not yet exist. (Malone #28492)
  * debian/cupsys.preinst: If we upgrade from a version earlier than this one,
    change all root-owned PPD files in /etc/cups/ppd to be owned by cupsys.
    (Malone #12879)

 -- Martin Pitt <email address hidden>  Thu, 19 Jan 2006 16:55:51 +0100

cupsys (1.1.99.b1.r4892-0ubuntu1) dapper; urgency=low


  * New upstream snapshot.
  * Adapt patches to new upstream version:
    - 02_configure.dpatch
    - 48_stdlib.dpatch
    - ubuntu-nowebadmin.dpatch
  * Add debian/patches/50_local_username_check.dpatch: Fix the restriction
    of changing/cancelling of print jobs to the owner.
    - scheduler/auth.c: Disable weird code that bypasses user name check for
      local authentication.
    - scheduler/ipp.c: Copy the determined user name of the connection to the
      con structure, so that cupsdCheckPolicy() has a chance to actually
      verify it.
    - Ubuntu #12177

 -- Martin Pitt <email address hidden>  Fri, 13 Jan 2006 15:28:22 +0100

cupsys (1.1.99.b1.r4841-1ubuntu8) dapper; urgency=low


  * debian/cupsys.init.d: Remove the hideous killing hacks and just invoke
    start-stop-daemon with the correct arguments.

 -- Martin Pitt <email address hidden>  Wed, 11 Jan 2006 19:23:47 +0100

cupsys (1.1.99.b1.r4841-1ubuntu7) dapper; urgency=low


  * debian/cupsys.init.d: Make sure that the PID file directory /var/run/cups
    exists. The new approach of mounting /var/run as tmpfs removes the
    directory that is shipped in the deb. (Ubuntu #22261)

 -- Martin Pitt <email address hidden>  Wed, 11 Jan 2006 13:47:45 +0100

cupsys (1.1.99.b1.r4841-1ubuntu6) dapper; urgency=low


  * debian/cupsys.init: Call stop/start in the 'restart/force-reload' section
    to make use of the much more robust 'stop' handling. This should avoid
    frequent failures of force-reload. (Ubuntu #21787)
  * debian/cupsys.postinst:
    - Set permissions of /etc/cups/interfaces to root:lpadmin 2775.
    - Make /etc/printcap writable for group lpadmin.
    - This fixes third-party printer drivers and command line tools.
    - Ubuntu #20891

 -- Martin Pitt <email address hidden>  Thu,  5 Jan 2006 18:11:51 +0100