Adding debian version 2.4.1-3.debian/2.4.1-3debian

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

72 files changed, 4640 insertions, 0 deletions

diff --git a/debian/NEWS b/debian/NEWS
new file mode 100644
index 0000000..ad1bd54
--- /dev/null
+++ b/debian/NEWS
@@ -0,0 +1,39 @@
+isc-kea (2.2.0-8) unstable; urgency=medium
+
+  Require user authentication to access the kea-ctrl-agent API service.
+
+  Upgrades from previous versions, or fresh installs, will get a debconf
+  "high" priority prompt with 3 options:
+  - no action (default)
+  - configure with a random password
+  - configure with a given password
+
+  If there is no password, the kea-ctrl-agent will NOT start.
+
+  The password is expected to be in /etc/kea/kea-api-password, with ownership
+  root:_kea and permissions 0640. To change it, run `dpkg-reconfigure
+  kea-ctrl-agent` (which will present the same 3 options from above again), or
+  just edit the file manually.
+
+ -- Andreas Hasenack <andreas@canonical.com>  Fri, 17 Mar 2023 11:28:49 -0300
+
+isc-kea (2.2.0-3) unstable; urgency=medium
+
+  Starting with this upload, all the kea services are confined by default with
+  apparmor (if it's enabled on the host).
+
+ -- Paride Legovini <paride@debian.org>  Fri, 17 Feb 2023 19:59:43 +0100
+
+isc-kea (2.2.0-2) unstable; urgency=medium
+
+  The control sockets were moved to /run/kea (Closes: #1014929)
+
+  keactrl is no longer being installed. This script is not systemd-aware and
+  not installed by the upstream .deb packages.
+
+  Default logging of all kea services is set to "output" in their respective
+  configuration files. This means they end up in the systemd journal logging.
+  (Closes: #1016747)
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 14 Feb 2023 11:24:58 -0300
+
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..5e170cb
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,522 @@
+isc-kea (2.4.1-3) unstable; urgency=medium
+
+  [ Paride Legovini ]
+  * d/t/smoke-test: add sleep to allow for the services to start
+  * d/t/kea-ctrl-agent-debconf override systemd restart limit.
+    Thanks to Andreas Hasenack
+  * ci: salsa pipeline: disable the crossbuild-arm64 job
+  * ci: salsa pipeline: fail on Lintian warnings
+  * d/*.l-o: drop unused overrides
+  * kea-dev: build and install kea-msg-compiler.
+    Thanks to Quentin Armitage (Closes: #1065362)
+  * d/kea-dev.l-o: override no-manual-page for kea-msg-compiler
+  * ci: salsa pipeline: enable reprotest, without build_path variation.
+    Thanks to Holger Levsen
+  * d/p/0001-support_kfreebsd.patch: drop patch.
+    The development of Debian GNU/kFreeBSD terminated in July 2023.
+  * d/p/0011-kea-ctrl-agent-authentication.patch: add dep-3 headers
+  * d/*.init: fix SysV init scripts.
+    Thanks to Stefan Klein (Closes: #1055438)
+  * d/rules: disable LTO on ppc64el as it causes crashes.
+    Thanks to Sergio Durigan Junior (LP: #2055151)
+
+  [ Andreas Hasenack ]
+  * apparmor: also allow reading the pid file.
+    At least kea-ctrl-agent attempts to read the pid file, and it makes
+    sense to allow that. Also make the change for all other profiles.
+
+ -- Paride Legovini <paride@debian.org>  Fri, 29 Mar 2024 16:38:54 +0100
+
+isc-kea (2.4.1-2) unstable; urgency=medium
+
+  * Team upload.
+
+  [ Athos Ribeiro ]
+  * d/*.service: Remove dhcp{4,6} WantedBy statements
+
+  [ Paride Legovini ]
+  * d/po/fr.po: add French templates translation.
+    Thanks to Jean-Pierre Giraud (Closes: #1059863)
+  * d/copyright: update copyright years for debian/*
+
+  [ Andreas Hasenack ]
+  * apparmor: add missing include directive.
+    Add a missing include directive to all profiles include the
+    site-specific additions and overrides. (Closes: #1064513)
+
+ -- Andreas Hasenack <andreas@canonical.com>  Mon, 26 Feb 2024 10:32:35 -0300
+
+isc-kea (2.4.1-1) unstable; urgency=medium
+
+  * New upstream version 2.4.1
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 14 Dec 2023 17:21:04 -0300
+
+isc-kea (2.4.0-1) unstable; urgency=medium
+
+  [ Paride Legovini ]
+  * d/control: add Athos Ribeiro to Uploaders
+  * d/*.init: specify the daemons' full path.
+    Thanks to Alessandro Vesely (Closes: #1052338)
+
+  [ Athos Ribeiro ]
+  * New upstream version 2.4.0 (Closes: #1040523)
+  * d/patches: refresh patches
+  * d/rules: remove cleanup for kea_connector2.py
+  * d/t/kea-dhcp4: check if lease lifetime is valid
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 26 Oct 2023 09:17:18 -0300
+
+isc-kea (2.2.1-3) unstable; urgency=medium
+
+  [ Andreas Hasenack ]
+  * apparmor: allow kea-ctrl-agent to access IPv6 sockets
+    (Closes: #1052764)
+
+ -- Paride Legovini <paride@debian.org>  Wed, 27 Sep 2023 14:47:14 +0200
+
+isc-kea (2.2.1-2) unstable; urgency=medium
+
+  * d/po/de.po: add German debconf translation.
+    Thanks to Christoph Brinkhaus (Closes: #1041710)
+  * d/po/es.po: add Spanish debconf translation.
+    Thanks to Camaleón (Closes: #1041772)
+  * d/po/nl.po: add Dutch debconf translation.
+    Thanks to Frans Spiesschaert (Closes: #1041875)
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Sun, 10 Sep 2023 10:09:52 -0300
+
+isc-kea (2.2.1-1) unstable; urgency=medium
+
+  * d/u/signing-key.asc: update upstream signing key
+  * New upstream version 2.2.1
+  * Fix typo in debconf string.
+    Thanks to Helge Kreutzmann (Closes: #1041394)
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 04 Aug 2023 07:37:08 -0300
+
+isc-kea (2.2.0-8) unstable; urgency=medium
+
+  [ Athos Ribeiro ]
+  * d/rules: add strict shlibs control file
+
+  [ Andreas Hasenack ]
+  * Restrict access to the default RESTful API on 127.0.0.1:8000 to
+    authenticated users (Closes: #1033367) (LP #2007312):
+    - Add debconf templates to restrict API access
+    - d/control: add debconf build-deps
+    - d/kea-ctrl-agent.postinst: handle kea-api password creation
+    - d/kea-ctrl-agent.config: prepare debconf questions
+    - d/kea-ctrl-agent.postrm: purge api password file
+    - d/p/0011-kea-ctrl-agent-authentication.patch
+    - d/t/kea-ctrl-agent.service: require a non-empty kea api password file
+    - d/t/control, d/t/kea-ctrl-agent-debconf: test debconf options
+    - d/t/smoke-tests, d/t/kea-dhcp4: support kea-ctrl-agent authentication
+  * d/NEWS: update with noteworthy changes
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 04 Jul 2023 10:40:32 -0300
+
+isc-kea (2.2.0-6) unstable; urgency=medium
+
+  [ Andreas Hasenack ]
+  * apparmor: use the apparmor nameservice abstraction.
+    Use the apparmor nameservice abstraction instead of hand-picked rules.
+    (Closes: #1033640, #1033639)
+
+ -- Paride Legovini <paride@debian.org>  Mon, 03 Apr 2023 12:48:28 +0200
+
+isc-kea (2.2.0-5) unstable; urgency=medium
+
+  [ Paride Legovini ]
+  * d/control: update to Standards-Version 4.6.2, no changes needed
+
+  [ Andreas Hasenack ]
+  * d/t/kea-dhcp4.conf.template: retry opening a socket. Sometimes the
+    `keabr0` bridge used in the DEP8 test takes a while to become ready, and
+    kea-dhcp4 fails to open a socket on it. Add configuration options to
+    kea-dhcp4 to retry opening the socket a few times before giving up.
+    (LP: #2008932)
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 02 Mar 2023 14:00:17 -0300
+
+isc-kea (2.2.0-4) unstable; urgency=medium
+
+  [ Athos Ribeiro ]
+  * d/rules: use MathJax from libjs-mathjax instead loading from external CDN
+
+  [ Andreas Hasenack ]
+  * d/t/kea-dhcp4: make the test more robust
+    - increase dhclient timeout to 60s, and run in verbose mode
+    - show logs in the case of failure
+    - set +e inside the cleanup handler
+    - fix resolv.conf regexp
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 27 Feb 2023 14:58:26 -0300
+
+isc-kea (2.2.0-3) unstable; urgency=medium
+
+  [ Andreas Hasenack ]
+  * Add apparmor profiles.
+    - d/control: add build-depends on dh-apparmor
+    - d/usr.sbin.kea-*: add the profiles
+    - d/kea-*.install: install the profiles
+    - d/rules: use dh_apparmor to enable the profiles
+  * d/tests: Add DEP8 test for kea-dhcp4
+
+ -- Paride Legovini <paride@debian.org>  Fri, 17 Feb 2023 19:59:43 +0100
+
+isc-kea (2.2.0-2) unstable; urgency=medium
+
+  [ Athos Ribeiro ]
+  * d/tests: add simple DEP8 smoke tests
+  * Set default control sockets location to /run/kea (Closes: #1014929)
+    (LP: #1863100)
+
+  [ Paride Legovini ]
+  * d/control: drop dependency on lsb-base (obsolete)
+  * d/salsa-ci.yml: enable the autopkgtest job
+  * d/kea-common.*:
+    - Do not install keactrl. The keactrl script is not systemd-aware and not
+      installed by the upstream .deb packages. Remove it from the Debian
+      packaging
+    - Leave handling of /var/*/kea directories to systemd. No need to create
+      them in packaging as the systemd units will automatically create them
+      with the right ownership and permissions
+  * d/*.service:
+    - Do not set KEA_LOGGER_DESTINATION. The variable is meant to tell the
+      daemons where to log *before* their config files are loaded. If unset
+      the default is stdout, which works well with systemd
+    - Do not set KEA_PIDFILE_DIR. What we set it to corresponds to the
+      defaults. The documentation says that KEA_PIDFILE_DIR "is intended
+      primarily for testing"
+  * d/rules: use the systemd journal for logging (Closes: #1016747)
+    (LP: #2006522)
+  * d/kea-doc.README.Debian: document how logging is done by default
+  * d/tests/smoke-tests: check location of PID and lock files
+
+ -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 14 Feb 2023 11:24:58 -0300
+
+isc-kea (2.2.0-1) unstable; urgency=medium
+
+  * New upstream version 2.2.0.
+    Thanks to Daniel Baumann (Closes: #1016109)
+  * debian/patches:
+    - 0002-kea_admin_fix.patch: refresh patch
+    - 0007-keyctrl-colored-ddns-status.patch: drop patch (fixed upstream)
+    - 0009-disable-database-tests.patch: refresh patch
+    - 0010-build-libco-when-gtest-is-not-enabled: drop patch (fixed upstream)
+    - 0011-sphinx-set-language.patch: drop patch (fixed upstream)
+  * d/kea-doc.doc-base: register documentation to doc-base
+  * Lintian overrides:
+    - *.lintian-overrides: adapt to "pointed hints" syntax
+    - kea-admin.l-o: bash-term-in-posix-shell (false positives)
+    - d/kea-doc.l-o: add overrides for sphinx installed fonts.
+      + font-in-non-font-package [usr/share/doc/kea/html/_static/fonts/*]
+      + font-outside-font-dir [usr/share/doc/kea/html/_static/fonts/*]
+  * d/copyright: remove file patterns made unnecessary by new release
+  * d/salsa-ci.yml: add salsa CI
+
+ -- Paride Legovini <paride@debian.org>  Tue, 02 Aug 2022 12:16:45 +0000
+
+isc-kea (2.0.2-3) unstable; urgency=medium
+
+  * d/rules: configure: specify the Python site packages location.
+    Related changes:
+     - d/python3-kea-connector.install: update paths accordingly
+    Thanks to Kilian Krause (Closes: #1014995)
+
+ -- Paride Legovini <paride@debian.org>  Wed, 20 Jul 2022 16:03:19 +0000
+
+isc-kea (2.0.2-2) unstable; urgency=medium
+
+  * d/patches: explicitly set the sphinx doc language.
+    Needed for compatibility with Sphinx 5.0. New patch:
+    - d/p/0011-sphinx-set-language.patch (Closes: #1013407)
+  * d/control: bump Standards-Version to 4.6.1, no changes needed
+  * d/gbp.conf: debian-branch = debian/unstable (DEP-14)
+  * d/gbp.conf: enable use of pristine-tar
+  * d/watch.include-odd-versions: alternative watch file.
+    Also covers the odd-numbered (= devel) upstream releases.
+
+ -- Paride Legovini <paride@debian.org>  Sun, 26 Jun 2022 14:48:25 +0000
+
+isc-kea (2.0.2-1) unstable; urgency=medium
+
+  * New upstream version 2.0.2
+
+ -- Paride Legovini <paride@debian.org>  Mon, 07 Mar 2022 21:13:17 +0000
+
+isc-kea (2.0.1-2) unstable; urgency=medium
+
+  * Upload to Debian unstable
+  * wrap-and-sort -bast (cosmetic)
+
+ -- Paride Legovini <paride@debian.org>  Sun, 30 Jan 2022 19:39:09 +0100
+
+isc-kea (2.0.1-1) experimental; urgency=medium
+
+  * New upstream version 2.0.1 (Closes: #954768, #973641)
+  * d/watch: fix search path and only match stable versions (Closes: #974611)
+  * d/u/signing-key.asc: replace with new key for 2021-2022.
+  * d/control:
+    - Update Standards-Version to 4.6.0 (no changes needed)
+    - Switch to dh compat level 13
+    - Set Rules-Requires-Root: no
+    - Drop ORed dependency on obsolete libmysqlclient-dev
+    - Add python3-kea-connector dependency to kea-ctrl-agent
+    - Build-Depend on procps (test dependency)
+    - Drop Section: libs for kea-common (fallback to Section: net)
+    - Minor cosmetic changes to the descriptions
+  * d/rules:
+    - Don't pass --as-needed to ld (it's now the default)
+    - Drop explicit `dh_missing --fail-missing` (default in dh 13)
+    - Drop useless override_dh_auto_make target
+    - Drop override_dh_clean (not needed)
+    - Use execute_after_* targets where appropriate
+    - Do not ignore the test results
+    - Drop unnecessary $@ in override_dh_auto_configure
+    - Disable out-of-source building (dh -B)
+    - Set localstatedir to /var (Closes: #959149)
+    - Delete __pycache__ recursively
+    - Don't delete keactrl.8
+    - Drop `dh_installdocs -A`: it prevents using a main doc package
+    - Build perfdhcp (configure flag: --enable-perfdhcp)
+  * d/patches:
+    - 0001-support_kfreebsd: refresh patch
+    - 0002-kea_admin_fix: refresh patch
+    - 0003-Use-runstatedir-for-pid-file-location.patch: drop, fixed upstream
+    - d/p/0004-Put-KEA_LOCKFILE_DIR-to-runstatedir.patch: drop patch.
+      Replaced by setting the KEA_LOCKFILE_DIR environment variable.
+    - 0007-keyctrl-colored-ddns-status.patch: add patch
+    - 0009-disable-database-tests.patch: add patch.
+      Skip the database tests (problematic to run in automation).
+    - 0010-build-libco-when-gtest-is-not-enabled.patch: add patch.
+      Fix test suite fails if Kea is built without gtest.
+    - Always use the .patch extension for uniformity
+  * d/docs: drop file, replaced by kea-doc.docs
+  * d/kea-doc.install: drop file, replaced by d/kea-doc.docs
+  * d/kea-admin.install: install perfdhcp
+  * d/*.install: move manpages to d/*.manpages
+  * d/kea-common.manpages: install keactrl.8
+  * d/kea-doc.docs:
+    - Add CONTRIBUTING.md
+    - Install the API reference
+  * d/not-installed: refresh list of not-installed files
+  * d/s/lintian-overrides: override very-long-line-length-in-source-file
+  * d/kea-common.l-o: override script-not-executable etc/kea/keactrl.conf.
+    Has a shebang but it's meant to be sourced, not executed.
+  * d/u/metadata: add upstream metadata file
+  * d/copyright:
+    - Add Canonical Ltd. for debian/*
+    - Drop references to nonexisting files
+  * d/control: add Paride Legovini to Uploaders
+
+ -- Paride Legovini <paride@debian.org>  Thu, 27 Jan 2022 12:27:23 +0100
+
+isc-kea (1.7.5-1) unstable; urgency=medium
+
+  * Bump dh compat to 12, bump debian standard to 4.5.0
+    (dh_compat v11 is broken and should not be used)
+  * New upstream version 1.7.5
+  * Security issues fixed since 1.5.0-2:
+   + CVE-2019-6472: A packet containing a malformed DUID can cause the
+     kea-dhcp6 server to terminate
+   + CVE-2019-6473: An invalid hostname option can cause the kea-dhcp4
+     server to terminate
+   + CVE-2019-6474: An oversight when validating incoming client requests
+     can lead to a situation where the Kea server will exit when trying to
+     restart
+  * Add python3-sphinx and python3-sphinx-rtd-theme to Build-Depends to
+    build the documentation
+  * Adjust installed files
+  * Add 'kea' metapackage that depends on all server components of Kea
+  * Fix more ISC KEA -> Kea naming
+  * Cleanup the lintian warnings
+
+ -- Ondřej Surý <ondrej@debian.org>  Mon, 23 Mar 2020 11:11:05 +0100
+
+isc-kea (1.5.0-2) unstable; urgency=medium
+
+  [ Jason Guy  ]
+  * Stop deleting _kea user and group on postrm for security
+  * Drop debhelper compat to v11; v12 adds dependency on init-system-helpers
+    (>=1.52), and stretch uses 1.48.
+
+  [ Badreddin Aboubakr ]
+  * Fix systemd service file & create group kea
+  * Fix maintaner scripts to handle the _kea group (Closes: #924105)
+
+  [ Michal Nowikowski ]
+  * Fixed names of referenced services in WantedBy fields
+
+ -- Ondřej Surý <ondrej@sury.org>  Wed, 12 Jun 2019 16:11:11 +0200
+
+isc-kea (1.5.0-1) unstable; urgency=medium
+
+  [ Ondřej Surý ]
+  * New upstream version 1.5.0 (Closes: #916288)
+  * Update d/watch to use better mangling and https:// URL
+  * Update ISC signing key
+  * Bump debhelper compat level to v12
+  * Fix some default paths to use runstatedir
+  * Create a non-privileged user _kea and run the Kea services under that user
+    (Closes: #910671)
+  * Add the netconf stuff to d/not-installed
+  * Greatly simplify d/copyright (Closes: #905214)
+  * Fix dpkg-statoverride usage in maintscripts
+  * Add adduser to kea-common Depends
+  * Add Pre-Depends: ${misc:Pre-Depends} for systemd Pre-Depends
+  * DHCPv4 daemon also needs CAP_NET_RAW
+  * It's Kea, not ISC KEA; fix the .service files
+
+  [ Yuval Freund ]
+  * Fix python dep issue. (Closes: #905977, #908491)
+
+  [ Badreddin Aboubakr ]
+  * Fix systemd Unit Files
+    + Change lock directory (systemd nesting issue)
+    + Quote RuntimeDirectory
+    + Remove "LogsDirectory" and "LogsDirectoryMode" (they are not
+      supported in systemd 232)
+
+  [ Jason Guy ]
+  * Added a new patch to fix the kea-admin script.
+  * Fixed the postrm script (Closes: #905421)
+
+ -- Ondřej Surý <ondrej@debian.org>  Mon, 25 Feb 2019 12:12:36 +0000
+
+isc-kea (1.4.0.P1-5) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Added a missing python3 dependency (Closes: #905977)
+  * Fixed kea-ctrl-agent dependency (Closes: #908491)
+  * Fixed kea-common postrm script (Closes: #905421)
+  * Fixed state directories (Closes: #910671)
+  * Fixed copyright (Closes: #905214)
+  * Cleaned up quilt patches.
+
+ -- Jason Guy <jason.e.guy@gmail.com>  Sun, 16 Dec 2018 19:31:18 -0500
+
+isc-kea (1.4.0.P1-3) unstable; urgency=medium
+
+  [ Ondřej Surý ]
+  * Install keactrl binary and manpage to kea-common package
+  * Make package backportable to Ubuntu Trusty that doesn't have
+    debian/not-installed support yet
+  * Tighten the permissions on the /run/lock/kea, /var/log/kea and
+    /var/lib/kea directory
+  * Merge little bits from Jason in d/control and d/rules
+  * Cleanup install files
+
+  [ Jason Guy ]
+  * Added missing files.
+  * Minor fixes to the lockfile paths.
+
+  [ Adam Majer ]
+  * Update ISC signing key for 2017-2018
+  * Add python3-kea-connector and kea-ctrl-agent files
+
+ -- Ondřej Surý <ondrej@debian.org>  Mon, 16 Jul 2018 15:53:56 +0000
+
+isc-kea (1.4.0.P1-2) unstable; urgency=medium
+
+  * Add alternative dependency for default-libmysqlclient-dev to make
+    backporting easier
+  * Re-enable mysql and pgsql backends
+
+ -- Ondřej Surý <ondrej@debian.org>  Sat, 14 Jul 2018 12:14:40 +0000
+
+isc-kea (1.4.0.P1-1) unstable; urgency=medium
+
+  * New upstream version 1.4.0.P1
+   + [CVE-2018-5739]: failure to release memory may exhaust system
+     resources (Closes: #903729)
+
+ -- Ondřej Surý <ondrej@debian.org>  Sat, 14 Jul 2018 08:51:37 +0000
+
+isc-kea (1.4.0-2) experimental; urgency=medium
+
+  * New upstream version 1.4.0 (Closes: #874501, #874501)
+  * Update Maintainer, Uploaders and Vcs-* Links
+  * Use --fail-missing to catch files not installed which should be
+  * Update bug numbers in d/changelog
+  * Add kea-admin binary into kea-admin package (Closes: #851712)
+  * Install hooks in kea-common package and kea-ctrl-agent into kea-utils
+    package
+  * Move kea-ctrl-agent to kea-admin package
+
+ -- Ondřej Surý <ondrej@debian.org>  Fri, 13 Jul 2018 20:00:33 +0000
+
+isc-kea (1.4.0-1) experimental; urgency=medium
+
+  * New upstream version 1.4.0 (Closes: #874501, #874501)
+  * Rebase patches on top of Kea 1.4
+  * Use upstream conffiles
+  * Run d/ through wrap-and-sort -a + add dh-autoconf
+  * Enable autoreconf
+  * Don't install *.spec files
+
+ -- Ondřej Surý <ondrej@debian.org>  Fri, 13 Jul 2018 18:42:25 +0000
+
+isc-kea (1.1.0-1) unstable; urgency=medium
+
+  * New upstream version 1.1.0 (closes: #844536)
+    + support PostgreSQL and MySQL for host reservation for both
+      DHCPv4 and DHCPv6
+    + allows MySQL and PostgreSQL host reservations databases
+      to operate in read-only mode
+    + extends host reservations capabilities based on specific
+      DHCP options.
+    + expanded client classification system
+    + DHCPv4-over-DHCPv6 - RFC7341
+  * builds with default mysql library (closes: #845856)
+  * debian/patches:
+    - fix_gcc6 - removed, upstreamed
+    - openssl1.1 - add OpenSSL 1.1 support (closes: #828356)
+
+ -- Adam Majer <adamm@zombino.com>  Sun, 27 Nov 2016 23:07:17 +0100
+
+isc-kea (1.0.0-4) unstable; urgency=medium
+
+  * debian/rules:
+    + Disable warnings being treated as errors during compilation.
+      This fixes compilation with GCC 6.0 and Kea's use of
+      auto_ptr which trigger depreciation warning (closes: #831123)
+  * debian/patches/fix_gcc6:
+    + fix compilation with gcc6 C++14
+
+ -- Adam Majer <adamm@zombino.com>  Mon, 25 Jul 2016 22:23:36 +0200
+
+isc-kea (1.0.0-3) unstable; urgency=medium
+
+  * debian/patches/support_kfreebsd:
+    + Add support for kFreeBSD - detect it as FreeBSD
+  * debian/watch:
+    + Only detect X.Y.Z* version formats
+    + Sort beta and other candidates before final release
+    + Verify upstream GPG signature
+  * debian/control:
+    + Remove dependency on Botan. Use OpenSSL instead.
+  * debian/rules:
+    + Disable dependency tracking for faster build
+    + Fix typo in configure script
+  * Updated .service files to start KEA services only after
+    network is up and time has been synced.
+  * Update Standard to 3.9.7. No changes.
+
+ -- Adam Majer <adamm@zombino.com>  Thu, 03 Mar 2016 20:49:02 -0600
+
+isc-kea (1.0.0-2) unstable; urgency=medium
+
+  * debian/copyright:
+    + Explicitly list more embedded boost headers
+  * debian/control:
+    + Do not require specific PostgreSQL version (closes: #814323)
+
+ -- Adam Majer <adamm@zombino.com>  Fri, 26 Feb 2016 13:37:51 -0600
+
+isc-kea (1.0.0-1) unstable; urgency=low
+
+  * Initial release (Closes: #759703)
+
+ -- Adam Majer <adamm@zombino.com>  Tue, 19 Jan 2016 13:15:40 -0600
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..c2d7d66
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,178 @@
+Source: isc-kea
+Section: net
+Priority: optional
+Maintainer: Kea <isc-kea@packages.debian.org>
+Uploaders:
+ Adam Majer <adamm@zombino.com>,
+ Ondřej Surý <ondrej@debian.org>,
+ Jason Guy <jason.e.guy@gmail.com>,
+ Paride Legovini <paride@debian.org>,
+ Athos Ribeiro <athos.ribeiro@canonical.com>,
+Build-Depends:
+ bison,
+ debhelper-compat (= 13),
+ default-libmysqlclient-dev,
+ dh-apparmor,
+ dh-python,
+ docbook,
+ docbook-xsl,
+ elinks,
+ flex,
+ libboost-dev,
+ libboost-system-dev,
+ liblog4cplus-dev,
+ libpq-dev,
+ libssl-dev,
+ po-debconf,
+ postgresql-server-dev-all,
+ procps,
+ python3-dev,
+ python3-sphinx,
+ python3-sphinx-rtd-theme,
+ xsltproc,
+Standards-Version: 4.6.2
+Homepage: http://kea.isc.org/
+Vcs-Git: https://salsa.debian.org/debian/isc-kea.git
+Vcs-Browser: https://salsa.debian.org/debian/isc-kea
+Rules-Requires-Root: no
+
+Package: kea
+Architecture: all
+Depends:
+ kea-admin,
+ kea-ctrl-agent,
+ kea-dhcp-ddns-server,
+ kea-dhcp4-server,
+ kea-dhcp6-server,
+ ${misc:Depends},
+Description: DHCP server [meta]
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium
+ providing a very high-performance with PostgreSQL, MySQL and memfile backends.
+ .
+ This is a metapackage that depends on all server components of Kea.
+
+Package: kea-admin
+Architecture: any
+Section: admin
+Depends:
+ kea-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends},
+Description: Administration utilities for Kea DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium.
+ .
+ This package provides backend database initialization and migration
+ scripts and a DHCP benchmark tool.
+
+Package: kea-common
+Architecture: any
+Depends:
+ adduser,
+ ${misc:Depends},
+ ${shlibs:Depends},
+Description: Common libraries for the Kea DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium.
+ .
+ This package provides common libraries used by Kea servers and utilities.
+
+Package: kea-ctrl-agent
+Architecture: any
+Pre-Depends:
+ ${misc:Pre-Depends},
+Depends:
+ kea-common (= ${binary:Version}),
+ python3-kea-connector,
+ debconf (>= 0.5),
+ ${misc:Depends},
+ ${python3:Depends},
+ ${shlibs:Depends},
+Suggests:
+ kea-doc,
+Description: REST API service for Kea DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium.
+ .
+ This package provides the REST API service agent for Kea DHCP.
+
+Package: kea-dev
+Architecture: any
+Section: devel
+Depends:
+ kea-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends},
+Description: Development headers for Kea DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium.
+ .
+ This package provides headers and static libraries of the common Kea
+ libraries, including libdhcp++.
+
+Package: kea-dhcp-ddns-server
+Architecture: any
+Pre-Depends:
+ ${misc:Pre-Depends},
+Depends:
+ kea-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends},
+Suggests:
+ kea-doc,
+Description: DHCP Dynamic DNS service
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium.
+ .
+ This package provides Dynamic DNS service to update DNS mapping based on
+ DHCP lease events.
+
+Package: kea-dhcp4-server
+Architecture: any
+Pre-Depends:
+ ${misc:Pre-Depends},
+Depends:
+ kea-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends},
+Suggests:
+ kea-doc,
+Description: IPv4 DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium
+ providing a very high-performance with PostgreSQL, MySQL and memfile backends.
+ .
+ This package provides the IPv4 DHCP server.
+
+Package: kea-dhcp6-server
+Architecture: any
+Pre-Depends:
+ ${misc:Pre-Depends},
+Depends:
+ kea-common (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends},
+Suggests:
+ kea-doc,
+Description: IPv6 DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium
+ providing a very high-performance with PostgreSQL, MySQL and memfile backends.
+ .
+ This package provides the IPv6 DHCP server.
+
+Package: kea-doc
+Architecture: all
+Section: doc
+Depends:
+ ${misc:Depends},
+Recommends:
+ libjs-mathjax,
+Description: Documentation for Kea DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium.
+ .
+ This package provides documentation for the DHCP servers.
+
+Package: python3-kea-connector
+Architecture: all
+Section: python
+Depends:
+ ${misc:Depends},
+ ${python3:Depends},
+Description: Python3 management connector for Kea DHCP server
+ Kea is an IPv4 and IPv6 DHCP server developed by Internet Systems Consortium.
+ .
+ This package provides Python3 connector.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..d90da60
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,408 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+
+Files: *
+Copyright: 2010-2018, Internet Systems Consortium, Inc. ("ISC")
+License: MPL-2.0
+
+Files: debian/*
+Copyright: 2016-2018, Adam Majer <adamm@zombino.com>
+	   2017-2018, Jason Guy (jason.e.guy@gmail.com)
+	   2018-2019, Internet Systems Consortium, Inc.
+	   2022-2024, Canonical Ltd.
+License: MPL-2.0
+
+Files: src/bin/agent/agent_parser.cc
+  src/bin/agent/agent_parser.h
+  src/bin/agent/location.hh
+  src/bin/d2/d2_parser.cc
+  src/bin/d2/d2_parser.h
+  src/bin/d2/location.hh
+  src/bin/dhcp4/dhcp4_parser.cc
+  src/bin/dhcp4/dhcp4_parser.h
+  src/bin/dhcp4/location.hh
+  src/bin/dhcp6/dhcp6_parser.cc
+  src/bin/dhcp6/dhcp6_parser.h
+  src/bin/dhcp6/location.hh
+  src/lib/eval/location.hh
+  src/lib/eval/parser.cc
+  src/lib/eval/parser.h
+Copyright: 2002-2015, Free Software Foundation, Inc.
+License: GPL-3+-with-bison-exception
+
+Files: src/lib/util/encode/*
+Copyright: 2002, Robert Ramey - http:www.rrsd.com .
+License: BSL-1.0
+
+License: GPL-3+-with-bison-exception
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 3 dated June, 2007, or (at
+ your option) any later version.
+ .
+ As a special exception, you may create a larger work that contains
+ part or all of the Bison parser skeleton and distribute that work
+ under terms of your choice, so long as that work isn't itself a
+ parser generator using the skeleton or a modified version thereof
+ as a parser skeleton.  Alternatively, if you modify or redistribute
+ the parser skeleton itself, you may (at your option) remove this
+ special exception, which will cause the skeleton and the resulting
+ Bison output files to be licensed under the GNU General Public
+ License without this special exception.
+ .
+ On Debian systems, the complete text of version 3 of the GNU General
+ Public License can be found in '/usr/share/common-licenses/GPL-3'.
+
+License: MPL-2.0
+ .
+   Mozilla Public License Version 2.0
+   ==================================
+   .
+   1. Definitions
+   --------------
+   1.1. "Contributor"
+       means each individual or legal entity that creates, contributes to
+       the creation of, or owns Covered Software.
+   1.2. "Contributor Version"
+       means the combination of the Contributions of others (if any) used
+       by a Contributor and that particular Contributor's Contribution.
+   1.3. "Contribution"
+       means Covered Software of a particular Contributor.
+   1.4. "Covered Software"
+       means Source Code Form to which the initial Contributor has attached
+       the notice in Exhibit A, the Executable Form of such Source Code
+       Form, and Modifications of such Source Code Form, in each case
+       including portions thereof.
+   1.5. "Incompatible With Secondary Licenses"
+       means
+       (a) that the initial Contributor has attached the notice described
+           in Exhibit B to the Covered Software; or
+       (b) that the Covered Software was made available under the terms of
+          version 1.1 or earlier of the License, but not also under the
+          terms of a Secondary License.
+   1.6. "Executable Form"
+        means any form of the work other than Source Code Form.
+   1.7. "Larger Work"
+        means a work that combines Covered Software with other material, in
+        a separate file or files, that is not Covered Software.
+   1.8. "License"
+       means this document.
+   1.9. "Licensable"
+        means having the right to grant, to the maximum extent possible,
+        whether at the time of the initial grant or subsequently, any and
+        all of the rights conveyed by this License.
+   1.10. "Modifications"
+        means any of the following:
+       (a) any file in Source Code Form that results from an addition to,
+           deletion from, or modification of the contents of Covered
+           Software; or
+       (b) any new file in Source Code Form that contains any Covered
+           Software.
+   1.11. "Patent Claims" of a Contributor
+       means any patent claim(s), including without limitation, method,
+       process, and apparatus claims, in any patent Licensable by such
+       Contributor that would be infringed, but for the grant of the
+       License, by the making, using, selling, offering for sale, having
+       made, import, or transfer of either its Contributions or its
+       Contributor Version.
+   1.12. "Secondary License"
+       means either the GNU General Public License, Version 2.0, the GNU
+       Lesser General Public License, Version 2.1, the GNU Affero General
+       Public License, Version 3.0, or any later versions of those
+       licenses.
+   1.13. "Source Code Form"
+       means the form of the work preferred for making modifications.
+   1.14. "You" (or "Your")
+       means an individual or a legal entity exercising rights under this
+       License. For legal entities, "You" includes any entity that
+       controls, is controlled by, or is under common control with You. For
+       purposes of this definition, "control" means (a) the power, direct
+       or indirect, to cause the direction or management of such entity,
+       whether by contract or otherwise, or (b) ownership of more than
+       fifty percent (50%) of the outstanding shares or beneficial
+       ownership of such entity.
+   .
+   2. License Grants and Conditions
+   --------------------------------
+   2.1. Grants
+   Each Contributor hereby grants You a world-wide, royalty-free,
+   non-exclusive license:
+   (a) under intellectual property rights (other than patent or trademark)
+       Licensable by such Contributor to use, reproduce, make available,
+       modify, display, perform, distribute, and otherwise exploit its
+       Contributions, either on an unmodified basis, with Modifications, or
+       as part of a Larger Work; and
+   (b) under Patent Claims of such Contributor to make, use, sell, offer
+       for sale, have made, import, and otherwise transfer either its
+       Contributions or its Contributor Version.
+   .
+   2.2. Effective Date
+   The licenses granted in Section 2.1 with respect to any Contribution
+   become effective for each Contribution on the date the Contributor first
+   distributes such Contribution.
+   .
+   2.3. Limitations on Grant Scope
+   The licenses granted in this Section 2 are the only rights granted under
+   this License. No additional rights or licenses will be implied from the
+   distribution or licensing of Covered Software under this License.
+   Notwithstanding Section 2.1(b) above, no patent license is granted by a
+   Contributor:
+   (a) for any code that a Contributor has removed from Covered Software;
+       or
+   (b) for infringements caused by: (i) Your and any other third party's
+       modifications of Covered Software, or (ii) the combination of its
+       Contributions with other software (except as part of its Contributor
+       Version); or
+   (c) under Patent Claims infringed by Covered Software in the absence of
+       its Contributions.
+   This License does not grant any rights in the trademarks, service marks,
+   or logos of any Contributor (except as may be necessary to comply with
+   the notice requirements in Section 3.4).
+   .
+   2.4. Subsequent Licenses
+   No Contributor makes additional grants as a result of Your choice to
+   distribute the Covered Software under a subsequent version of this
+   License (see Section 10.2) or under the terms of a Secondary License (if
+   permitted under the terms of Section 3.3).
+   .
+   2.5. Representation
+   Each Contributor represents that the Contributor believes its
+   Contributions are its original creation(s) or it has sufficient rights
+   to grant the rights to its Contributions conveyed by this License.
+   .
+   2.6. Fair Use
+   This License is not intended to limit any rights You have under
+   applicable copyright doctrines of fair use, fair dealing, or other
+   equivalents.
+   .
+   2.7. Conditions
+   Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+   in Section 2.1.
+   .
+   3. Responsibilities
+   -------------------
+   3.1. Distribution of Source Form
+   All distribution of Covered Software in Source Code Form, including any
+   Modifications that You create or to which You contribute, must be under
+   the terms of this License. You must inform recipients that the Source
+   Code Form of the Covered Software is governed by the terms of this
+   License, and how they can obtain a copy of this License. You may not
+   attempt to alter or restrict the recipients' rights in the Source Code
+   Form.
+   .
+   3.2. Distribution of Executable Form
+   If You distribute Covered Software in Executable Form then:
+   (a) such Covered Software must also be made available in Source Code
+       Form, as described in Section 3.1, and You must inform recipients of
+       the Executable Form how they can obtain a copy of such Source Code
+       Form by reasonable means in a timely manner, at a charge no more
+       than the cost of distribution to the recipient; and
+   (b) You may distribute such Executable Form under the terms of this
+       License, or sublicense it under different terms, provided that the
+       license for the Executable Form does not attempt to limit or alter
+       the recipients' rights in the Source Code Form under this License.
+   3.3. Distribution of a Larger Work
+   You may create and distribute a Larger Work under terms of Your choice,
+   provided that You also comply with the requirements of this License for
+   the Covered Software. If the Larger Work is a combination of Covered
+   Software with a work governed by one or more Secondary Licenses, and the
+   Covered Software is not Incompatible With Secondary Licenses, this
+   License permits You to additionally distribute such Covered Software
+   under the terms of such Secondary License(s), so that the recipient of
+   the Larger Work may, at their option, further distribute the Covered
+   Software under the terms of either this License or such Secondary
+   License(s).
+   .
+   3.4. Notices
+   You may not remove or alter the substance of any license notices
+   (including copyright notices, patent notices, disclaimers of warranty,
+   or limitations of liability) contained within the Source Code Form of
+   the Covered Software, except that You may alter any license notices to
+   the extent required to remedy known factual inaccuracies.
+   .
+   3.5. Application of Additional Terms
+   You may choose to offer, and to charge a fee for, warranty, support,
+   indemnity or liability obligations to one or more recipients of Covered
+   Software. However, You may do so only on Your own behalf, and not on
+   behalf of any Contributor. You must make it absolutely clear that any
+   such warranty, support, indemnity, or liability obligation is offered by
+   You alone, and You hereby agree to indemnify every Contributor for any
+   liability incurred by such Contributor as a result of warranty, support,
+   indemnity or liability terms You offer. You may include additional
+   disclaimers of warranty and limitations of liability specific to any
+   jurisdiction.
+   .
+   4. Inability to Comply Due to Statute or Regulation
+   ---------------------------------------------------
+   .
+   If it is impossible for You to comply with any of the terms of this
+   License with respect to some or all of the Covered Software due to
+   statute, judicial order, or regulation then You must: (a) comply with
+   the terms of this License to the maximum extent possible; and (b)
+   describe the limitations and the code they affect. Such description must
+   be placed in a text file included with all distributions of the Covered
+   Software under this License. Except to the extent prohibited by statute
+   or regulation, such description must be sufficiently detailed for a
+   recipient of ordinary skill to be able to understand it.
+   .
+   5. Termination
+   --------------
+   .
+   5.1. The rights granted under this License will terminate automatically
+   if You fail to comply with any of its terms. However, if You become
+   compliant, then the rights granted under this License from a particular
+   Contributor are reinstated (a) provisionally, unless and until such
+   Contributor explicitly and finally terminates Your grants, and (b) on an
+   ongoing basis, if such Contributor fails to notify You of the
+   non-compliance by some reasonable means prior to 60 days after You have
+   come back into compliance. Moreover, Your grants from a particular
+   Contributor are reinstated on an ongoing basis if such Contributor
+   notifies You of the non-compliance by some reasonable means, this is the
+   first time You have received notice of non-compliance with this License
+   from such Contributor, and You become compliant prior to 30 days after
+   Your receipt of the notice.
+   .
+   5.2. If You initiate litigation against any entity by asserting a patent
+   infringement claim (excluding declaratory judgment actions,
+   counter-claims, and cross-claims) alleging that a Contributor Version
+   directly or indirectly infringes any patent, then the rights granted to
+   You by any and all Contributors for the Covered Software under Section
+   2.1 of this License shall terminate.
+   .
+   5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+   end user license agreements (excluding distributors and resellers) which
+   have been validly granted by You or Your distributors under this License
+   prior to termination shall survive termination.
+   .
+   ************************************************************************
+   *                                                                      *
+   *  6. Disclaimer of Warranty                                           *
+   *  -------------------------                                           *
+   *                                                                      *
+   *  Covered Software is provided under this License on an "as is"       *
+   *  basis, without warranty of any kind, either expressed, implied, or  *
+   *  statutory, including, without limitation, warranties that the       *
+   *  Covered Software is free of defects, merchantable, fit for a        *
+   *  particular purpose or non-infringing. The entire risk as to the     *
+   *  quality and performance of the Covered Software is with You.        *
+   *  Should any Covered Software prove defective in any respect, You     *
+   *  (not any Contributor) assume the cost of any necessary servicing,   *
+   *  repair, or correction. This disclaimer of warranty constitutes an   *
+   *  essential part of this License. No use of any Covered Software is   *
+   *  authorized under this License except under this disclaimer.         *
+   *                                                                      *
+   ************************************************************************
+   .
+   ************************************************************************
+   *                                                                      *
+   *  7. Limitation of Liability                                          *
+   *  --------------------------                                          *
+   *                                                                      *
+   *  Under no circumstances and under no legal theory, whether tort      *
+   *  (including negligence), contract, or otherwise, shall any           *
+   *  Contributor, or anyone who distributes Covered Software as          *
+   *  permitted above, be liable to You for any direct, indirect,         *
+   *  special, incidental, or consequential damages of any character      *
+   *  including, without limitation, damages for lost profits, loss of    *
+   *  goodwill, work stoppage, computer failure or malfunction, or any    *
+   *  and all other commercial damages or losses, even if such party      *
+   *  shall have been informed of the possibility of such damages. This   *
+   *  limitation of liability shall not apply to liability for death or   *
+   *  personal injury resulting from such party's negligence to the       *
+   *  extent applicable law prohibits such limitation. Some               *
+   *  jurisdictions do not allow the exclusion or limitation of           *
+   *  incidental or consequential damages, so this exclusion and          *
+   *  limitation may not apply to You.                                    *
+   *                                                                      *
+   ************************************************************************
+   .
+   8. Litigation
+   -------------
+   Any litigation relating to this License may be brought only in the
+   courts of a jurisdiction where the defendant maintains its principal
+   place of business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions.
+   Nothing in this Section shall prevent a party's ability to bring
+   cross-claims or counter-claims.
+   .
+   9. Miscellaneous
+   ----------------
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides
+   that the language of a contract shall be construed against the drafter
+   shall not be used to construe this License against a Contributor.
+   .
+   10. Versions of the License
+   ---------------------------
+   .
+   10.1. New Versions
+   Mozilla Foundation is the license steward. Except as provided in Section
+   10.3, no one other than the license steward has the right to modify or
+   publish new versions of this License. Each version will be given a
+   distinguishing version number.
+   .
+   10.2. Effect of New Versions
+   You may distribute the Covered Software under the terms of the version
+   of the License under which You originally received the Covered Software,
+   or under the terms of any subsequent version published by the license
+   steward.
+   .
+   10.3. Modified Versions
+   If you create software not governed by this License, and you want to
+   create a new license for such software, you may create and use a
+   modified version of this License if you rename the license and remove
+   any references to the name of the license steward (except to note that
+   such modified license differs from this License).
+   .
+   10.4. Distributing Source Code Form that is Incompatible With Secondary
+   Licenses
+   .
+   If You choose to distribute Source Code Form that is Incompatible With
+   Secondary Licenses under the terms of this version of the License, the
+   notice described in Exhibit B of this License must be attached.
+   .
+   Exhibit A - Source Code Form License Notice
+   -------------------------------------------
+   .
+    This Source Code Form is subject to the terms of the Mozilla Public
+    License, v. 2.0. If a copy of the MPL was not distributed with this
+    file, You can obtain one at http://mozilla.org/MPL/2.0/.
+   .
+   If it is not possible or desirable to put the notice in a particular
+   file, then You may include the notice in a location (such as a LICENSE
+   file in a relevant directory) where a recipient would be likely to look
+   for such a notice.
+   .
+   You may add additional accurate notices of copyright ownership.
+   .
+   Exhibit B - "Incompatible With Secondary Licenses" Notice
+   ---------------------------------------------------------
+   .
+   This Source Code Form is "Incompatible With Secondary Licenses", as
+   defined by the Mozilla Public License, v. 2.0.
+
+License: BSL-1.0
+ Boost Software License - Version 1.0 - August 17th, 2003
+ .
+ Permission is hereby granted, free of charge, to any person or organization
+ obtaining a copy of the software and accompanying documentation covered by
+ this license (the "Software") to use, reproduce, display, distribute,
+ execute, and transmit the Software, and to prepare derivative works of the
+ Software, and to permit third-parties to whom the Software is furnished to
+ do so, all subject to the following:
+ .
+ The copyright notices in the Software and this entire statement, including
+ the above license grant, this restriction and the following disclaimer,
+ must be included in all copies of the Software, in whole or in part, and
+ all derivative works of the Software, unless such copies or derivative
+ works are solely in the form of machine-executable object code generated by
+ a source language processor.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
+ SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
+ FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ DEALINGS IN THE SOFTWARE.
diff --git a/debian/copyright-scan-patterns.yml b/debian/copyright-scan-patterns.yml
new file mode 100644
index 0000000..3592d24
--- /dev/null
+++ b/debian/copyright-scan-patterns.yml
@@ -0,0 +1,33 @@
+---
+check:
+  suffixes:
+  - asm
+  - lua
+  - nqp
+  - s
+  - template
+ignore:
+  pattern:
+  - /debian/
+  - Makefile
+  - AUTHORS
+  - README
+  - ChangeLog
+  - INSTALL
+  - MANIFEST
+  - /config(.guess|ure|ure.ac|.h.in|.sub)
+  suffixes:
+  - generic
+  - rst
+  - jpg
+  - yml
+  - png
+  - dia
+  - o
+  - htm
+  - html
+  - txt
+  - install
+  - M
+  - in
+
diff --git a/debian/fill.copyright.blanks.yml b/debian/fill.copyright.blanks.yml
new file mode 100644
index 0000000..b1c7e8e
--- /dev/null
+++ b/debian/fill.copyright.blanks.yml
@@ -0,0 +1,18 @@
+---
+src/hooks/* :
+  copyright: 2010-2018, Internet Systems Consortium, Inc. ("ISC")
+  license: MPL-2.0
+doc/* :
+  copyright: 2010-2018, Internet Systems Consortium, Inc. ("ISC")
+  license: MPL-2.0
+src/lib/dhcpsrv/cache_host_data_source.h :
+  copyright: 2018, Internet Systems Consortium, Inc. ("ISC")
+  license: MPL-2.0
+ext/* :
+  copyright: 2010-2018, Internet Systems Consortium, Inc. ("ISC")
+  license: MPL-2.0
+m4macros/* :
+  copyright: 1994-2013, Free Software Foundation, Inc.
+  license: MPL-2.0
+
+
diff --git a/debian/fix.scanned.copyright b/debian/fix.scanned.copyright
new file mode 100644
index 0000000..2f1c741
--- /dev/null
+++ b/debian/fix.scanned.copyright
@@ -0,0 +1,368 @@
+! License:"MPL-2.0"
+  text="
+ Mozilla Public License Version 2.0
+ ==================================
+ .
+ 1. Definitions
+ --------------
+ 1.1. \"Contributor\"
+     means each individual or legal entity that creates, contributes to
+     the creation of, or owns Covered Software.
+ 1.2. \"Contributor Version\"
+     means the combination of the Contributions of others (if any) used
+     by a Contributor and that particular Contributor's Contribution.
+ 1.3. \"Contribution\"
+     means Covered Software of a particular Contributor.
+ 1.4. \"Covered Software\"
+     means Source Code Form to which the initial Contributor has attached
+     the notice in Exhibit A, the Executable Form of such Source Code
+     Form, and Modifications of such Source Code Form, in each case
+     including portions thereof.
+ 1.5. \"Incompatible With Secondary Licenses\"
+     means
+     (a) that the initial Contributor has attached the notice described
+         in Exhibit B to the Covered Software; or
+     (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+ 1.6. \"Executable Form\"
+      means any form of the work other than Source Code Form.
+ 1.7. \"Larger Work\"
+      means a work that combines Covered Software with other material, in
+      a separate file or files, that is not Covered Software.
+ 1.8. \"License\"
+     means this document.
+ 1.9. \"Licensable\"
+      means having the right to grant, to the maximum extent possible,
+      whether at the time of the initial grant or subsequently, any and
+      all of the rights conveyed by this License.
+ 1.10. \"Modifications\"
+      means any of the following:
+     (a) any file in Source Code Form that results from an addition to,
+         deletion from, or modification of the contents of Covered
+         Software; or
+     (b) any new file in Source Code Form that contains any Covered
+         Software.
+ 1.11. \"Patent Claims\" of a Contributor
+     means any patent claim(s), including without limitation, method,
+     process, and apparatus claims, in any patent Licensable by such
+     Contributor that would be infringed, but for the grant of the
+     License, by the making, using, selling, offering for sale, having
+     made, import, or transfer of either its Contributions or its
+     Contributor Version.
+ 1.12. \"Secondary License\"
+     means either the GNU General Public License, Version 2.0, the GNU
+     Lesser General Public License, Version 2.1, the GNU Affero General
+     Public License, Version 3.0, or any later versions of those
+     licenses.
+ 1.13. \"Source Code Form\"
+     means the form of the work preferred for making modifications.
+ 1.14. \"You\" (or \"Your\")
+     means an individual or a legal entity exercising rights under this
+     License. For legal entities, \"You\" includes any entity that
+     controls, is controlled by, or is under common control with You. For
+     purposes of this definition, \"control\" means (a) the power, direct
+     or indirect, to cause the direction or management of such entity,
+     whether by contract or otherwise, or (b) ownership of more than
+     fifty percent (50%) of the outstanding shares or beneficial
+     ownership of such entity.
+ .
+ 2. License Grants and Conditions
+ --------------------------------
+ 2.1. Grants
+ Each Contributor hereby grants You a world-wide, royalty-free,
+ non-exclusive license:
+ (a) under intellectual property rights (other than patent or trademark)
+     Licensable by such Contributor to use, reproduce, make available,
+     modify, display, perform, distribute, and otherwise exploit its
+     Contributions, either on an unmodified basis, with Modifications, or
+     as part of a Larger Work; and
+ (b) under Patent Claims of such Contributor to make, use, sell, offer
+     for sale, have made, import, and otherwise transfer either its
+     Contributions or its Contributor Version.
+ .
+ 2.2. Effective Date
+ The licenses granted in Section 2.1 with respect to any Contribution
+ become effective for each Contribution on the date the Contributor first
+ distributes such Contribution.
+ .
+ 2.3. Limitations on Grant Scope
+ The licenses granted in this Section 2 are the only rights granted under
+ this License. No additional rights or licenses will be implied from the
+ distribution or licensing of Covered Software under this License.
+ Notwithstanding Section 2.1(b) above, no patent license is granted by a
+ Contributor:
+ (a) for any code that a Contributor has removed from Covered Software;
+     or
+ (b) for infringements caused by: (i) Your and any other third party's
+     modifications of Covered Software, or (ii) the combination of its
+     Contributions with other software (except as part of its Contributor
+     Version); or
+ (c) under Patent Claims infringed by Covered Software in the absence of
+     its Contributions.
+ This License does not grant any rights in the trademarks, service marks,
+ or logos of any Contributor (except as may be necessary to comply with
+ the notice requirements in Section 3.4).
+ .
+ 2.4. Subsequent Licenses
+ No Contributor makes additional grants as a result of Your choice to
+ distribute the Covered Software under a subsequent version of this
+ License (see Section 10.2) or under the terms of a Secondary License (if
+ permitted under the terms of Section 3.3).
+ .
+ 2.5. Representation
+ Each Contributor represents that the Contributor believes its
+ Contributions are its original creation(s) or it has sufficient rights
+ to grant the rights to its Contributions conveyed by this License.
+ .
+ 2.6. Fair Use
+ This License is not intended to limit any rights You have under
+ applicable copyright doctrines of fair use, fair dealing, or other
+ equivalents.
+ .
+ 2.7. Conditions
+ Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+ in Section 2.1.
+ .
+ 3. Responsibilities
+ -------------------
+ 3.1. Distribution of Source Form
+ All distribution of Covered Software in Source Code Form, including any
+ Modifications that You create or to which You contribute, must be under
+ the terms of this License. You must inform recipients that the Source
+ Code Form of the Covered Software is governed by the terms of this
+ License, and how they can obtain a copy of this License. You may not
+ attempt to alter or restrict the recipients' rights in the Source Code
+ Form.
+ .
+ 3.2. Distribution of Executable Form
+ If You distribute Covered Software in Executable Form then:
+ (a) such Covered Software must also be made available in Source Code
+     Form, as described in Section 3.1, and You must inform recipients of
+     the Executable Form how they can obtain a copy of such Source Code
+     Form by reasonable means in a timely manner, at a charge no more
+     than the cost of distribution to the recipient; and
+ (b) You may distribute such Executable Form under the terms of this
+     License, or sublicense it under different terms, provided that the
+     license for the Executable Form does not attempt to limit or alter
+     the recipients' rights in the Source Code Form under this License.
+ 3.3. Distribution of a Larger Work
+ You may create and distribute a Larger Work under terms of Your choice,
+ provided that You also comply with the requirements of this License for
+ the Covered Software. If the Larger Work is a combination of Covered
+ Software with a work governed by one or more Secondary Licenses, and the
+ Covered Software is not Incompatible With Secondary Licenses, this
+ License permits You to additionally distribute such Covered Software
+ under the terms of such Secondary License(s), so that the recipient of
+ the Larger Work may, at their option, further distribute the Covered
+ Software under the terms of either this License or such Secondary
+ License(s).
+ .
+ 3.4. Notices
+ You may not remove or alter the substance of any license notices
+ (including copyright notices, patent notices, disclaimers of warranty,
+ or limitations of liability) contained within the Source Code Form of
+ the Covered Software, except that You may alter any license notices to
+ the extent required to remedy known factual inaccuracies.
+ .
+ 3.5. Application of Additional Terms
+ You may choose to offer, and to charge a fee for, warranty, support,
+ indemnity or liability obligations to one or more recipients of Covered
+ Software. However, You may do so only on Your own behalf, and not on
+ behalf of any Contributor. You must make it absolutely clear that any
+ such warranty, support, indemnity, or liability obligation is offered by
+ You alone, and You hereby agree to indemnify every Contributor for any
+ liability incurred by such Contributor as a result of warranty, support,
+ indemnity or liability terms You offer. You may include additional
+ disclaimers of warranty and limitations of liability specific to any
+ jurisdiction.
+ .
+ 4. Inability to Comply Due to Statute or Regulation
+ ---------------------------------------------------
+ .
+ If it is impossible for You to comply with any of the terms of this
+ License with respect to some or all of the Covered Software due to
+ statute, judicial order, or regulation then You must: (a) comply with
+ the terms of this License to the maximum extent possible; and (b)
+ describe the limitations and the code they affect. Such description must
+ be placed in a text file included with all distributions of the Covered
+ Software under this License. Except to the extent prohibited by statute
+ or regulation, such description must be sufficiently detailed for a
+ recipient of ordinary skill to be able to understand it.
+ .
+ 5. Termination
+ --------------
+ .
+ 5.1. The rights granted under this License will terminate automatically
+ if You fail to comply with any of its terms. However, if You become
+ compliant, then the rights granted under this License from a particular
+ Contributor are reinstated (a) provisionally, unless and until such
+ Contributor explicitly and finally terminates Your grants, and (b) on an
+ ongoing basis, if such Contributor fails to notify You of the
+ non-compliance by some reasonable means prior to 60 days after You have
+ come back into compliance. Moreover, Your grants from a particular
+ Contributor are reinstated on an ongoing basis if such Contributor
+ notifies You of the non-compliance by some reasonable means, this is the
+ first time You have received notice of non-compliance with this License
+ from such Contributor, and You become compliant prior to 30 days after
+ Your receipt of the notice.
+ .
+ 5.2. If You initiate litigation against any entity by asserting a patent
+ infringement claim (excluding declaratory judgment actions,
+ counter-claims, and cross-claims) alleging that a Contributor Version
+ directly or indirectly infringes any patent, then the rights granted to
+ You by any and all Contributors for the Covered Software under Section
+ 2.1 of this License shall terminate.
+ .
+ 5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+ end user license agreements (excluding distributors and resellers) which
+ have been validly granted by You or Your distributors under this License
+ prior to termination shall survive termination.
+ .
+ ************************************************************************
+ *                                                                      *
+ *  6. Disclaimer of Warranty                                           *
+ *  -------------------------                                           *
+ *                                                                      *
+ *  Covered Software is provided under this License on an \"as is\"       *
+ *  basis, without warranty of any kind, either expressed, implied, or  *
+ *  statutory, including, without limitation, warranties that the       *
+ *  Covered Software is free of defects, merchantable, fit for a        *
+ *  particular purpose or non-infringing. The entire risk as to the     *
+ *  quality and performance of the Covered Software is with You.        *
+ *  Should any Covered Software prove defective in any respect, You     *
+ *  (not any Contributor) assume the cost of any necessary servicing,   *
+ *  repair, or correction. This disclaimer of warranty constitutes an   *
+ *  essential part of this License. No use of any Covered Software is   *
+ *  authorized under this License except under this disclaimer.         *
+ *                                                                      *
+ ************************************************************************
+ .
+ ************************************************************************
+ *                                                                      *
+ *  7. Limitation of Liability                                          *
+ *  --------------------------                                          *
+ *                                                                      *
+ *  Under no circumstances and under no legal theory, whether tort      *
+ *  (including negligence), contract, or otherwise, shall any           *
+ *  Contributor, or anyone who distributes Covered Software as          *
+ *  permitted above, be liable to You for any direct, indirect,         *
+ *  special, incidental, or consequential damages of any character      *
+ *  including, without limitation, damages for lost profits, loss of    *
+ *  goodwill, work stoppage, computer failure or malfunction, or any    *
+ *  and all other commercial damages or losses, even if such party      *
+ *  shall have been informed of the possibility of such damages. This   *
+ *  limitation of liability shall not apply to liability for death or   *
+ *  personal injury resulting from such party's negligence to the       *
+ *  extent applicable law prohibits such limitation. Some               *
+ *  jurisdictions do not allow the exclusion or limitation of           *
+ *  incidental or consequential damages, so this exclusion and          *
+ *  limitation may not apply to You.                                    *
+ *                                                                      *
+ ************************************************************************
+ .
+ 8. Litigation
+ -------------
+ Any litigation relating to this License may be brought only in the
+ courts of a jurisdiction where the defendant maintains its principal
+ place of business and such litigation shall be governed by laws of that
+ jurisdiction, without reference to its conflict-of-law provisions.
+ Nothing in this Section shall prevent a party's ability to bring
+ cross-claims or counter-claims.
+ .
+ 9. Miscellaneous
+ ----------------
+ This License represents the complete agreement concerning the subject
+ matter hereof. If any provision of this License is held to be
+ unenforceable, such provision shall be reformed only to the extent
+ necessary to make it enforceable. Any law or regulation which provides
+ that the language of a contract shall be construed against the drafter
+ shall not be used to construe this License against a Contributor.
+ .
+ 10. Versions of the License
+ ---------------------------
+ .
+ 10.1. New Versions
+ Mozilla Foundation is the license steward. Except as provided in Section
+ 10.3, no one other than the license steward has the right to modify or
+ publish new versions of this License. Each version will be given a
+ distinguishing version number.
+ .
+ 10.2. Effect of New Versions
+ You may distribute the Covered Software under the terms of the version
+ of the License under which You originally received the Covered Software,
+ or under the terms of any subsequent version published by the license
+ steward.
+ .
+ 10.3. Modified Versions
+ If you create software not governed by this License, and you want to
+ create a new license for such software, you may create and use a
+ modified version of this License if you rename the license and remove
+ any references to the name of the license steward (except to note that
+ such modified license differs from this License).
+ .
+ 10.4. Distributing Source Code Form that is Incompatible With Secondary
+ Licenses
+ .
+ If You choose to distribute Source Code Form that is Incompatible With
+ Secondary Licenses under the terms of this version of the License, the
+ notice described in Exhibit B of this License must be attached.
+ .
+ Exhibit A - Source Code Form License Notice
+ -------------------------------------------
+ .
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ .
+ If it is not possible or desirable to put the notice in a particular
+ file, then You may include the notice in a location (such as a LICENSE
+ file in a relevant directory) where a recipient would be likely to look
+ for such a notice.
+ .
+ You may add additional accurate notices of copyright ownership.
+ .
+ Exhibit B - \"Incompatible With Secondary Licenses\" Notice
+ ---------------------------------------------------------
+ .
+ This Source Code Form is \"Incompatible With Secondary Licenses\", as
+ defined by the Mozilla Public License, v. 2.0."
+
+! License:"BSL-1.0"
+  text="
+ Boost Software License - Version 1.0 - August 17th, 2003 
+ . 
+ Permission is hereby granted, free of charge, to any person or organization
+ obtaining a copy of the software and accompanying documentation covered by
+ this license (the \"Software\") to use, reproduce, display, distribute,
+ execute, and transmit the Software, and to prepare derivative works of the
+ Software, and to permit third-parties to whom the Software is furnished to
+ do so, all subject to the following:
+ .
+ The copyright notices in the Software and this entire statement, including
+ the above license grant, this restriction and the following disclaimer,
+ must be included in all copies of the Software, in whole or in part, and
+ all derivative works of the Software, unless such copies or derivative
+ works are solely in the form of machine-executable object code generated by
+ a source language processor.
+ .
+ THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
+ SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
+ FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ DEALINGS IN THE SOFTWARE."
+
+! Files:"*"
+  Copyright="2010-2018, Internet Systems Consortium, Inc. (\"ISC\")" 
+  License short_name="MPL-2.0"
+ 
+! Files:"debian/*" 
+  Copyright="2016-2018, Adam Majer <adamm@zombino.com> / 2017-2018, Jason Guy (jason.e.guy@gmail.com) / 2018-2018, Internet Systems Consortium, Inc."
+  License short_name="MPL-2.0"
+
+! Files:"src/lib/util/encode/*"
+  Copyright="2002, Robert Ramey - http:www.rrsd.com ."
+  License short_name="BSL-1.0"
+
diff --git a/debian/gbp.conf b/debian/gbp.conf
new file mode 100644
index 0000000..ed04da0
--- /dev/null
+++ b/debian/gbp.conf
@@ -0,0 +1,4 @@
+[DEFAULT]
+debian-branch = debian/unstable
+pristine-tar = True
+pristine-tar-commit = True
diff --git a/debian/kea-admin.install b/debian/kea-admin.install
new file mode 100644
index 0000000..9117487
--- /dev/null
+++ b/debian/kea-admin.install
@@ -0,0 +1,3 @@
+usr/sbin/kea-admin
+usr/sbin/perfdhcp
+usr/share/kea/scripts
diff --git a/debian/kea-admin.lintian-overrides b/debian/kea-admin.lintian-overrides
new file mode 100644
index 0000000..8500cf7
--- /dev/null
+++ b/debian/kea-admin.lintian-overrides
@@ -0,0 +1,2 @@
+kea-admin: script-not-executable [usr/share/kea/scripts/*]
+kea-admin: bash-term-in-posix-shell
diff --git a/debian/kea-admin.manpages b/debian/kea-admin.manpages
new file mode 100644
index 0000000..342d39e
--- /dev/null
+++ b/debian/kea-admin.manpages
@@ -0,0 +1,2 @@
+usr/share/man/man8/kea-admin.8
+usr/share/man/man8/perfdhcp.8
diff --git a/debian/kea-common.install b/debian/kea-common.install
new file mode 100644
index 0000000..b7023a0
--- /dev/null
+++ b/debian/kea-common.install
@@ -0,0 +1,4 @@
+debian/usr.sbin.kea-lfc etc/apparmor.d/
+usr/lib/*/kea/hooks
+usr/lib/*/libkea-*.so.*
+usr/sbin/kea-lfc
diff --git a/debian/kea-common.lintian-overrides b/debian/kea-common.lintian-overrides
new file mode 100644
index 0000000..0efd491
--- /dev/null
+++ b/debian/kea-common.lintian-overrides
@@ -0,0 +1 @@
+kea-common: package-name-doesnt-match-sonames *
diff --git a/debian/kea-common.manpages b/debian/kea-common.manpages
new file mode 100644
index 0000000..12f0ade
--- /dev/null
+++ b/debian/kea-common.manpages
@@ -0,0 +1 @@
+usr/share/man/man8/kea-lfc.8
diff --git a/debian/kea-common.postinst b/debian/kea-common.postinst
new file mode 100644
index 0000000..61957be
--- /dev/null
+++ b/debian/kea-common.postinst
@@ -0,0 +1,39 @@
+#!/bin/sh
+# postinst script for kea-common
+#
+# see: dh_installdeb(1)
+
+set -e
+
+case "$1" in
+    configure)
+        addgroup --force-badname --system _kea >/dev/null || exit 1
+        adduser --force-badname --quiet --system --home /var/lib/kea \
+           --shell /bin/false --no-create-home --disabled-password --disabled-login \
+           --gecos "Kea DHCP User" --group _kea >/dev/null || exit 1
+
+        # From version 2.2.0-2 we leave the handling of the /var/log/kea and
+        # /var/lib/kea directories to systemd (creation and ownership/permissions
+        # settings). When upgrading from kea-common (< 2.2.0-2) drop the now
+        # useless dpkg-statoverrides.
+        if [ "$2" != "" ] && dpkg --compare-versions "$2" lt "2.2.0-2"; then
+            for d in /var/log/kea /var/lib/kea; do
+                if dpkg-statoverride --list $d >/dev/null 2>&1; then
+                    dpkg-statoverride --remove $d
+                fi
+            done
+        fi
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/kea-ctrl-agent.config b/debian/kea-ctrl-agent.config
new file mode 100644
index 0000000..00e4013
--- /dev/null
+++ b/debian/kea-ctrl-agent.config
@@ -0,0 +1,73 @@
+#!/bin/sh
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+ask_for_password() {
+    while :; do
+        RET=""
+        db_input high kea-ctrl-agent/kea_api_password || true
+        db_go || true
+        db_get kea-ctrl-agent/kea_api_password
+        if [ -z "$RET" ]; then
+            # empty passwords result in no action
+            break
+        fi
+        API_PASSWORD="$RET"
+        db_input high kea-ctrl-agent/kea_api_password_again || true
+        db_go || true
+        db_get kea-ctrl-agent/kea_api_password_again
+        if [ "$RET" = "$API_PASSWORD" ]; then
+            API_PASSWORD=""
+            break
+        fi
+        db_fset kea-ctrl-agent/password_mismatch seen false
+        db_input critical kea-ctrl-agent/password_mismatch || true
+        db_set kea-ctrl-agent/kea_api_password ""
+        db_set kea-ctrl-agent/kea_api_password_again ""
+        db_go || true
+    done
+}
+
+gen_random_pw() {
+    head -c 15 /dev/urandom | base64 | tr -d '[:space:]'
+}
+
+
+RET=""
+choice=""
+reconfigure=""
+
+if [ "${1}" = "configure" ] || [ "${1}" = "reconfigure" ]; then
+    if [ "${1}" = "reconfigure" ] || [ -n "${DEBCONF_RECONFIGURE}" ]; then
+        reconfigure="yes"
+    fi
+    # only ask questions on:
+    # - reconfigure
+    # - fresh install
+    # - upgrade from pre-debconf package (lt: empty version is "earlier", so
+    #   this covers the fresh install case too)
+    if [ -n "${reconfigure}" ] || dpkg --compare-versions "$2" lt "2.2.0-5ubuntu2~"; then
+        db_input high kea-ctrl-agent/make_a_choice || true
+        db_go || true
+
+        db_get kea-ctrl-agent/make_a_choice
+        choice="${RET}"
+
+        case "${choice}" in
+            unconfigured)
+                # nothing to do
+            ;;
+            configured_password)
+                ask_for_password
+            ;;
+            configured_random_password)
+                db_set kea-ctrl-agent/kea_api_password "$(gen_random_pw)"
+            ;;
+            *)
+                # shouldn't happen, so it's the same as "unconfigured" above
+            ;;
+        esac
+    fi
+fi
diff --git a/debian/kea-ctrl-agent.init b/debian/kea-ctrl-agent.init
new file mode 100644
index 0000000..3d1d5fa
--- /dev/null
+++ b/debian/kea-ctrl-agent.init
@@ -0,0 +1,161 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          kea-ctrl-agent
+# Required-Start:    $local_fs $network $remote_fs $syslog
+# Required-Stop:     $local_fs $network $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Kea DHCP Control Agent for REST Service
+# Description:       Kea is an IPv4 and IPv6 DHCP server developed by Internet
+#                    Systems Consortium providing a very high-performance with
+#                    PostgreSQL, MySQL and memfile backends.
+### END INIT INFO
+# Author: Jason Guy <jason.e.guy@gmail.com>
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC=kea-ctrl-agent
+NAME=kea-ctrl-agent
+DAEMON=/usr/sbin/kea-ctrl-agent
+DAEMON_ARGS="-c /etc/kea/kea-ctrl-agent.conf"
+DAEMONUSER=_kea
+PIDFILE=/run/kea/kea-ctrl-agent.kea-ctrl-agent.pid
+SCRIPTNAME=/etc/init.d/$NAME
+KEA_PIDFILE_DIR=/run/kea
+KEA_LOCKFILE_DIR=/run/lock/kea
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+create_lockfile_dir()
+{
+	if [ ! -d "$KEA_LOCKFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_LOCKFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_LOCKFILE_DIR"
+	fi
+}
+
+create_pidfile_dir()
+{
+	if [ ! -d "$KEA_PIDFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_PIDFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_PIDFILE_DIR"
+	fi
+}
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	create_lockfile_dir
+	create_pidfile_dir
+	export KEA_LOCKFILE_DIR
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -b -c $DAEMONUSER -- \
+		$DAEMON_ARGS \
+		|| return 2
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON --user $DAEMONUSER
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	return 0
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  status)
+	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+	;;
+  reload|force-reload)
+	log_daemon_msg "Reloading $DESC" "$NAME"
+	do_reload
+	log_end_msg $?
+	;;
+  restart)
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+		# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/debian/kea-ctrl-agent.install b/debian/kea-ctrl-agent.install
new file mode 100644
index 0000000..c1184cf
--- /dev/null
+++ b/debian/kea-ctrl-agent.install
@@ -0,0 +1,4 @@
+etc/kea/kea-ctrl-agent.conf
+usr/sbin/kea-ctrl-agent
+usr/sbin/kea-shell
+debian/usr.sbin.kea-ctrl-agent etc/apparmor.d/
diff --git a/debian/kea-ctrl-agent.manpages b/debian/kea-ctrl-agent.manpages
new file mode 100644
index 0000000..ff73f6e
--- /dev/null
+++ b/debian/kea-ctrl-agent.manpages
@@ -0,0 +1,2 @@
+usr/share/man/man8/kea-ctrl-agent.8
+usr/share/man/man8/kea-shell.8
diff --git a/debian/kea-ctrl-agent.postinst b/debian/kea-ctrl-agent.postinst
new file mode 100644
index 0000000..a3c94af
--- /dev/null
+++ b/debian/kea-ctrl-agent.postinst
@@ -0,0 +1,72 @@
+#!/bin/sh
+# postinst script for kea-ctrl-agent.
+#
+# See: dh_installdeb(1).
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+# Summary of how this script can be called:
+#        * <postinst> 'configure' <most-recently-configured-version>
+#        * <old-postinst> 'abort-upgrade' <new version>
+#        * <conflictor's-postinst> 'abort-remove' 'in-favour' <package>
+#          <new-version>
+#        * <postinst> 'abort-remove'
+#        * <deconfigured's-postinst> 'abort-deconfigure' 'in-favour'
+#          <failed-install-package> <version> 'removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package.
+
+
+case "$1" in
+    configure|reconfigure)
+        api_password=""
+        choice=""
+        pw_file=/etc/kea/kea-api-password
+
+        db_get kea-ctrl-agent/make_a_choice
+        choice="${RET}"
+        RET=""
+
+        case "${choice}" in
+            unconfigured)
+                # do nothing
+            ;;
+            configured_password|configured_random_password)
+                db_get kea-ctrl-agent/kea_api_password
+                api_password="${RET}"
+            ;;
+            *)
+            ;;
+        esac
+
+        if [ -n "${api_password}" ]; then
+            touch "${pw_file}"
+            chmod 0640 "${pw_file}"
+            chgrp _kea "${pw_file}"
+            # no extra \n
+            printf "%s" "${api_password}" > "${pw_file}"
+        fi
+   ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+    ;;
+
+    *)
+        echo "postinst called with unknown argument '$1'" >&2
+        exit 1
+    ;;
+esac
+
+# forget we ever saw the password
+db_set kea-ctrl-agent/kea_api_password ""
+db_set kea-ctrl-agent/kea_api_password_again ""
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/kea-ctrl-agent.postrm b/debian/kea-ctrl-agent.postrm
new file mode 100644
index 0000000..f387553
--- /dev/null
+++ b/debian/kea-ctrl-agent.postrm
@@ -0,0 +1,40 @@
+#!/bin/sh
+# postrm script for kea-ctrl-agent.
+#
+# See: dh_installdeb(1).
+
+set -e
+
+# Summary of how this script can be called:
+#        * <postrm> 'remove'
+#        * <postrm> 'purge'
+#        * <old-postrm> 'upgrade' <new-version>
+#        * <new-postrm> 'failed-upgrade' <old-version>
+#        * <new-postrm> 'abort-install'
+#        * <new-postrm> 'abort-install' <old-version>
+#        * <new-postrm> 'abort-upgrade' <old-version>
+#        * <disappearer's-postrm> 'disappear' <overwriter>
+#          <overwriter-version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package.
+
+
+case "$1" in
+    purge)
+        rm -f /etc/kea/kea-api-password
+    ;;
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+    ;;
+
+    *)
+        echo "postrm called with unknown argument '$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/kea-ctrl-agent.service b/debian/kea-ctrl-agent.service
new file mode 100644
index 0000000..52e11ad
--- /dev/null
+++ b/debian/kea-ctrl-agent.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=Kea Control Agent
+Documentation=man:kea-ctrl-agent(8)
+After=network-online.target time-sync.target
+ConditionFileNotEmpty=/etc/kea/kea-api-password
+
+[Service]
+User=_kea
+Environment="KEA_LOCKFILE_DIR=/run/lock/kea"
+ConfigurationDirectory=kea
+RuntimeDirectory=kea lock/kea
+RuntimeDirectoryPreserve=yes
+LogsDirectory=kea
+LogsDirectoryMode=0750
+StateDirectory=kea
+ExecStart=/usr/sbin/kea-ctrl-agent -c /etc/kea/kea-ctrl-agent.conf
+ExecReload=/bin/kill -HUP $MAINPID
+KillMode=process
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/kea-ctrl-agent.templates b/debian/kea-ctrl-agent.templates
new file mode 100644
index 0000000..090e353
--- /dev/null
+++ b/debian/kea-ctrl-agent.templates
@@ -0,0 +1,34 @@
+Template: kea-ctrl-agent/kea_api_password
+Type: password
+_Description: New password for the kea control agent "kea_api" user:
+ This password will be stored in the /etc/kea/kea-api-password file.
+ .
+ NOTE: if the password is empty, no action will be taken.
+
+Template: kea-ctrl-agent/kea_api_password_again
+Type: password
+_Description: Repeat password for the kea control agent "kea_api" user:
+
+Template: kea-ctrl-agent/password_mismatch
+Type: error
+_Description: Password input error
+ The two passwords you entered were not the same. Please try again.
+
+Template: kea-ctrl-agent/make_a_choice
+Type: select
+Choices: do_nothing, configured_random_password, configured_password
+_Description: Kea control agent authentication configuration
+ Starting with this version, the Kea Control Agent will be configured to require authentication by default.
+ .
+ The available options are:
+ .
+  do nothing:
+   Until you create /etc/kea/kea-api-password, either manually or using one the other options described here, the service will not start.
+ .
+  configured with a random password:
+   The packaging will generate a random password for you, save it, and start the service.
+ .
+  configured with password:
+   The packaging will save the password you supply, and start the service. Note that an empty password will result in no action and be equivalent to "do nothing" above.
+ .
+ The username is `kea-api`, and the password will be expected to be in `/etc/kea/kea-api-password`.
diff --git a/debian/kea-dev.install b/debian/kea-dev.install
new file mode 100644
index 0000000..9805c55
--- /dev/null
+++ b/debian/kea-dev.install
@@ -0,0 +1,3 @@
+usr/include/kea/*
+usr/lib/*/libkea-*.so
+usr/bin/kea-msg-compiler
diff --git a/debian/kea-dev.lintian-overrides b/debian/kea-dev.lintian-overrides
new file mode 100644
index 0000000..a87424b
--- /dev/null
+++ b/debian/kea-dev.lintian-overrides
@@ -0,0 +1 @@
+kea-dev: no-manual-page [usr/bin/kea-msg-compiler]
diff --git a/debian/kea-dhcp-ddns-server.init b/debian/kea-dhcp-ddns-server.init
new file mode 100644
index 0000000..c67be9e
--- /dev/null
+++ b/debian/kea-dhcp-ddns-server.init
@@ -0,0 +1,167 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          kea-dhcp-ddns
+# Required-Start:    $local_fs $network $remote_fs $syslog
+# Required-Stop:     $local_fs $network $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Kea DHCP DDNS Server
+# Description:       Kea is an IPv4 and IPv6 DHCP server developed by Internet
+#                    Systems Consortium providing a very high-performance with
+#                    PostgreSQL, MySQL and memfile backends.
+### END INIT INFO
+# Author: Adam Majer <adamm@zombino.com>
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC=kea-dhcp-ddns
+NAME=kea-dhcp-ddns
+DAEMON=/usr/sbin/kea-dhcp-ddns
+DAEMON_ARGS="-c /etc/kea/kea-dhcp-ddns.conf"
+DAEMONUSER=_kea
+PIDFILE=/run/kea/kea-dhcp-ddns.kea-dhcp-ddns.pid # depends on config-filename: https://kea.readthedocs.io/en/latest/arm/ddns.html#starting-and-stopping-the-dhcp-ddns-server
+SCRIPTNAME=/etc/init.d/$NAME
+KEA_PIDFILE_DIR=/run/kea
+KEA_LOCKFILE_DIR=/run/lock/kea
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+create_lockfile_dir()
+{
+	if [ ! -d "$KEA_LOCKFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_LOCKFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_LOCKFILE_DIR"
+	fi
+}
+
+create_pidfile_dir()
+{
+	if [ ! -d "$KEA_PIDFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_PIDFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_PIDFILE_DIR"
+	fi
+}
+
+setcap_binary()
+{
+	setcap "cap_net_bind_service" $DAEMON
+}
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	create_lockfile_dir
+	create_pidfile_dir
+	setcap_binary
+	export KEA_LOCKFILE_DIR
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -b -c $DAEMONUSER -- \
+		$DAEMON_ARGS \
+		|| return 2
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON --user $DAEMONUSER
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	return 0
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  status)
+	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+	;;
+  reload|force-reload)
+	log_daemon_msg "Reloading $DESC" "$NAME"
+	do_reload
+	log_end_msg $?
+	;;
+  restart)
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+		# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/debian/kea-dhcp-ddns-server.install b/debian/kea-dhcp-ddns-server.install
new file mode 100644
index 0000000..d029623
--- /dev/null
+++ b/debian/kea-dhcp-ddns-server.install
@@ -0,0 +1,3 @@
+etc/kea/kea-dhcp-ddns.conf
+usr/sbin/kea-dhcp-ddns
+debian/usr.sbin.kea-dhcp-ddns /etc/apparmor.d/
diff --git a/debian/kea-dhcp-ddns-server.manpages b/debian/kea-dhcp-ddns-server.manpages
new file mode 100644
index 0000000..4dde921
--- /dev/null
+++ b/debian/kea-dhcp-ddns-server.manpages
@@ -0,0 +1 @@
+usr/share/man/man8/kea-dhcp-ddns.8
diff --git a/debian/kea-dhcp-ddns-server.service b/debian/kea-dhcp-ddns-server.service
new file mode 100644
index 0000000..e752e9d
--- /dev/null
+++ b/debian/kea-dhcp-ddns-server.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=Kea DDNS Service
+Documentation=man:kea-dhcp-ddns(8)
+Wants=network-online.target
+After=network-online.target
+After=time-sync.target
+
+[Service]
+User=_kea
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+Environment="KEA_LOCKFILE_DIR=/run/lock/kea"
+ConfigurationDirectory=kea
+RuntimeDirectory=kea lock/kea
+RuntimeDirectoryPreserve=yes
+LogsDirectory=kea
+LogsDirectoryMode=0750
+StateDirectory=kea
+ExecStart=/usr/sbin/kea-dhcp-ddns -c /etc/kea/kea-dhcp-ddns.conf
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/kea-dhcp4-server.init b/debian/kea-dhcp4-server.init
new file mode 100644
index 0000000..c91aa61
--- /dev/null
+++ b/debian/kea-dhcp4-server.init
@@ -0,0 +1,167 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          kea-dhcp4-server
+# Required-Start:    $local_fs $network $remote_fs $syslog
+# Required-Stop:     $local_fs $network $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Kea DHCP IPv4 Server
+# Description:       Kea is an IPv4 and IPv6 DHCP server developed by Internet
+#                    Systems Consortium providing a very high-performance with
+#                    PostgreSQL, MySQL and memfile backends.
+### END INIT INFO
+# Author: Adam Majer <adamm@zombino.com>
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="kea-dhcp4"
+NAME=kea-dhcp4-server
+DAEMON=/usr/sbin/kea-dhcp4
+DAEMON_ARGS="-c /etc/kea/kea-dhcp4.conf"
+DAEMONUSER=_kea
+PIDFILE=/run/kea/kea-dhcp4.kea-dhcp4.pid # depends on config-filename: https://kea.readthedocs.io/en/latest/arm/dhcp4-srv.html
+SCRIPTNAME=/etc/init.d/$NAME
+KEA_PIDFILE_DIR=/run/kea
+KEA_LOCKFILE_DIR=/run/lock/kea
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+create_lockfile_dir()
+{
+	if [ ! -d "$KEA_LOCKFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_LOCKFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_LOCKFILE_DIR"
+	fi
+}
+
+create_pidfile_dir()
+{
+	if [ ! -d "$KEA_PIDFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_PIDFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_PIDFILE_DIR"
+	fi
+}
+
+setcap_binary()
+{
+	setcap "cap_net_bind_service,cap_net_raw=+ep" $DAEMON
+}
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	create_lockfile_dir
+	create_pidfile_dir
+	setcap_binary
+	export KEA_LOCKFILE_DIR
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -b -c $DAEMONUSER -- \
+		$DAEMON_ARGS \
+		|| return 2
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON --user $DAEMONUSER
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	return 0
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  status)
+	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+	;;
+  reload|force-reload)
+	log_daemon_msg "Reloading $DESC" "$NAME"
+	do_reload
+	log_end_msg $?
+	;;
+  restart)
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+		# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/debian/kea-dhcp4-server.install b/debian/kea-dhcp4-server.install
new file mode 100644
index 0000000..59f61d2
--- /dev/null
+++ b/debian/kea-dhcp4-server.install
@@ -0,0 +1,3 @@
+etc/kea/kea-dhcp4.conf
+usr/sbin/kea-dhcp4
+debian/usr.sbin.kea-dhcp4 /etc/apparmor.d/
diff --git a/debian/kea-dhcp4-server.manpages b/debian/kea-dhcp4-server.manpages
new file mode 100644
index 0000000..05225e5
--- /dev/null
+++ b/debian/kea-dhcp4-server.manpages
@@ -0,0 +1 @@
+usr/share/man/man8/kea-dhcp4.8
diff --git a/debian/kea-dhcp4-server.service b/debian/kea-dhcp4-server.service
new file mode 100644
index 0000000..43b70c8
--- /dev/null
+++ b/debian/kea-dhcp4-server.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=Kea IPv4 DHCP daemon
+Documentation=man:kea-dhcp4(8)
+Wants=network-online.target
+After=network-online.target
+After=time-sync.target
+
+[Service]
+User=_kea
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
+Environment="KEA_LOCKFILE_DIR=/run/lock/kea"
+ConfigurationDirectory=kea
+RuntimeDirectory=kea lock/kea
+RuntimeDirectoryPreserve=yes
+LogsDirectory=kea
+LogsDirectoryMode=0750
+StateDirectory=kea
+ExecStart=/usr/sbin/kea-dhcp4 -c /etc/kea/kea-dhcp4.conf
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/kea-dhcp6-server.init b/debian/kea-dhcp6-server.init
new file mode 100644
index 0000000..7b57f01
--- /dev/null
+++ b/debian/kea-dhcp6-server.init
@@ -0,0 +1,167 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          kea-dhcp6-server
+# Required-Start:    $local_fs $network $remote_fs $syslog
+# Required-Stop:     $local_fs $network $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Kea DHCP IPv6 Server
+# Description:       Kea is an IPv4 and IPv6 DHCP server developed by Internet
+#                    Systems Consortium providing a very high-performance with
+#                    PostgreSQL, MySQL and memfile backends.
+### END INIT INFO
+# Author: Adam Majer <adamm@zombino.com>
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="kea-dhcp6"
+NAME=kea-dhcp6-server
+DAEMON=/usr/sbin/kea-dhcp6
+DAEMON_ARGS="-c /etc/kea/kea-dhcp6.conf"
+DAEMONUSER=_kea
+PIDFILE=/run/kea/kea-dhcp6.kea-dhcp6.pid # depends on config-filename: https://kea.readthedocs.io/en/latest/arm/dhcp6-srv.html
+SCRIPTNAME=/etc/init.d/$NAME
+KEA_PIDFILE_DIR=/run/kea
+KEA_LOCKFILE_DIR=/run/lock/kea
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+create_lockfile_dir()
+{
+	if [ ! -d "$KEA_LOCKFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_LOCKFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_LOCKFILE_DIR"
+	fi
+}
+
+create_pidfile_dir()
+{
+	if [ ! -d "$KEA_PIDFILE_DIR" ]; then
+		mkdir -m 0750 -p "$KEA_PIDFILE_DIR"
+		chown "$DAEMONUSER:" "$KEA_PIDFILE_DIR"
+	fi
+}
+
+setcap_binary()
+{
+	setcap "cap_net_bind_service" $DAEMON
+}
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	create_lockfile_dir
+	create_pidfile_dir
+	setcap_binary
+	export KEA_LOCKFILE_DIR
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -b -c $DAEMONUSER -- \
+		$DAEMON_ARGS \
+		|| return 2
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON --user $DAEMONUSER
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --exec $DAEMON --user $DAEMONUSER
+	return 0
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  status)
+	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+	;;
+  reload|force-reload)
+	log_daemon_msg "Reloading $DESC" "$NAME"
+	do_reload
+	log_end_msg $?
+	;;
+  restart)
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+		# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/debian/kea-dhcp6-server.install b/debian/kea-dhcp6-server.install
new file mode 100644
index 0000000..d22f7a7
--- /dev/null
+++ b/debian/kea-dhcp6-server.install
@@ -0,0 +1,3 @@
+etc/kea/kea-dhcp6.conf
+usr/sbin/kea-dhcp6
+debian/usr.sbin.kea-dhcp6 /etc/apparmor.d/
diff --git a/debian/kea-dhcp6-server.manpages b/debian/kea-dhcp6-server.manpages
new file mode 100644
index 0000000..b6c99cb
--- /dev/null
+++ b/debian/kea-dhcp6-server.manpages
@@ -0,0 +1 @@
+usr/share/man/man8/kea-dhcp6.8
diff --git a/debian/kea-dhcp6-server.service b/debian/kea-dhcp6-server.service
new file mode 100644
index 0000000..7944a09
--- /dev/null
+++ b/debian/kea-dhcp6-server.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=Kea IPv6 DHCP daemon
+Documentation=man:kea-dhcp6(8)
+Wants=network-online.target
+After=network-online.target
+After=time-sync.target
+
+[Service]
+User=_kea
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+Environment="KEA_LOCKFILE_DIR=/run/lock/kea"
+ConfigurationDirectory=kea
+RuntimeDirectory=kea lock/kea
+RuntimeDirectoryPreserve=yes
+LogsDirectory=kea
+LogsDirectoryMode=0750
+StateDirectory=kea
+ExecStart=/usr/sbin/kea-dhcp6 -c /etc/kea/kea-dhcp6.conf
+
+[Install]
+WantedBy=multi-user.target
diff --git a/debian/kea-doc.README.Debian b/debian/kea-doc.README.Debian
new file mode 100644
index 0000000..03c9d46
--- /dev/null
+++ b/debian/kea-doc.README.Debian
@@ -0,0 +1,13 @@
+# ISC Kea for Debian
+
+## Logging
+
+Following what upstream does with their .deb packaging, the Debian packages by
+default log to the systemd journal. If logging to file is desired just edit the
+config files and change the loggers "output" to a file under /var/log/kea/,
+e.g. for /etc/kea/kea-dhcp4.conf:
+
+  "output": "/var/log/kea/kea-dhcp4.log"
+
+The systemd units automatically create the /var/log/kea/ right ownership and
+permissions.
diff --git a/debian/kea-doc.doc-base b/debian/kea-doc.doc-base
new file mode 100644
index 0000000..e403e79
--- /dev/null
+++ b/debian/kea-doc.doc-base
@@ -0,0 +1,11 @@
+Document: kea
+Title: Kea Administrator Reference Manual
+Author: Internet Systems Consortium
+Abstract: This is the reference guide for Kea, an open source implementation
+ of the Dynamic Host Configuration Protocol (DHCP) servers, developed and
+ maintained by Internet Systems Consortium (ISC).
+Section: System/Administration
+
+Format: HTML
+Files: /usr/share/doc/kea/html/*
+Index: /usr/share/doc/kea/html/index.html
diff --git a/debian/kea-doc.docs b/debian/kea-doc.docs
new file mode 100644
index 0000000..df73e67
--- /dev/null
+++ b/debian/kea-doc.docs
@@ -0,0 +1,3 @@
+CONTRIBUTING.md
+usr/share/doc/kea/*
+usr/share/kea/api
diff --git a/debian/kea-doc.lintian-overrides b/debian/kea-doc.lintian-overrides
new file mode 100644
index 0000000..6e30f23
--- /dev/null
+++ b/debian/kea-doc.lintian-overrides
@@ -0,0 +1,3 @@
+kea-doc: embedded-javascript-library *
+kea-doc: font-in-non-font-package [usr/share/doc/kea/html/_static/fonts/*]
+kea-doc: font-outside-font-dir [usr/share/doc/kea/html/_static/fonts/*]
diff --git a/debian/not-installed b/debian/not-installed
new file mode 100644
index 0000000..045263b
--- /dev/null
+++ b/debian/not-installed
@@ -0,0 +1,4 @@
+usr/share/man/man8/kea-netconf.8
+usr/sbin/keactrl
+usr/share/man/man8/keactrl.8
+etc/kea/keactrl.conf
diff --git a/debian/patches/0002-kea_admin_fix.patch b/debian/patches/0002-kea_admin_fix.patch
new file mode 100644
index 0000000..5ed99e4
--- /dev/null
+++ b/debian/patches/0002-kea_admin_fix.patch
@@ -0,0 +1,20 @@
+From: Kea <isc-kea@packages.debian.org>
+Date: Tue, 19 Feb 2019 12:39:35 +0000
+Subject: kea_admin_fix
+
+Removed the fallback to the build version of kea-admin since it will not exist on users hosts.
+---
+ src/bin/admin/kea-admin.in | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/src/bin/admin/kea-admin.in
++++ b/src/bin/admin/kea-admin.in
+@@ -50,8 +50,6 @@
+ # Include the installed admin-utils.sh if available. Fallback to sources otherwise.
+ if test -f "@datarootdir@/@PACKAGE_NAME@/scripts/admin-utils.sh"; then
+     . "@datarootdir@/@PACKAGE_NAME@/scripts/admin-utils.sh"
+-else
+-    . "@abs_top_builddir@/src/bin/admin/admin-utils.sh"
+ fi
+ 
+ # Find the installed kea-lfc if available. Fallback to sources otherwise.
diff --git a/debian/patches/0009-disable-database-tests.patch b/debian/patches/0009-disable-database-tests.patch
new file mode 100644
index 0000000..7d008c8
--- /dev/null
+++ b/debian/patches/0009-disable-database-tests.patch
@@ -0,0 +1,26 @@
+Description: Skip the database tests
+ The MySQL and PostgreSQL tests require a server with username,
+ password and tables setup for the test, see doc/devel/unit-tests.dox.
+ There's no way to instruct the build system to skip specific tests,
+ so let's disable them with a patch.
+Forwarded: not-needed
+Author: Paride Legovini <paride.legovini@canonical.com>
+Last-Update: 2020-12-03
+--- a/src/bin/admin/tests/mysql_tests.sh.in
++++ b/src/bin/admin/tests/mysql_tests.sh.in
+@@ -1,4 +1,6 @@
+ #!/bin/sh
++echo "SKIPPING MYSQL TEST"
++exit 0
+ 
+ # Copyright (C) 2014-2023 Internet Systems Consortium, Inc. ("ISC")
+ #
+--- a/src/bin/admin/tests/pgsql_tests.sh.in
++++ b/src/bin/admin/tests/pgsql_tests.sh.in
+@@ -1,4 +1,6 @@
+ #!/bin/sh
++echo "SKIPPING POSTGRESQL TEST"
++exit 0
+ 
+ # Copyright (C) 2015-2023 Internet Systems Consortium, Inc. ("ISC")
+ #
diff --git a/debian/patches/0010-set-control-sockets-location.patch b/debian/patches/0010-set-control-sockets-location.patch
new file mode 100644
index 0000000..f8be1d3
--- /dev/null
+++ b/debian/patches/0010-set-control-sockets-location.patch
@@ -0,0 +1,116 @@
+From: Athos Ribeiro <athos.ribeiro@canonical.com>
+Date: Mon, 13 Feb 2023 16:20:18 -0300
+Subject: d/rules: set the default location for control sockets to /run/kea
+
+The default config files place the control sockets in /tmp, which is
+insecure. Mangle the config files to place the sockets under _kea-owned
+/run/kea instead.
+
+Patch originally submitted by Paride Legovini in
+https://salsa.debian.org/debian/isc-kea/-/merge_requests/15.
+
+Last-Update: 2023-02-13
+Bug: https://gitlab.isc.org/isc-projects/kea/-/issues/2495
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014929
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/isc-kea/+bug/1863100
+---
+ src/bin/keactrl/kea-ctrl-agent.conf.pre | 6 +++---
+ src/bin/keactrl/kea-dhcp-ddns.conf.pre  | 2 +-
+ src/bin/keactrl/kea-dhcp4.conf.pre      | 2 +-
+ src/bin/keactrl/kea-dhcp6.conf.pre      | 2 +-
+ src/bin/keactrl/kea-netconf.conf.pre    | 4 ++--
+ 5 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/src/bin/keactrl/kea-ctrl-agent.conf.pre
++++ b/src/bin/keactrl/kea-ctrl-agent.conf.pre
+@@ -32,15 +32,15 @@
+     "control-sockets": {
+         "dhcp4": {
+             "socket-type": "unix",
+-            "socket-name": "/tmp/kea4-ctrl-socket"
++            "socket-name": "@runstatedir@/@PACKAGE@/kea4-ctrl-socket"
+         },
+         "dhcp6": {
+             "socket-type": "unix",
+-            "socket-name": "/tmp/kea6-ctrl-socket"
++            "socket-name": "@runstatedir@/@PACKAGE@/kea6-ctrl-socket"
+         },
+         "d2": {
+             "socket-type": "unix",
+-            "socket-name": "/tmp/kea-ddns-ctrl-socket"
++            "socket-name": "@runstatedir@/@PACKAGE@/kea-ddns-ctrl-socket"
+         }
+     },
+ 
+--- a/src/bin/keactrl/kea-dhcp-ddns.conf.pre
++++ b/src/bin/keactrl/kea-dhcp-ddns.conf.pre
+@@ -23,7 +23,7 @@
+   "port": 53001,
+   "control-socket": {
+       "socket-type": "unix",
+-      "socket-name": "/tmp/kea-ddns-ctrl-socket"
++      "socket-name": "@runstatedir@/@PACKAGE@/kea-ddns-ctrl-socket"
+   },
+   "tsig-keys": [],
+   "forward-ddns" : {},
+--- a/src/bin/keactrl/kea-dhcp4.conf.pre
++++ b/src/bin/keactrl/kea-dhcp4.conf.pre
+@@ -49,7 +49,7 @@
+     // more. For detailed description, see Sections 8.8, 16 and 15.
+     "control-socket": {
+         "socket-type": "unix",
+-        "socket-name": "/tmp/kea4-ctrl-socket"
++        "socket-name": "@runstatedir@/@PACKAGE@/kea4-ctrl-socket"
+     },
+ 
+     // Use Memfile lease database backend to store leases in a CSV file.
+--- a/src/bin/keactrl/kea-dhcp6.conf.pre
++++ b/src/bin/keactrl/kea-dhcp6.conf.pre
+@@ -43,7 +43,7 @@
+     // description, see Sections 9.12, 16 and 15.
+     "control-socket": {
+         "socket-type": "unix",
+-        "socket-name": "/tmp/kea6-ctrl-socket"
++        "socket-name": "@runstatedir@/@PACKAGE@/kea6-ctrl-socket"
+     },
+ 
+     // Use Memfile lease database backend to store leases in a CSV file.
+--- a/src/bin/keactrl/kea-netconf.conf.pre
++++ b/src/bin/keactrl/kea-netconf.conf.pre
+@@ -30,13 +30,13 @@
+         "dhcp4": {
+             "control-socket": {
+                 "socket-type": "unix",
+-                "socket-name": "/tmp/kea4-ctrl-socket"
++                "socket-name": "@runstatedir@/@PACKAGE@/kea4-ctrl-socket"
+             }
+         },
+         "dhcp6": {
+             "control-socket": {
+                 "socket-type": "unix",
+-                "socket-name": "/tmp/kea6-ctrl-socket"
++                "socket-name": "@runstatedir@/@PACKAGE@/kea6-ctrl-socket"
+             }
+         }
+     },
+--- a/tools/path_replacer.sh.in
++++ b/tools/path_replacer.sh.in
+@@ -28,13 +28,17 @@
+ localstatedir="@localstatedir@"
+ exec_prefix="@exec_prefix@"
+ libdir="@libdir@"
++runstatedir="@runstatedir@"
++PACKAGE="@PACKAGE@"
+ 
+ echo "Replacing \@prefix\@ with ${prefix}"
+ echo "Replacing \@libdir\@ with ${libdir}"
+ echo "Replacing \@sysconfdir\@ with ${sysconfdir}"
+ echo "Replacing \@localstatedir\@ with ${localstatedir}"
++echo "Replacing \@runstatedir\@ with ${runstatedir}"
++echo "Replacing \@PACKAGE\@ with ${PACKAGE}"
+ 
+ echo "Input file: $1"
+ echo "Output file: $2"
+ 
+-sed -e "s@SEP@\@libdir\@@SEP@${libdir}@SEP@g; s@SEP@\@localstatedir\@@SEP@${localstatedir}@SEP@g; s@SEP@\@prefix\@@SEP@${prefix}@SEP@g; s@SEP@\@sysconfdir\@@SEP@${sysconfdir}@SEP@g" "${1}" > "${2}"
++sed -e "s@SEP@\@libdir\@@SEP@${libdir}@SEP@g; s@SEP@\@localstatedir\@@SEP@${localstatedir}@SEP@g; s@SEP@\@prefix\@@SEP@${prefix}@SEP@g; s@SEP@\@sysconfdir\@@SEP@${sysconfdir}@SEP@g; s@SEP@\@runstatedir\@@SEP@${runstatedir}@SEP@g; s@SEP@\@PACKAGE\@@SEP@${PACKAGE}@SEP@g" "${1}" > "${2}"
diff --git a/debian/patches/0011-kea-ctrl-agent-authentication.patch b/debian/patches/0011-kea-ctrl-agent-authentication.patch
new file mode 100644
index 0000000..d965fbc
--- /dev/null
+++ b/debian/patches/0011-kea-ctrl-agent-authentication.patch
@@ -0,0 +1,30 @@
+Description: Set kea-ctrl-agent up to require a password.
+Author: Andreas Hasenack <andreas.hasenack@canonical.com>
+Forwarded: not-needed
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033367
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/isc-kea/+bug/2007312
+Last-Update: 2023-03-17
+
+diff --git a/src/bin/keactrl/kea-ctrl-agent.conf.pre b/src/bin/keactrl/kea-ctrl-agent.conf.pre
+index e6ae8b8a..f7e3fed2 100644
+--- a/src/bin/keactrl/kea-ctrl-agent.conf.pre
++++ b/src/bin/keactrl/kea-ctrl-agent.conf.pre
+@@ -26,6 +26,18 @@
+     // is specifically for HA updates only.
+     "http-port": 8000,
+ 
++    "authentication": {
++        "type": "basic",
++        "realm": "Kea Control Agent",
++        "directory": "/etc/kea",
++        "clients": [
++            {
++                "user": "kea-api",
++                "password-file": "kea-api-password"
++            }
++        ]
++    },
++
+     // Specify location of the files to which the Control Agent
+     // should connect to forward commands to the DHCPv4, DHCPv6
+     // and D2 servers via unix domain sockets.
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..d18b4f5
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1,4 @@
+0002-kea_admin_fix.patch
+0009-disable-database-tests.patch
+0010-set-control-sockets-location.patch
+0011-kea-ctrl-agent-authentication.patch
diff --git a/debian/po/POTFILES.in b/debian/po/POTFILES.in
new file mode 100644
index 0000000..e2d1d9f
--- /dev/null
+++ b/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] kea-ctrl-agent.templates
diff --git a/debian/po/de.po b/debian/po/de.po
new file mode 100644
index 0000000..7f7b56d
--- /dev/null
+++ b/debian/po/de.po
@@ -0,0 +1,130 @@
+# German translation of isc-kea debconf templates.
+# This file is distributed under the same license as the isc-kea package.
+# Copyright © of this file:
+# Christoph Brinkhaus <c.brinkhaus@t-online.de>, 2023.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: isc-kea_2.2.0-8\n"
+"Report-Msgid-Bugs-To: isc-kea@packages.debian.org\n"
+"POT-Creation-Date: 2023-03-29 14:20-0300\n"
+"PO-Revision-Date: 2023-07-17 20:18+0200\n"
+"Last-Translator: Christoph Brinkhaus <c.brinkhaus@t-online.de>\n"
+"Language-Team: German <debian-l10n-german@lists.debian.org>\n"
+"Language: de\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "New password for the kea control agent \"kea_api\" user:"
+msgstr "Neues Passwort für den Kea Control Agent »kea_api«-Benutzer:"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "This password will be stored in the /etc/kea/kea-api-password file."
+msgstr ""
+"Dieses Passwort wird in der Datei /etc/kea/kea-api-password gespeichert."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "NOTE: if the password is empty, no action will be taken."
+msgstr "HINWEIS: falls das Passwort leer ist, wird keine Aktion durchgeführt."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:2001
+msgid "Repeat password for the kea control agent \"kea_api\" user:"
+msgstr ""
+"Geben Sie das Passwort für den Kea Control Agent »kea_api«-Benutzer erneut "
+"ein:"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "Password input error"
+msgstr "Passwort-Eingabefehler"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "The two passwords you entered were not the same. Please try again."
+msgstr ""
+"Die zwei eingegebenen Passwörter sind nicht identisch. Bitte versuchen Sie "
+"es erneut."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "Kea control agent authentication configuration"
+msgstr "Kea Control Agent-Authentifizierungskonfiguration"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"Starting with this version, the Kea Control Agent will be configured to "
+"require authentication by default."
+msgstr ""
+"Ab dieser Version ist die Standardeinstellung des Kea Control Agent so, dass "
+"eine Authentifizierung erforderlich ist."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "The available options are:"
+msgstr "Die verfügbaren Möglichkeiten sind:"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" do nothing:\n"
+"  Until you create /etc/kea/kea-api-password, either manually or using one "
+"the other options described here, the service will not start."
+msgstr ""
+" keine Aktion:\n"
+" Bis Sie /etc/kea/kea-api-password erstellt haben, entweder manuell oder "
+"durch Verwendung der anderen hier beschriebenen Möglichkeiten, wird der "
+"Dienst nicht starten."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with a random password:\n"
+"  The packaging will generate a random password for you, save it, and start "
+"the service."
+msgstr ""
+" mit einem zufälligen Passwort konfiguriert:\n"
+"  Das Paket erzeugt ein zufälliges Passwort, speichert es und startet den "
+"Dienst."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with password:\n"
+"  The packaging will save the password you supply, and start the service. "
+"Note that an empty password will result in no action and be equivalent to "
+"\"do nothing\" above."
+msgstr ""
+" konfiguriert mit einem Passwort:\n"
+"  Das Paket speichert das bereitgestellte Passwort und startet den Dienst. "
+"Beachten Sie, dass ein leeres Passwort keine Aktionen bewirkt und dem »keine "
+"Aktion« von oben entspricht."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"The username is `kea-api`, and the password will be expected to be in `/etc/"
+"kea/kea-api-password`."
+msgstr ""
+"Der Benutzername ist `kea-api` und das Passwort wird in `/etc/kea/kea-api-"
+"password` erwartet."
diff --git a/debian/po/es.po b/debian/po/es.po
new file mode 100644
index 0000000..bef717d
--- /dev/null
+++ b/debian/po/es.po
@@ -0,0 +1,129 @@
+# Translation of isc-kea debconf templates to Spanish.
+# Copyright (C) 2023 Camaleón <noelamac@gmail.com>
+# This file is distributed under the same license as the isc-kea package.
+# Camaleón <noelamac@gmail.com>, 2023.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: isc-kea\n"
+"Report-Msgid-Bugs-To: isc-kea@packages.debian.org\n"
+"POT-Creation-Date: 2023-03-29 14:20-0300\n"
+"PO-Revision-Date: 2023-07-09 16:50+0200\n"
+"Last-Translator: Camaleón <noelamac@gmail.com>\n"
+"Language-Team: Debian Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"Language: es\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 2.4.2\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "New password for the kea control agent \"kea_api\" user:"
+msgstr "Nueva contraseña del usuario «kea-api» del Agente de Control Kea:"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "This password will be stored in the /etc/kea/kea-api-password file."
+msgstr "Esta contraseña se guardará en el archivo «/etc/kea/kea-api-password»."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "NOTE: if the password is empty, no action will be taken."
+msgstr ""
+"NOTA: si deja la contraseña en blanco, no se llevará a cabo ninguna acción."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:2001
+msgid "Repeat password for the kea control agent \"kea_api\" user:"
+msgstr ""
+"Vuelva a introducir la contraseña del usuario «kea-api» del Agente de "
+"Control Kea:"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "Password input error"
+msgstr "Error al introducir la contraseña"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "The two passwords you entered were not the same. Please try again."
+msgstr "Las contraseñas que ha introducido no coinciden. Inténtelo de nuevo."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "Kea control agent authentication configuration"
+msgstr "Configuración de la autentificación del Agente de Control Kea"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"Starting with this version, the Kea Control Agent will be configured to "
+"require authentication by default."
+msgstr ""
+"A partir de esta versión, el Agente de Control Kea se configurará para "
+"requerir autentificación de manera predeterminada."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "The available options are:"
+msgstr "Las opciones disponibles son:"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" do nothing:\n"
+"  Until you create /etc/kea/kea-api-password, either manually or using one "
+"the other options described here, the service will not start."
+msgstr ""
+" no hacer nada:\n"
+"  El servicio no se iniciará hasta que no se genere el archivo «/etc/kea/kea-"
+"api-password», bien manualmente o utilizando alguna de las otras opciones "
+"descritas en este apartado."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with a random password:\n"
+"  The packaging will generate a random password for you, save it, and start "
+"the service."
+msgstr ""
+" configurado con una contraseña aleatoria:\n"
+"  El paquete generará una contraseña aleatoria para usted, la guardará e "
+"iniciará el servicio."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with password:\n"
+"  The packaging will save the password you supply, and start the service. "
+"Note that an empty password will result in no action and be equivalent to "
+"\"do nothing\" above."
+msgstr ""
+" configurado con contraseña:\n"
+"  El paquete guardará la contraseña que introduzca e iniciará el servicio. "
+"Tenga en cuenta que una contraseña en blanco no generará ninguna acción y "
+"será equivalente a la opción «no hacer nada»."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"The username is `kea-api`, and the password will be expected to be in `/etc/"
+"kea/kea-api-password`."
+msgstr ""
+"El nombre de usuario es «kea-api» y se espera que la contraseña esté en el "
+"archivo «/etc/kea/kea-api-password»."
diff --git a/debian/po/fr.po b/debian/po/fr.po
new file mode 100644
index 0000000..c139c17
--- /dev/null
+++ b/debian/po/fr.po
@@ -0,0 +1,132 @@
+# Translation of isc-kea debconf templates to French.
+# Copyright (C) 2023
+# This file is distributed under the same license as the isc-kea package.
+#
+# Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>, 2023.
+msgid ""
+msgstr ""
+"Project-Id-Version: isc-kea\n"
+"Report-Msgid-Bugs-To: isc-kea@packages.debian.org\n"
+"POT-Creation-Date: 2023-03-29 14:20-0300\n"
+"PO-Revision-Date: 2023-12-16 11:24+0100\n"
+"Last-Translator: Jean-Pierre Giraud <jean-pierregiraud@neuf.fr>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"Language: fr_FR\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=2; plural=(n > 1);\n"
+"X-Generator: Lokalize 22.12.3\n"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "New password for the kea control agent \"kea_api\" user:"
+msgstr ""
+"Nouveau mot de passe de l'utilisateur agent de contrôle de kea « kea_api » :"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "This password will be stored in the /etc/kea/kea-api-password file."
+msgstr ""
+"Ce mot de passe sera enregistré dans le fichier /etc/kea/kea-api-password."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "NOTE: if the password is empty, no action will be taken."
+msgstr ""
+"NOTE : si le mot de passe est vide, aucune action ne sera entreprise."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:2001
+msgid "Repeat password for the kea control agent \"kea_api\" user:"
+msgstr ""
+"Confirmation du mot de passe de l'utilisateur agent de contrôle de kea "
+"« kea_api » :"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "Password input error"
+msgstr "Erreur de saisie du mot de passe"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "The two passwords you entered were not the same. Please try again."
+msgstr ""
+"Le mot de passe et sa confirmation ne sont pas identiques. Veuillez "
+"recommencer."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "Kea control agent authentication configuration"
+msgstr "Configuration de l'authentification de l'agent de contrôle de kea"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"Starting with this version, the Kea Control Agent will be configured to "
+"require authentication by default."
+msgstr ""
+"À partir de cette version, l'agent de contrôle de kea sera configuré pour "
+"exiger par défaut une authentification."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "The available options are:"
+msgstr "Les options disponibles sont :"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" do nothing:\n"
+"  Until you create /etc/kea/kea-api-password, either manually or using one "
+"the other options described here, the service will not start."
+msgstr ""
+" Ne rien faire :\n"
+"  jusqu'à la création de /etc/kea/kea-api-password, manuellement ou en "
+"utilisant une des options décrites ici, le service ne démarrera pas."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with a random password:\n"
+"  The packaging will generate a random password for you, save it, and start "
+"the service."
+msgstr ""
+" Configuration avec un mot de passe aléatoire :\n"
+"  le paquet va générer un mot de passe aléatoire, enregistrez-le et démarrez "
+"le service."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with password:\n"
+"  The packaging will save the password you supply, and start the service. "
+"Note that an empty password will result in no action and be equivalent to "
+"\"do nothing\" above."
+msgstr ""
+" Configuration avec un mot de passe :\n"
+"  le paquet va enregistrer le mot de passe fourni et démarrer le service. "
+"Notez qu'un mot de passe vide n'aboutira à aucune action et est équivalent à "
+"l'option « ne rien faire »."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"The username is `kea-api`, and the password will be expected to be in `/etc/"
+"kea/kea-api-password`."
+msgstr ""
+"Le nom d'utilisateur est « kea-api  et le mot de passe devrait être dans le "
+"fichier « /etc/kea/kea-api-password »."
diff --git a/debian/po/nl.po b/debian/po/nl.po
new file mode 100644
index 0000000..12b8d6e
--- /dev/null
+++ b/debian/po/nl.po
@@ -0,0 +1,127 @@
+# Dutch translation of isc-kea debconf templates.
+# This file is distributed under the same license as the isc-kea package.
+# Frans Spiesschaert <Frans.Spiesschaert@yucom.be>, 2023.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: isc-kea_2.2.0-8\n"
+"Report-Msgid-Bugs-To: isc-kea@packages.debian.org\n"
+"POT-Creation-Date: 2023-03-29 14:20-0300\n"
+"PO-Revision-Date: 2023-07-10 23:19+0200\n"
+"Last-Translator: Frans Spiesschaert <Frans.Spiesschaert@yucom.be>\n"
+"Language-Team: Debian Dutch l10n Team <debian-l10n-dutch@lists.debian.org>\n"
+"Language: nl\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Gtranslator 3.30.1\n"
+"Plural-Forms: nplurals=2; plural=(n != 1)\n"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "New password for the kea control agent \"kea_api\" user:"
+msgstr "Nieuw wachtwoord voor gebruiker \"kea_api\" van de kea control agent:"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "This password will be stored in the /etc/kea/kea-api-password file."
+msgstr ""
+"Dit wachtwoord wordt opgeslagen in het bestand /etc/kea/kea-api-password."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "NOTE: if the password is empty, no action will be taken."
+msgstr "OPMERKING: als het wachtwoord leeg is, wordt er geen actie ondernomen."
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:2001
+msgid "Repeat password for the kea control agent \"kea_api\" user:"
+msgstr ""
+"Herhaal het wachtwoord voor gebruiker \"kea_api\" van de kea control agent:"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "Password input error"
+msgstr "Fout bij het invoeren van het wachtwoord"
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "The two passwords you entered were not the same. Please try again."
+msgstr ""
+"De twee wachtwoorden die u invoerde, waren niet identiek. Probeer opnieuw."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "Kea control agent authentication configuration"
+msgstr "Kea control agent authenticatieconfiguratie"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"Starting with this version, the Kea Control Agent will be configured to "
+"require authentication by default."
+msgstr ""
+"Vanaf deze versie wordt Kea Control Agent geconfigureerd om standaard "
+"verificatie te vereisen."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "The available options are:"
+msgstr "De beschikbare opties zijn:"
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" do nothing:\n"
+"  Until you create /etc/kea/kea-api-password, either manually or using one "
+"the other options described here, the service will not start."
+msgstr ""
+" niets doen:\n"
+"  Totdat u /etc/kea/kea-api-password aanmaakt, handmatig of met behulp van "
+"een van de andere hier beschreven opties, zal de service niet starten."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with a random password:\n"
+"  The packaging will generate a random password for you, save it, and start "
+"the service."
+msgstr ""
+" geconfigureerd met een willekeurig wachtwoord:\n"
+"  Het pakket genereert een willekeurig wachtwoord voor u, slaat het op en "
+"start de service."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with password:\n"
+"  The packaging will save the password you supply, and start the service. "
+"Note that an empty password will result in no action and be equivalent to "
+"\"do nothing\" above."
+msgstr ""
+" geconfigureerd met wachtwoord:\n"
+"  Het pakket slaat het door u opgegeven wachtwoord op en start de service. "
+"Merk op dat een leeg wachtwoord geen actie tot gevolg heeft en gelijk staat "
+"aan \"niets doen\" hierboven."
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"The username is `kea-api`, and the password will be expected to be in `/etc/"
+"kea/kea-api-password`."
+msgstr ""
+"De gebruikersnaam is `kea-api` en het wachtwoord wordt verwacht in `/etc/kea/"
+"kea-api-password` te staan."
diff --git a/debian/po/templates.pot b/debian/po/templates.pot
new file mode 100644
index 0000000..c6a7229
--- /dev/null
+++ b/debian/po/templates.pot
@@ -0,0 +1,110 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the isc-kea package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: isc-kea\n"
+"Report-Msgid-Bugs-To: isc-kea@packages.debian.org\n"
+"POT-Creation-Date: 2023-03-29 14:20-0300\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "New password for the kea control agent \"kea_api\" user:"
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "This password will be stored in the /etc/kea/kea-api-password file."
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:1001
+msgid "NOTE: if the password is empty, no action will be taken."
+msgstr ""
+
+#. Type: password
+#. Description
+#: ../kea-ctrl-agent.templates:2001
+msgid "Repeat password for the kea control agent \"kea_api\" user:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "Password input error"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../kea-ctrl-agent.templates:3001
+msgid "The two passwords you entered were not the same. Please try again."
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "Kea control agent authentication configuration"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"Starting with this version, the Kea Control Agent will be configured to "
+"require authentication by default."
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid "The available options are:"
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" do nothing:\n"
+"  Until you create /etc/kea/kea-api-password, either manually or using one "
+"the other options described here, the service will not start."
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with a random password:\n"
+"  The packaging will generate a random password for you, save it, and start "
+"the service."
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+" configured with password:\n"
+"  The packaging will save the password you supply, and start the service. "
+"Note that an empty password will result in no action and be equivalent to "
+"\"do nothing\" above."
+msgstr ""
+
+#. Type: select
+#. Description
+#: ../kea-ctrl-agent.templates:4001
+msgid ""
+"The username is `kea-api`, and the password will be expected to be in `/etc/"
+"kea/kea-api-password`."
+msgstr ""
diff --git a/debian/python3-kea-connector.install b/debian/python3-kea-connector.install
new file mode 100644
index 0000000..d0b8f74
--- /dev/null
+++ b/debian/python3-kea-connector.install
@@ -0,0 +1,2 @@
+usr/lib/python3/dist-packages/kea/kea_conn.py
+usr/lib/python3/dist-packages/kea/kea_connector3.py
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..ec21498
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,75 @@
+#!/usr/bin/make -f
+
+# see EXAMPLES in dpkg-buildflags(1) and read /usr/share/dpkg/*
+DPKG_EXPORT_BUILDFLAGS = 1
+include /usr/share/dpkg/default.mk
+
+include /usr/share/dpkg/pkg-info.mk
+
+# see FEATURE AREAS in dpkg-buildflags(1)
+export DEB_BUILD_MAINT_OPTIONS = hardening=+all
+
+# Disable LTO on ppc64el as it causes crashes (LP: #2055151).
+# This has been spotted in Ubuntu, where LTO is enabled by
+# default, but it likely that Debian would be affected too.
+ifeq ($(DEB_HOST_ARCH),ppc64el)
+export DEB_BUILD_MAINT_OPTIONS += optimize=-lto
+endif
+
+%:
+	dh $@ --with python3 -X.la
+
+override_dh_auto_configure:
+	dh_auto_configure -- \
+		--prefix=/usr \
+		--sysconfdir=/etc \
+		--localstatedir=/var \
+		--with-openssl \
+		--with-mysql \
+		--with-pgsql \
+		--with-boost-libs=-lboost_system \
+		--enable-generate-docs \
+		--enable-generate-messages \
+		--enable-shell \
+		--disable-static \
+		--disable-rpath \
+		--enable-generate-parser \
+		--disable-dependency-tracking \
+		--enable-perfdhcp \
+		--without-werror \
+		--with-site-packages=/usr/lib/python3/dist-packages
+
+execute_after_dh_auto_build-indep:
+	# Do not download external JS components in binary documentation package
+	# Inspired by similar removal in python-pyopencl
+	# Thanks to Andreas Beckmann
+	find doc/sphinx/_build/html -name '*.html' -exec sed -r -i -e '\,( *)<script async="async" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js"></script>,i \1<script src="/usr/share/javascript/mathjax/MathJax.js"></script>' {} +
+	find doc/sphinx/_build/html -name '*.html' -exec sed -r -i -e 's,https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js,/usr/share/javascript/mathjax/config/TeX-MML-AM_CHTML.js,' {} +
+
+execute_after_dh_install:
+	dh_apparmor -pkea-ctrl-agent --profile-name=usr.sbin.kea-ctrl-agent
+	dh_apparmor -pkea-dhcp4-server --profile-name=usr.sbin.kea-dhcp4
+	dh_apparmor -pkea-dhcp6-server --profile-name=usr.sbin.kea-dhcp6
+	dh_apparmor -pkea-dhcp-ddns-server --profile-name=usr.sbin.kea-dhcp-ddns
+	dh_apparmor -pkea-common --profile-name=usr.sbin.kea-lfc
+
+override_dh_auto_test:
+	dh_auto_test --no-parallel
+
+execute_after_dh_auto_install:
+	rm -rv \
+	    debian/tmp/usr/share/doc/kea/ChangeLog \
+	    debian/tmp/usr/share/doc/kea/COPYING \
+	    debian/tmp/usr/lib/python3/dist-packages/kea/__pycache__
+	# log to stdout (i.e. to to the systemd journal), and use a shorter log
+	# pattern that avoids logging information made redundant by the journal.
+	# adapted from: https://gitlab.isc.org/isc-projects/kea-packaging/-/blob/master/debian/rules
+	sed -i -e 's/"output": .*/"output": "stdout",/' -e 's@// "pattern"@"pattern"@' debian/tmp/etc/kea/kea-*.conf
+
+# Since we do not maintain a symbols file for the libraries shipped in
+# kea-common, make the shlibs control file more strict, generating dependencies
+# such as "libkea-util 52 kea-common (= 2.2.0-5)" instead of the less strict
+# "libkea-util 52 kea-common (>= 2.2.0)".
+override_dh_makeshlibs:
+	dh_makeshlibs -pkea-common -V'kea-common (= ${DEB_VERSION})'
+	dh_makeshlibs -Nkea-common
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
new file mode 100644
index 0000000..3c99ae9
--- /dev/null
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,14 @@
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
+
+variables:
+  # FTCBFS because of missing build-deps that are unlikely to be fixed any soon.
+  SALSA_CI_DISABLE_CROSSBUILD_ARM64: 1
+  # Fail on Lintian warnings
+  SALSA_CI_LINTIAN_FAIL_WARNING: 1
+  SALSA_CI_LINTIAN_SUPPRESS_TAGS: >-
+    orig-tarball-missing-upstream-signature,
+    package-name-defined-in-config-h,
+  # Not reproducible when varying the build_path.
+  SALSA_CI_REPROTEST_ARGS: --variations=-build_path
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..163aaf8
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/debian/source/lintian-overrides b/debian/source/lintian-overrides
new file mode 100644
index 0000000..8d87da8
--- /dev/null
+++ b/debian/source/lintian-overrides
@@ -0,0 +1 @@
+isc-kea source: very-long-line-length-in-source-file
diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..bbed706
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,13 @@
+# Keep this test as the first, as it will verify the default installation
+# behavior wrt kea-ctrl-agent password configuration
+Tests: kea-ctrl-agent-debconf
+Restrictions: needs-root, allow-stderr
+Depends: kea-ctrl-agent
+
+Tests: smoke-tests
+Restrictions: needs-root, allow-stderr
+Depends: kea, curl, jq
+
+Tests: kea-dhcp4
+Restrictions: needs-root, allow-stderr, breaks-testbed
+Depends: kea-dhcp4-server, kea-ctrl-agent, isc-dhcp-client, bridge-utils, iproute2, jq
diff --git a/debian/tests/kea-ctrl-agent-debconf b/debian/tests/kea-ctrl-agent-debconf
new file mode 100644
index 0000000..5790977
--- /dev/null
+++ b/debian/tests/kea-ctrl-agent-debconf
@@ -0,0 +1,266 @@
+#!/bin/bash
+
+set -e
+
+pw_file="/etc/kea/kea-api-password"
+pw_secret="secret_password_${RANDOM}"
+service="kea-ctrl-agent.service"
+
+cleanup() {
+    /bin/true
+}
+
+trap cleanup EXIT
+
+override_systemd_throttling() {
+    mkdir -p /run/systemd/system/kea-ctrl-agent.service.d
+    cat > /run/systemd/system/kea-ctrl-agent.service.d/override.conf <<EOF
+[Unit]
+StartLimitIntervalSec=0
+EOF
+    systemctl daemon-reload
+}
+
+check_perms() {
+    local file="${1}"
+    local wanted_perms="${2}"
+    local perms
+
+    perms=$(stat -c %U:%G:%a "${file}")
+    if [ "${perms}" != "${wanted_perms}" ]; then
+        echo "## ERROR: permissions are ${perms} and should be ${wanted_perms}"
+        return 1
+    else
+        echo "## OK, permissions are ${perms}"
+    fi
+}
+
+service_status_must_be() {
+    local service_status
+    local wanted_status="${1}"
+    service_status=$(systemctl is-active "${service}" || /bin/true)
+    systemctl status "${service}" || /bin/true
+    if [ "${service_status}" != "${wanted_status}" ]; then
+        echo "## ERROR, service is ${service_status}"
+        return 1
+    else
+        echo "## OK, service is ${service_status}"
+    fi
+}
+
+reconfigure_unconfigured() {
+    debconf-set-selections << EOF
+kea-ctrl-agent kea-ctrl-agent/make_a_choice select unconfigured
+EOF
+    dpkg-reconfigure kea-ctrl-agent
+}
+
+reconfigure_password() {
+    local password="${1}"
+    debconf-set-selections << EOF
+kea-ctrl-agent kea-ctrl-agent/make_a_choice select configured_password
+kea-ctrl-agent kea-ctrl-agent/kea_api_password password ${password}
+kea-ctrl-agent kea-ctrl-agent/kea_api_password_again password ${password}
+EOF
+    dpkg-reconfigure kea-ctrl-agent
+}
+
+reconfigure_random() {
+    debconf-set-selections << EOF
+kea-ctrl-agent kea-ctrl-agent/make_a_choice select configured_random_password
+EOF
+    dpkg-reconfigure kea-ctrl-agent
+}
+
+test_fresh_install() {
+    echo
+    echo "## Running ${FUNCNAME[0]}"
+    # On a fresh install, which is the situation we are in as this is the first
+    # test being run, there is no kea-api-password file, and the service isn't
+    # running
+    echo "## Fresh install, default options, there must be no ${pw_file} file"
+    ls -la "$(dirname ${pw_file})"
+    test ! -f "${pw_file}"
+
+    echo
+    echo "## With no ${pw_file}, the service must not be running"
+    service_status_must_be inactive
+    echo
+}
+
+test_service_wont_start_without_pwfile() {
+    echo
+    echo "## Running ${FUNCNAME[0]}"
+    echo "## With no ${pw_file}, service must not start"
+    ls -la "$(dirname ${pw_file})"
+    test ! -f "${pw_file}"
+    echo "## Current status:"
+    systemctl status "${service}" || /bin/true
+    echo
+    echo "## Attempting to start ${service}"
+    systemctl start "${service}"
+    service_status_must_be inactive
+    echo
+}
+
+test_configured_password() {
+    echo
+    echo "## Running ${FUNCNAME[0]}"
+    echo "## Reconfiguring kea-ctrl-agent with password ${pw_secret}"
+    reconfigure_password "${pw_secret}"
+
+    echo "## Checking that ${pw_file} exists and has ${pw_secret}"
+    ls -la "$(dirname ${pw_file})"
+    test -f "${pw_file}"
+    generated_pw=$(cat "${pw_file}")
+    if [ "${generated_pw}" != "${pw_secret}" ]; then
+        echo "## ERROR, password from ${pw_file} is not equal to ${pw_secret}: ${generated_pw}"
+        return 1
+    else
+        echo "## OK, password from ${pw_file} is ${generated_pw}"
+    fi
+
+    echo "## Checking that ${pw_file} has expected permissions and ownership"
+    check_perms "${pw_file}" "root:_kea:640"
+    echo
+
+    echo
+    echo "## Checking that the service is running"
+    service_status_must_be active
+}
+
+test_configured_random_password() {
+    local generated_pw
+
+    echo
+    echo "## Running ${FUNCNAME[0]}"
+    echo "## Reconfiguring kea-ctrl-agent with random password option"
+    reconfigure_random
+
+    echo "## Checking that ${pw_file} exists and has a password different from ${pw_secret}"
+    ls -la "$(dirname ${pw_file})"
+    test -f "${pw_file}"
+
+    generated_pw=$(cat "${pw_file}")
+    if [ "${generated_pw}" = "${pw_secret}" ]; then
+        echo "## ERROR, generated random password \"${generated_pw}\" is equal to \"${pw_secret}\""
+        return 1
+    else
+        echo "## OK, generated random password is \"${generated_pw}\""
+    fi
+    echo
+    echo "## Checking that ${pw_file} has expected permissions and ownership"
+    check_perms "${pw_file}" "root:_kea:640"
+    echo
+
+    echo
+    echo "## Checking that the service is running"
+    service_status_must_be active
+}
+
+test_unconfigured() {
+    local -r new_secret="${pw_secret}${pw_secret}"
+    local contents
+
+    echo
+    echo "## Running ${FUNCNAME[0]}"
+    echo "## Reconfiguring kea-ctrl-agent with option \"unconfigured\" should leave things as they were"
+    echo
+    echo "## Overwriting ${pw_file} with ${new_secret}"
+    printf "%s" "${new_secret}" > "${pw_file}"
+
+    echo "## Reconfiguring"
+    reconfigure_unconfigured
+
+    echo
+    echo "## ${pw_file} should still contain ${new_secret}"
+    contents=$(cat "${pw_file}")
+    if [ "${contents}" != "${new_secret}" ]; then
+        echo "## ERROR, ${pw_file} now contains \"${contents}\""
+        return 1
+    else
+        echo "## OK, same content"
+    fi
+
+    echo "## Removing ${pw_file} and reconfiguring, a new one should not be created, and the service must be stopped"
+    rm -f "${pw_file}"
+    ls -la $(dirname "${pw_file}")
+    echo "## Reconfiguring"
+    reconfigure_unconfigured
+
+    echo "## ${pw_file} was not recreated"
+    ls -la $(dirname "${pw_file}")
+    test ! -f "${pw_file}"
+    echo "## With no ${pw_file}, the service must not be running"
+    service_status_must_be inactive
+}
+
+test_no_start_with_empty_password() {
+    echo
+    echo "## Running ${FUNCNAME[0]}"
+    echo "## kea-ctrl-agent must not start with an empty password file"
+    echo
+    echo "## Truncating ${pw_file}"
+    truncate -s 0 "${pw_file}"
+    ls -la $(dirname "${pw_file}")
+    test ! -s "${pw_file}"
+    echo
+    echo "## Restarting kea-ctrl-agent"
+    systemctl restart "${service}"
+    echo
+    echo "## Service must not be started"
+    service_status_must_be inactive
+}
+
+test_empty_password_via_debconf() {
+    local service_status
+    local contents
+
+    echo
+    echo "## Running ${FUNCNAME[0]}"
+    echo "## Reconfiguring with password set to ${pw_secret}"
+    reconfigure_password "${pw_secret}"
+
+    echo
+    echo "## ${pw_file} must now contain ${pw_secret}"
+    contents=$(cat "${pw_file}")
+    if [ "${contents}" != "${pw_secret}" ]; then
+        echo "## ERROR, ${pw_file} now contains \"${contents}\""
+        return 1
+    else
+        echo "## OK, same content"
+    fi
+
+    echo
+    echo "## Service must be running"
+    service_status_must_be active
+
+    echo
+    echo "## Reconfiguring with an empty password should not change the existing password"
+    # set an empty password (no args)
+    reconfigure_password
+    ls -la $(dirname "${pw_file}")
+    contents=$(cat "${pw_file}")
+    if [ "${contents}" != "${pw_secret}" ]; then
+        echo "## ERROR, ${pw_file} now contains \"${contents}\""
+        return 1
+    else
+        echo "## OK, same content"
+    fi
+
+    echo
+    echo "## Service must be running"
+    service_status_must_be active
+}
+
+
+# we restart kea-ctrl-agent a lot during this test
+override_systemd_throttling
+
+test_fresh_install
+test_service_wont_start_without_pwfile
+test_configured_password
+test_configured_random_password
+test_unconfigured
+test_no_start_with_empty_password
+test_empty_password_via_debconf
diff --git a/debian/tests/kea-dhcp4 b/debian/tests/kea-dhcp4
new file mode 100644
index 0000000..66ce927
--- /dev/null
+++ b/debian/tests/kea-dhcp4
@@ -0,0 +1,277 @@
+#!/bin/bash
+
+set -e
+set -o pipefail
+
+bridge="keabr0"
+bridge_ip="192.168.127.1/24"
+subnetcidr="192.168.127.0/24"
+pool_range="192.168.127.10 - 192.168.127.250"
+test_domain="example.autopkgtest"
+server_iface="p1"
+client_iface="client0"
+client_ns="clientns"
+declare -A dhcp4_config
+resolv_conf_bkp=$(mktemp)
+kea_password_file="/etc/kea/kea-api-password"
+
+# kea-ctrl-agent needs a password file, or else it won't start
+# this also tests the debconf mechanism
+debconf-set-selections << eof
+kea-ctrl-agent kea-ctrl-agent/make_a_choice select configured_random_password
+eof
+dpkg-reconfigure kea-ctrl-agent
+[ -s "${kea_password_file}" ] || {
+    echo "ERROR, debconf-set-selections failed to set a password for kea-ctrl-agent"
+    exit 1
+}
+
+auth_params="--auth-user kea-api --auth-password $(cat ${kea_password_file})"
+
+cleanup() {
+    rc=$?
+    set +e # so we don't exit midcleanup
+    if [ ${rc} -ne 0 ]; then
+        echo "## FAIL"
+        echo
+        echo "## dmesg"
+        dmesg -T | tail -n 500
+        echo
+        echo "## kea logs"
+        journalctl -u kea-dhcp4-server.service
+    fi
+    echo
+    echo "## Cleaning up"
+    ip link set "${server_iface}" down
+    ip link del "${server_iface}"
+    ip link set "${bridge}" down
+    brctl delbr "${bridge}"
+    ip netns delete "${client_ns}"
+    sed -r -i "/example.autopkgtest/d" /etc/hosts
+    if [ -s "${resolv_conf_bkp}" ]; then
+        cat "${resolv_conf_bkp}" > /etc/resolv.conf
+    fi
+    rm -f "${resolv_conf_bkp}"
+    # restore it for when we are called from the main script, and not the trap
+    set -e
+}
+
+trap cleanup EXIT
+
+run_on_client() {
+    ip netns exec "${client_ns}" "$@"
+}
+
+setup() {
+    cleanup 2>/dev/null
+    # so we don't have to worry about it being a symlink
+    cat /etc/resolv.conf > "${resolv_conf_bkp}"
+    echo "127.0.1.1 $(hostname).${test_domain} $(hostname)" >> /etc/hosts
+    ip netns add "${client_ns}"
+    ip link add "${server_iface}" type veth peer "${client_iface}" netns "${client_ns}"
+    brctl addbr "${bridge}"
+    brctl addif "${bridge}" "${server_iface}"
+    ip link set "${server_iface}" up
+    ip link set "${bridge}" up
+    ip addr add "${bridge_ip}" dev "${bridge}"
+}
+
+render_dhcp4_conf() {
+    local -n config="${1}"
+    local -r service="dhcp4"
+
+    template="debian/tests/kea-${service}.conf.template"
+    [ -f "${template}" ] || return 1
+    output="/etc/kea/kea-${service}.conf"
+
+    cat "${template}" | sed -r \
+        -e "s,@interface@,${config[interface]}," \
+        -e "s,@dnsip@,${config[dnsip]}," \
+        -e "s,@domain@,${config[domain]}," \
+        -e "s/@domainsearch@/${config[domainsearch]}/" \
+        -e "s,@router@,${config[router]}," \
+        -e "s,@subnetcidr@,${config[subnetcidr]}," \
+        -e "s,@poolrange@,${config[poolrange]}," \
+        -e "s,@multiarch@,$(dpkg-architecture -qDEB_HOST_MULTIARCH)," \
+        > "${output}"
+}
+
+json_get_length() {
+    echo "${1}" | jq '. | length'
+}
+
+kea_get_leases_by_mac() {
+    local mac="${1}"
+    echo "\"hw-address\": \"${mac}\"" | kea-shell ${auth_params} --service dhcp4 lease4-get-by-hw-address
+}
+
+get_result_from_lease() {
+    echo "${1}" | jq -r '.[0].result'
+}
+
+get_number_of_leases() {
+    echo "${1}" | jq '.[0].arguments.leases | length'
+}
+
+get_ip_from_lease() {
+    echo "${1}" | jq -r '.[0]["arguments"]["leases"][0]["ip-address"]'
+}
+
+get_mac_from_lease() {
+    echo "${1}" | jq -r '.[0]["arguments"]["leases"][0]["hw-address"]'
+}
+
+get_valid_lifetime_from_lease() {
+    echo "${1}" | jq -r '.[0]["arguments"]["leases"][0]["valid-lft"]'
+}
+
+check_leases() {
+    local data="${1}"
+    local if_mac="${2}"
+    local if_ip="${3}"
+    local res
+
+    res=$(json_get_length "${data}")
+    if [ ${res} != 1 ]; then
+        echo "## ERROR"
+        echo "## Expected 1 result, got ${res}:"
+        return 1
+    fi
+
+    res=$(get_result_from_lease "${data}")
+    if [ ${res} != 0 ]; then
+        echo "## ERROR"
+        echo "## Failed to obtain leases from server, code ${res}"
+        return 1
+    fi
+
+    res=$(get_number_of_leases "${data}")
+    if [ ${res} -ne 1 ]; then
+        echo "## ERROR"
+        echo "## Expected 1 lease, got ${res}:"
+        return 1
+    fi
+
+    res=$(get_ip_from_lease "${data}")
+    if [ "${if_ip}" != "${res}" ]; then
+        echo "## ERROR"
+        echo "## IP from lease (${res}) does not match IP from interface: ${if_ip}"
+        run_on_client ip a show
+        return 1
+    fi
+
+    res=$(get_mac_from_lease "${data}")
+    if [ "${if_mac}" != "${res}" ]; then
+        echo "## ERROR"
+        echo "## MAC from lease (${res}) does not match MAC from client interface: ${if_mac}"
+        run_on_client ip l show
+        return 1
+    fi
+}
+
+
+setup
+
+dhcp4_config["interface"]="${bridge}"
+# get rid of the CIDR part at the end
+dhcp4_config["dnsip"]="${bridge_ip%%/*}"
+dhcp4_config["domain"]="${test_domain}"
+dhcp4_config["domainsearch"]="${test_domain}"
+# get rid of the CIDR part at the end
+dhcp4_config["router"]="${bridge_ip%%/*}"
+dhcp4_config["subnetcidr"]="${subnetcidr}"
+dhcp4_config["poolrange"]="${pool_range}"
+
+echo
+echo "## Configuring kea-dhcp4 and restarting the service"
+render_dhcp4_conf dhcp4_config
+systemctl restart kea-dhcp4-server.service
+sleep 2s
+
+echo
+echo "## Obtaining IP via dhclient"
+run_on_client timeout -v 60s dhclient -v "${client_iface}"
+echo "## OK"
+
+ip=$(run_on_client ip -4 -o addr show dev "${client_iface}" | awk '{print $4}')
+ip=${ip%%/*} # remove the CIDR part
+mac=$(run_on_client ip -4 link show dev "${client_iface}" | grep "link/ether" | awk '{print $2}')
+
+echo
+echo "## Got ip=${ip}"
+
+echo
+echo "## Checking leases that match client's ethernet address ${mac}"
+# this will break if/when we close LP: #2007312
+leases=$(kea_get_leases_by_mac "${mac}")
+echo "## Leases:"
+echo "${leases}" | jq .
+
+check_leases "${leases}" "${mac}" "${ip}"
+echo "## OK"
+
+echo
+echo "## INFO: Networking in the ${client_ns} namespace:"
+echo
+echo "## Interfaces"
+run_on_client ip a
+echo
+echo "## Routes"
+run_on_client ip route
+echo
+echo "## DNS"
+if command -v resolvectl > /dev/null 2>&1; then
+    run_on_client resolvectl status
+else
+    echo "## Skipping DNS info (no resolvectl installed)"
+fi
+
+echo
+echo "## Checking that the DNS domain \"${test_domain}\" was added to resolv.conf"
+if grep -E "^search[[:blank:]]" /etc/resolv.conf | grep -q -w -F "${test_domain}"; then
+    echo "## OK"
+else
+    echo "## ERROR"
+    echo "## /etc/resolv.conf does not contain ${test_domain}"
+    cat /etc/resolv.conf
+    exit 1
+fi
+
+echo
+echo "## Releasing IP via dhclient -r"
+run_on_client timeout -v 60s dhclient -v -r
+echo "## OK"
+
+echo
+# As per entry 2072 in
+# https://downloads.isc.org/isc/kea/2.4.0/Kea-2.4.0-ReleaseNotes.txt, starting
+# from kea 2.3.2, a lease is no longer deleted from the lease database after a
+# release request. Instead, it is expired to enable lease affinity. It is kept
+# for `hold-reclaimed-time` seconds. Its default value is 3600 seconds.
+# https://kea.readthedocs.io/en/kea-2.4.0/arm/lease-expiration.html
+echo "## Checking that the lease was expired"
+leases=$(kea_get_leases_by_mac "${mac}")
+echo "${leases}" | jq .
+n_results=$(json_get_length "${leases}")
+if [ ${n_results} -ne 1 ]; then
+    echo "## ERROR, expected 1 result, got ${n_results}"
+    echo "${leases}" | jq .
+    exit 1
+fi
+
+n_leases=$(get_number_of_leases "${leases}")
+if [ ${n_leases} -ne 1 ]; then
+    echo "## ERROR"
+    echo "## Expected 1 lease, got ${n_leases}:"
+    echo "${leases}" | jq .
+    exit 1
+fi
+lft=$(get_valid_lifetime_from_lease "${leases}")
+if [ ${lft} -gt 0 ]; then
+    echo "## ERROR"
+    echo "## Expected expired lease lifetime (0), got ${lft}"
+    echo "${leases}" | jq .
+    exit 1
+fi
+
+echo "## OK"
diff --git a/debian/tests/kea-dhcp4.conf.template b/debian/tests/kea-dhcp4.conf.template
new file mode 100644
index 0000000..2addefd
--- /dev/null
+++ b/debian/tests/kea-dhcp4.conf.template
@@ -0,0 +1,71 @@
+{
+"Dhcp4": {
+    "interfaces-config": {
+        "interfaces": [ "@interface@" ],
+        "service-sockets-max-retries": 10,
+        "service-sockets-retry-wait-time": 1000
+    },
+    "control-socket": {
+        "socket-type": "unix",
+        "socket-name": "/run/kea/kea4-ctrl-socket"
+    },
+    "hooks-libraries": [
+        {
+            "library": "/usr/lib/@multiarch@/kea/hooks/libdhcp_lease_cmds.so"
+        }
+    ],
+    "lease-database": {
+        "type": "memfile",
+        "lfc-interval": 3600
+    },
+    "expired-leases-processing": {
+        "reclaim-timer-wait-time": 10,
+        "flush-reclaimed-timer-wait-time": 25,
+        "hold-reclaimed-time": 3600,
+        "max-reclaim-leases": 100,
+        "max-reclaim-time": 250,
+        "unwarned-reclaim-cycles": 5
+    },
+    "renew-timer": 900,
+    "rebind-timer": 1800,
+    "valid-lifetime": 3600,
+    "option-data": [
+        {
+            "name": "domain-name-servers",
+            "data": "@dnsip@"
+        },
+        {
+            "code": 15,
+            "data": "@domain@"
+        },
+        {
+            "name": "domain-search",
+            "data": "@domainsearch@"
+        }
+    ],
+    "subnet4": [
+        {
+            "subnet": "@subnetcidr@",
+            "pools": [ { "pool": "@poolrange@" } ],
+            "option-data": [
+                {
+                    "name": "routers",
+                    "data": "@router@"
+                }
+            ]
+        }
+    ],
+    "loggers": [
+    {
+        "name": "kea-dhcp4",
+        "output_options": [
+            {
+                "output": "stdout"
+            }
+        ],
+        "severity": "INFO",
+        "debuglevel": 0
+    }
+  ]
+}
+}
diff --git a/debian/tests/smoke-tests b/debian/tests/smoke-tests
new file mode 100644
index 0000000..2de85c4
--- /dev/null
+++ b/debian/tests/smoke-tests
@@ -0,0 +1,63 @@
+#!/bin/bash
+
+set -exo pipefail
+
+# kea-ctrl-agent needs a password file, or else it won't start
+# this also tests the debconf mechanism
+debconf-set-selections << eof
+kea-ctrl-agent kea-ctrl-agent/make_a_choice select configured_random_password
+eof
+
+dpkg-reconfigure kea-ctrl-agent
+kea_password_file="/etc/kea/kea-api-password"
+[ -s "${kea_password_file}" ] || {
+    echo "ERROR, debconf-set-selections failed to set a password for kea-ctrl-agent"
+    exit 1
+}
+
+# Arbitrary wait to allow for the services to start.
+# This is needed to avoid having racy/flaky tests.
+sleep 5
+
+# Check that the PID files are in the right location
+for f in kea-dhcp4.kea-dhcp4.pid kea-dhcp6.kea-dhcp6.pid kea-ctrl-agent.kea-ctrl-agent.pid kea-dhcp-ddns.kea-dhcp-ddns.pid; do
+    test -f "/run/kea/$f"
+done
+
+# Check that the sockets are in the right location
+for socket in kea-ddns-ctrl-socket kea4-ctrl-socket kea6-ctrl-socket; do
+    test -S "/run/kea/$socket"
+done
+
+# Check that lock files are in the right location
+test -f /run/lock/kea/logger_lockfile
+
+check_kea_version() {
+  CHECKED_VERSION=$1
+  if [[ ! ${CHECKED_VERSION} =~ [0-9]+(\.[0-9]+){2} ]]; then
+    echo "Version [ ${CHECKED_VERSION} ] does not match X.Y.Z format"
+    exit 1
+  fi
+}
+
+# Check dhcp4 server configuration file
+kea-dhcp4 -t /etc/kea/kea-dhcp4.conf > /dev/null
+
+# Check dhcp6 server configuration file
+kea-dhcp6 -t /etc/kea/kea-dhcp6.conf > /dev/null
+
+# Check if we need to provide authentication
+auth_params=""
+basic_auth_params=""
+if [ -s /etc/kea/kea-api-password ]; then
+    auth_params="--auth-user kea-api --auth-password $(cat /etc/kea/kea-api-password)"
+    basic_auth_params="-u kea-api:$(cat /etc/kea/kea-api-password)"
+fi
+
+# Check control agent API
+TEST_KEA_VERSION=$(curl ${basic_auth_params} -s -X POST -H "Content-Type: application/json" -d '{ "command": "version-get", "service": [ "dhcp4" ] }' 127.0.0.1:8000 | jq -r '.[0].text')
+check_kea_version "${TEST_KEA_VERSION}"
+
+# Check control agent API through kea-shell
+TEST_KEA_VERSION=$(echo | kea-shell --service dhcp4 --host 127.0.0.1 --port 8000 ${auth_params} version-get | jq -r '.[0].text')
+check_kea_version "${TEST_KEA_VERSION}"
diff --git a/debian/upstream/metadata b/debian/upstream/metadata
new file mode 100644
index 0000000..7ffad73
--- /dev/null
+++ b/debian/upstream/metadata
@@ -0,0 +1,6 @@
+Documentation: https://kea.readthedocs.io/
+Changelog: https://gitlab.isc.org/isc-projects/kea/-/wikis/Release-Notes
+Bug-Database: https://gitlab.isc.org/isc-projects/kea/-/issues
+Bug-Submit: https://gitlab.isc.org/isc-projects/kea/-/issues
+Repository: https://gitlab.isc.org/isc-projects/kea.git
+Repository-Browse: https://gitlab.isc.org/isc-projects/kea/
diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc
new file mode 100644
index 0000000..876061d
--- /dev/null
+++ b/debian/upstream/signing-key.asc
@@ -0,0 +1,175 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGNjen4BEADDHiUVNbkFtiKPaMWjKxbKmF1nmv7XKjDhwSww6WFiGPbQyxNM
+r8EHlEJx5kMT67rx0IYMhTLiXm/9C4dGYyUfFWc35CGetuzstzCNkwJs7vZAhEyk
++06CX4GFiHPOmWIupGCxFkNz1Qopz3ZePMlZRslVCHzW4dbg5NKLI0ojXlNaTDU5
+mgUXpsPi/6l6QE6q3ouvmWPF4u71cZ1+W4UkIRAXOlbVsDzGaMaoHjJd8cOM8DrZ
+gKHACNPjzqOvEujXDC2vyKw6XpxR+pHz0QcrRtlKnVhPNiKcDfw2mJJ5zxi9uSDc
+dh5FomMn9sS4gy2Tub2urELnPf9xnURftRGG3VO6nZc81ufQB4s1BNT2ny0Uhx5V
+mXUJwefMypMBfAvWCWBCeyWYtBeo7LT3NmtLq3oVGPfl7+a0ToFAYeghspK8/nOX
+6/fqF1MEtzvWjXljz6K7FSDYSY9AoaESLHGwCo6dtff5S7f1+l6PCUNo6aM/B5Ke
+SIAN9Lm6z2iVuy9Lukw+5IRoRKHHV4rJauPtDeYoWnNiSd7Q4vFtotUIjRpDARpm
+xWS711Q2T+knHFLEiU8QzxjLhOnTzh4n9dDLHCkOY5WM5krldVeL5EuTyPKinuSn
+oE01A7I4IGJp753CshibxjNYDiEOVeK93R38Y543edlIrYxnfyMVsiqPkwARAQAB
+tDRNaWNoYcWCIEvEmXBpZcWEIChDb2RlLVNpZ25pbmcgS2V5KSA8bWljaGFsQGlz
+Yy5vcmc+iQJOBBMBCgA4FiEEcGtsKGIOdvkdEfffUQpkKgbFLOwFAmNjen4CGwMF
+CwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQUQpkKgbFLOwiLxAAjYuI4JQ8mPq7
+YrV9m4tu+jOKvoKfpjct2Rh02n/X3ChOgrdcXU898eH56tRk8Mv/E+cBTPN9zQn6
+rLprbYR2t2R+zgvuUZWA8In7aewoPIJw8OdlG0gTK9m3VHJIOhIX07qcFttSZw4m
+4rEU5mdxi9FatBWBzqnVm4Pn577aqRXK908j+6TvgWbZ6Cq0tw3syVT4kGj+93+P
+uIQQQkTYN8UDQPsAKzfzkbQC9I5YXBKUoB9CfhXig8V9N75R0gsWkJ8Vy/8wsPXT
+9/EPIIzhnhSuUIjvvBPbLGrzDgbhrfUQ/QVuXDVN8xl3rAWM/tiNGOnmzoYORyM5
+ftrnCDIaO4aVKR6rtEzfdQa5Kid1StfhFien/U8jYErxkEn2HRt2gVEX5nYq31T+
+0jgVode2Dzkm4+HKHmfOYsQeC07Mu6wZw9raNYqFjTcfh0ajFpLIT3j2YqOJE2jy
+KbcveJcy2NiOiUl13exIZuBkZm0wEVbvgVX1PlgL3GJqnbU/Q+maRTb8FBoQVsOd
+GIm7U/phU91qR+00SkOcp2LgHCCNKrmHXgiBNYBbInNIp6ze3bFvfKTRFn8WdY9v
+Z7vNfKar8rt90mpjYG9qMhmvh4E9icfp3wRUtOwyi7VVtVTTUq0iFTe2C0m0v6KW
+XcDwwwaTbl79BOqOH3Gp1flS2ECBsyiZAg0EY2N8xQEQAMWcyZbpxEyefX4JTszG
+ocpz8C8yqvZJQUfoDK5AecQWR7OegPkIqwJcHEH5cz+MduklXNQdra/snn6pxGig
+At3xCwfzRTH/aYXdjcjnma1elzZSTgk6Maw4zR/W9wea2DcUtMCcsys0gviN/VUe
+Aqt+5pmhy2PlEWfJG+Mzyrqgz3Q8hRyAJAKONAwNhs1A4ZqQX/6iuCkJbH1CBeoW
++c+5qJHYEXsx25qR1yiKOFo5b90QOcwaebUq+xKQRlnESn75FTgDjDfDm9BqrHcn
+Tv79kOuIN5vhz4BCsuo5QbNu4RGrs/1VSTPvMf5AN7xs9pYNMAEde7pSF1Ps3B5p
+CE6iUw9L53ytV4iJQKXpzG29LofUu65YQjIXPgK7NbBO7FUHA41YbSfoWiOAjfMh
+iE025YM2+RPQh/Nrc3PqBj4h21ycT+d8eEXKfc/okbVFFE9dKS1hUwKgSrs7baOG
+CBZdpiB+t3jWrr8UrteALab7v0rndco3QKOe9U3f+Gm3MdgLK1TGiRgpdyiIXEel
+J7zhsdoYEvaKMgUOjhf+COdlf8b9ITg93mDKe8h0OcpirCXw4O2ma3sklabzZKZf
+CPhhja6Ro5gmO5pxaLau+esQWNrjEikynNIs+GRphtcFsVVH+ww26mR0nI65Llgv
+kb4+DrbDGSPP6R/C2q/LMLM1ABEBAAG0ME1pY2hhbCBOb3dhayAoQ29kZS1TaWdu
+aW5nIEtleSkgPG1ub3dha0Bpc2Mub3JnPokCTgQTAQoAOBYhBNmczq+Hl0cBTwON
+YxguI1eUYu+qBQJjY3zFAhsDBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEBgu
+I1eUYu+q9IAP/j/GGneuvjwbXdATiQAmkiFlOxjs+SsO/hgA/mmWcm+Kpg4cAlbP
+C2xEDa6biJyZ8TmLZEqPNrRm/umiisC8JnIJpIbInn42n4aDCRDW35lrYGdnP1Ft
+fexnEOWAJBDRVvh9OnfRfvf+HLFfLFl40b/15YzkTYGIfrMR9y8zalkzXxsVNsyr
+9Eq2pmYR7BT2z8d/9SAVuh8D3qgUylIgcFcCFJodsrI4zJSpIMfMntwVsZxDlis8
+JVFN8/pfhuBBe6vjqX/cGJnj6OL3T12jvvniv13W3rar2Ocm6XA9j1t5TZNhKqAy
+azAKu52NtdJjh25B6C/H+haXAX1eduCCE74uSarqS3F1wf6JI3p8fnWzk4hZNzxp
+nZjIk3vrHNjE4jXTZosXCf5DoVRfMpNbxj3YEnXV+kNZQRYPPatUPgFYbxz91hbN
+tHyCiy0GmTyf0QId8LTc0y9mPtP9QureJJ6rL8lt7pvXyrYglqhxDgRhJIGKMKdw
+0bQtTEF4tyNzC4/sg4/omAGH66clhXlqMmuUjHSUiQyA4LL1mJl63Q+bwqXX4B8t
+898tSUmb4Jmg3jLZ3Z9Hl7H8Sp3yYPOLzb2YUF6w3xFsUrNNzVxHFo8tAtEhtEfX
+D+ypkowZq8g41WqMlOBrrzQFuExUSXckH2Cn97lV6lkBoueqxP+Zv0bbmQINBGNj
+qIkBEADDw/CKszyuFKpVp4Z26rKJ3ooOlp8p9a+fmfuknPtMjJMSX8xK8pOlK739
+K83yvDRUidT4+R9IAUKM7TqGA0hoPZmZQLiK0YLlAAXufKxO9IsDZI/7DuF2d8fu
+usKQfS4oJC/IbzOAVwgwodnvKhttLWutT09GxiHrnfVPu6Uf4A+GWtrcTIWhXuxE
+m7+16ToxBOTLtQ3hh79/RndUuM0ldKRRzJUzASGIPmdQJDLCKgSSeaGjZAdq6gkl
+qT/K/R8eoLWSOaBRq8lBE1k7Tq4nSwthMHtCQq4+vxFWH3VF9hwy6ixccROPqt9s
+fNfJK3KF4KGhfejMuVn/Lxp1v+Ne2DsdnVofFakAbBMpMyauzAyXPncYSfFhzLBD
+kkn7THkfRznmHD8ux89kV534EyqYLjAy8AAD6zNc3tSYgfC0UUw7yz05Sl/eV9Xc
+pbezu2ipONlXko8jpCQiiHck599cy+StrjjYPwcHF5m8uUlNnzHoUj8qsoK5SA8u
+RnTW2I4DFbL0+x8eL7gmNQYFdMaA4azogtaTFWgPL2jPJ3B+/bUfHDZflvR0FB5+
+OD/QHsDv4SB6uX8TOhGbFsHpt7E0scb2U9B8gQeQQJZ3jmcIRp+K18mjYh/ErDFW
+23ixBe7h3tn2MGUTOhv1ibOYDE3GYBuGLQiom6yhCs8zrneuAQARAQABtDFXbG9k
+ZWsgV2VuY2VsIChDb2RlLVNpZ25pbmcgS2V5KSA8d2xvZGVrQGlzYy5vcmc+iQJO
+BBMBCgA4FiEEAlmjO19aOkRmzzRcel4ITKylGIQFAmNjqIkCGwMFCwkIBwMFFQoJ
+CAsFFgIDAQACHgECF4AACgkQel4ITKylGIRk9g//XrvOYy9zQkpo4Dkol8yLxr99
+Dq9Ur2v8F5Ba4za4QdUxeYrlq8J827mkUqMtnlyb/+3zSMy2I6HAI8QxlDZL5K0g
+Gm7iLrwVTM8nAQiNU5vAe4D6PeO5ATBEvRdAUTQGz4xeaTrUXbmNUSC1dZEPvH1z
+Fa/Z1WZoy9GLeuWDXix6OXTP8FlQWUTL4/ILLtfJDsWCCX7efkyfnvad8Ye2NfU9
+tBjRX5QQ0Dpvgpr8/7El44XcmaHxPWEiq8X2p/d6j3nU/7LspUXRu3ptu5Q2RqMM
+iRDZme2c8zieHETpC7m5sshzGxRtT5jWEtZ6V37On5DNTObvXCiaGV95qgiHi5VG
+s3MFD3QSo1jJI951k68UM8V+OnzbJGN7TezZ3fTn5Pwdd4C4035QMl0E5NXCcXc8
+9d+3DeFmewRRGCaOKPuO/jFPLWcwMlQqp5tkNx8LpqEZfD7/t6FrSvDUsUDU8Rn0
+TQILnUZioO68HmeuJbhKaUCMuZGjBIbBqviiufFRiJuEFOVKADQ1u/P5ct/0T/gE
+JAho3aubzdYMH5DLsaw03W5KfOjeTLW10zSmSK65wnR6fdwlo5l/Sg6Z63QXD+/H
+/OIFgzviJkyoh6MkH55z2K8BDWbhOmaUBjNAcQEXV1KyHeLDkQ+TJfLjctv4KIpv
+D7i6kNIp1b6OSdDS9W+ZAg0EY2OzdwEQAMRWPO237ohaXNpKO+dw1qkfOYYisiTQ
+yfkT7BG0Xvu8jxeOdRuvUzzplgOfwWhOQkyEEXd205/PpwReeeRwhiu0BDSrzYGM
+KZdw9Bw4enoaOinf5WTqM76mc5WUYfvDJIiHies+ANxj4EqTzvSif9hxvvzrbKYV
+lHdaGtLm40D6yZSzDEe3X49DmEABM4g/Bs7NfVJcJ3LtLo6qbLy2tKEgNPW+VN/s
+harufucxnH5HM6BUUOGZx8L04UCNJu+jvZ0zjLc5DqubNO1526kZclAo94DfTkb+
+ir9nxKn7RkdcseibeYPdeIh3le6aU6M0KhTJs3RCxaQF9At08Vrrkh+wkK2Jr5QW
+bs8cHpEJ+Q7BwDuAQetFi94eq7Sswh4mjhJ6ZnFCx8v9EbQnvL76afMbhZOezpaQ
+aAwXVuIio2fsJpHfxWnXb93H1QKiOQdBZZLQGowcFQCqAWg7h2FwWWbKMV1smGHr
+/28tLZtk/4aSCd9cZ9+nofFPPemPLbYwnBECIZN21QKZ2oBXKxb3hchy4EBTKWtC
+G/fbTsjSfTCUpMNZ57HO3rGXchjSdIf+tTGJpAqWkTcXuhWXBMWPK6/2REk/DKis
+XHugHg9R9hqGs2DaMpGh5NrOLly9+0dsjU15iTQucXbCS9895bRtmDjIN8dLSo9H
+6DDw4yO7SHTlABEBAAG0NE1hcmNpbiBHb2R6aW5hIChDb2RlLVNpZ25pbmcgS2V5
+KSA8bWdvZHppbmFAaXNjLm9yZz6JAk4EEwEKADgWIQQJCioHkj+SW1dngDpC5d94
+yDJx2wUCY2OzdwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRBC5d94yDJx
+29U0D/41C8WaGEphQW1N5lT/1284qiPuz3w3iSciAAoAe8iHUGBcSNpAWQmWvWXI
+buKb92Gtt8JtSOHwQj8qiHjqRsUu02t/tEgQMQUq6p2jqbxODJfHR8oMFMMB0i0I
+RgKtEQeq5wRJpVtH+zIFSl9PorsJtHHfhVbqxvE/axcNKa+WaqZdHuKMqADupQEw
+6rD7yYVX6YPiHxMhba2AAAoHT/3VpHC0JidZ5BWGwkfnGbV1/7O91GHfJx6KN/AK
+DKb5hFl4TrieDLJzphBWg0y4FJ4K7WSIKvcT2cLel9f9pHV6ysqSZWkCbkjkaVIi
+LyoA0o7l263WU0D5oG2ihW6Pa2YrWHDDjfTem+kOEFsMjN+Gw74I4KWUBtldfnHK
+A8TyeviKkVok1lwDAoJ3LJi/bcyCLgBZLInOU31mQ7mIXq1ENCOIvQvaG0Lwdt59
+sBI8sknHkt+54t/VCaKbWSBOzgGur6EDf9WtPHWvHNCKEleDiHCELdhRYYtENO7T
+vTv6Fq6Lh26dor26LnARLPvGLAKwONJ0vlTEG8IyoD5AHz9MwdXYgzh8wIvc/HtD
+/0FlQGLd0WYVI6UjZfPxHOZAzARJKXLJMqiSn8hnO8v6JZaUcOF0yRKTKtzqsjzU
+v9TubCGdQAaCSCaD2fmA0BEs/FpOnZ8P1fXMpcHGEtMV0qc0wZkCDQRjY7/GARAA
+ubCCHkdiMblMA9ZlcOVN1Wep7TuYxQouATTb+73iHDQRNIU7DvluHoSq5zJe1Qst
+zjTmtlkr2dyI5JnBexUEKrw2X7gPXfLaXY01gLLB/Jn8tU9VxPqBybxmjmEdP58B
+I7BwmCyMYNqDuvPSfTMlogH/pF35Al+c8UbOfDEQqxSO2nKPNa4T5ZoVxvMxV4gn
+hEJPv8Xte/wiE+CxxbmO2we6rwJjWe7O3T0mNmqvpO8iIsLlQnwTFD5L1huywPc0
+UDHK0nl8k2lkue2buaOiancLatXt/i+L1DIimCgZwOt3DlVLURH5lz5ALXE/fn+5
+wKkp+XVyNTAEFhSGifgBDYFw3nZeRTU7unMsRssL8SjuwPWoCcRI/3VE08xCuXc+
+h6NpGfeJjLRgUSSBF+958djY320TcXaRLrqRhjcJ34dBsDYsRSC15nnq2JU6Vj5t
+rJL9qOdwVAFwKeAfROUULcy/LHZ3QgKLN5jOfdqYzE2KHk1+VANttRPTG34i6uq6
+yzCFFYadwST22+QWvxh2ohYj2INvvrzRf3lVxssWyb4USB0JPajgnGeNY/hSYfDa
+KArqOr9S+3q7h0v4RgoPxDRFIC8v/10W4wPC7R3wj0m/1WHkSm951Wtzq3V84uCF
+LLhx2ByNpnJFRFqklonAH3WHUIeYcdXAsTeunrGU/XsAEQEAAbQuR3JlZyBDaG91
+bGVzIChDb2RlLVNpZ25pbmcgS2V5KSA8Z3JlZ0Bpc2Mub3JnPokCTgQTAQoAOBYh
+BJWA1r8syA8eO7ESUt6rkdVLE8m4BQJjY7/GAhsDBQsJCAcDBRUKCQgLBRYCAwEA
+Ah4BAheAAAoJEN6rkdVLE8m42PwP/RFmUzgsoM23Z/NQ2AacCFTmHweEllkmf+25
+3hP80BuSHKsdzlmllFux+xbKZEpQK0nL3fqW8yyv69WmsoKZPpZJxmQ6bwUbtXC7
+rHkt5gfOXiTaxDBmgO2dcnDsKLb+bEQ7C5hay1P8rOvf13a4UZeTP37gRGmMr38+
+LvADIspIxBdSvFa7Hb4HKG4VVDai8jaPCF0q8daEWMJxyKSfOQBtSVVAzjLcGrYR
+bCPDAI1DEASyQOru52WREe4vJCwSaq9dZyGhaWcnyTVQO8bsSLxu7cUVxA3SOheQ
+izYKkYNbaBDmWlZxLYFsTUf5izEYdW5BwHaowmw22hSspFod+c37BoY/ePfkR5iQ
+YuEff/unyqvdHMDqIXWZqpAi5o5hW3jdCd7ZL5T0WWjz4CQ8eko1ZYYnYzZlDrge
+F0veW8+lzHBLx3Ad8HyVGwtRe+VV1V0AZ0lpWMtxo02ZDRtqNDqPqVfLT5P87ZPv
+r5GhKtedgrjwY2clgmCT0xgAKNxi2SC+c/vI5PRkIoqwbTiryLIYq8tl6T1k6AMY
+eN1ZNQR7eNEXpIvYRD/BZw7IWKkCRaKwfDVhUHCm0ikylwdLXIfEEEA5mu2LJeZh
+vCddhks0S8+lRyWR/3okurF6rlloNtM1pslceh2AMDwfs3fORhYJxFsV7O7fyRnD
+NS93fq56mQINBGNj8P4BEADXK//p0lWEUNUYirsm6BUyUXqPlPrpVTdPB1tJPj1o
+zgeMKFOpYRPU1IZF1G6pbKD09gL6y19LehQYx1a57PF7kCx2ZvvcFN24EHto1H1p
+Ti48dZ7KyyEO1rBeLY5Zjgz6YvQZcSH3cd6cTrAo7hPIAjtgSTWp04FjtYJqf+tT
+gf+9ZWY+i4nQ6/Q5Z5NUd8jsOcOoFDsmY6Fds+lzn0aZSg2yfd8fnX5QFOIwDv66
+aM25q2kvkrX0wtvSQbulC8x5g6fIB3xEL6MWbXcEBYkBMW5Cnw/Kmyj7lJwVwvEO
+FFhKaOH/d2LG3rM66gl048aJYLhEJyFSyooBynXs8S/NLDgca94Bvb54FPX8LC3p
+lqJRLxhdkha5NLcUYiHOq/L7LWdThh5rRAy87Ggog8TVza118K3oiYujlyVEzLhB
+NVMT8x5kl15YknVgOKJAv9j28bSZihHrS7aga1BtYFD8yA9MuuDaHARV6YmThkdg
+OEz/PNECjsxCLcT5Bbthzg6Jg1qo3Unyeup0UbyX4zxSphCVmerDmMYddLjJ/ydc
+1uxyn4IPINBSx2sAPuUIymhVC29MB6N+SnB37/poTvSsIH15Vg264OVdaervIpuC
+W3eUANr7zrdO85nc1CTWGhugFwccXv9nyxAt8zUF/ci17p1/mLpy9K3LqlStVI9j
+MwARAQABtDBDYXRoeSBBbG1vbmQgKENvZGUtU2lnbmluZyBLZXkpIDxjYXRoeWFA
+aXNjLm9yZz6JAk4EEwEKADgWIQT8h0w+P+hncHCscb617/asfhrd+AUCY2Pw/gIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRC17/asfhrd+HM6D/9KD/n245Fq
+jVzew92lJtufAxAFkTA5WO6fXweMlUeqMOub4vpVMLPLoFe5TzWbJMtF0m/P5+aU
+YbcvZBWFHsrnwTgA55c1VrhggLOxpw4EU0TvBdwrO7PFOYc2WznaMG+mJdqw+uNM
+yK+G44aIaC6rvi3ILSo5HPnbgQWHs39QIRLLcUjtqvavQQeyYAl0zrvNI9Xrs/Nf
+eE6PS4hIXg90A9VJRhay18w9hA+STb+xmK+3oSwP1ayLqqQ43OnV/pExSHBsjBQk
+4p1nIPlRFL30lGp/o2MoBsRvQM1tELpgBTk1LaTHzuKEpOskrWU37xu0QgEtj7YE
+r0X+GGBxgJuUzqSyLsaDgH1sEDqE+AthFfv2dxDadcXM2cdch9y3OyuSMo89aWGc
+mEVyesjYoV40tDCG73qLtfehhV/iARDMCfnZGyGYIZdDBL+tZTNeLKVDIUi/R3x9
+OmpEl8ZuCuYltyEsJnCF/rQBVMgcTOmsMu6CMx+qT3kC8iGtHqkUT2ufpKISahTn
+e329FQjClEWwBHkr0T4K80Z0REjSo6UBtio73IOCxXe0RqO37L/qgo8xKZbLxy86
+857PRWJhgbw169FJ2kR5p+M5d/g/MUeYnigvWlORW5LyrFg6RnZ1ZbULZI80QhHN
+aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8NpkCDQRkSjCrARAApLUMHAbmxUMWLgDQ
+apRZBwWXriEyIVqA/SIy1PyWPPFXqs3LZ5Kn5Gw1WO8PfzkPZNtccGmNLjujIoRB
+qR41nV5zxcpS896SujBoYl80A4F4v9Op9i2pFeI9r9acFcUDjbGWBqNro4EfRcJN
+Ctkd9+pl3TUvFX06QCTxmmHy3M81SW3b4NWI+jia1cKjCd+qBFBgKWdjSMBeVTBC
+R9eKqsBQ1UJql2bRzc8pReS+TYCeEbhaOCvUCCKCwGtsSUOW726iNB/4zR4OOuQV
+B9ORufwed+E/RXa8N08/l5O96uXG0krJtOVm0/qQcXOaKxiDo6djnAgCdjFK5zaj
+7594wqbI7de58alWb/egqIhjBTgk+/cO+epZ05qx5SoJZL7ny2ottrfS2cBqP4g1
+SIt1sYl9ImHmJkNrNDy0s25nE9Nga6OfRqVbwnwot4ouTGwj0oZsCjw+gWjDdztH
+1fUWSnlA8jaX9/RZG2wKt9dI+Tp/U4d5dyTb8lIIzzgtAzDmDfPxwwT0rxAAL13A
+gDkJ0AzXA4WTOxb/JE2yfCz//kt7n8SYM//LixL4VAB7e/wnfZBhTq0OFpaPjFU0
+h/k0dc40AqcUuK3lSSjQr3KTzRHtjz8qtN4DFSuyZac83QSVtWE1rFKjS8bl3XHC
+kFFRJ2dMt2WRSkLOYNiTGbYLvmEAEQEAAbQwQW5kcmVpIFBhdmVsIChDb2RlLVNp
+Z25pbmcgS2V5KSA8YW5kcmVpQGlzYy5vcmc+iQJOBBMBCgA4FiEE2mo1COZypJ3T
+gq/ZW49NkbiO2QkFAmRKMKsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ
+W49NkbiO2QnQZw//XCpeqT0z/sqtu4FYWwYLz1OvWqhe+uA45f9BccnNSVkGFa7w
+3hlLQC/FLUIx2cVy9AluJBP29iQge/bCcXnzo/QvCbhe/4lCTxhr7nsBe1bWpuNI
+4Pl+cQxZQBwcz74zZ1jjaaQOqm3XtdZxeKNfCQmNvz389UZEk2m8K6qJD23fy20V
+n5Y2C502UuP3MitbYKBxBSbs+Auwy1evz/prQ9VeD4Nv3Zr+jWbWFW+dSDC8jkrX
+cGdwWrUQ51QD8VBB9lPWPGY6yTbRmacr4AlVSo2DAfyjHRrGHigRF/VAD5p1+u2g
+3UFLJaEyujfzwU1kG4+zQCWZ2W2UBOekklq/yefxEY5vU1/Lad7vQhBmogQNF21T
+FvLUE6ez7XNsdMZStDPiT8OoTyFZYLRM4yw5rWKw+1mICBv7NV82YD/8hoMoZPyX
+2tNRTXv2MZ6qD++0dMCIZNEyFTB344srvQSyJ7K7vwxulc7iFWngRA8oe6JkAhH4
+B0yNq1FJm6jIL41S2FmnDL3DlfAdKWapBqzgqkv+X5DQBaTlG9a4BcSsdMJgU/Yx
+dD03YsKhDtEWTqBmmEamR1K1CgCC3mOJfsHB5z+Qhdraz2hMr00EQrD5lnpLLpcF
+rYWoilvVlRy7Y7U5wfhY4074L2ZfB+yElKsvtfGKJX/8g+eJdeRuII+hjEc=
+=NX7P
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/debian/usr.sbin.kea-ctrl-agent b/debian/usr.sbin.kea-ctrl-agent
new file mode 100644
index 0000000..daef478
--- /dev/null
+++ b/debian/usr.sbin.kea-ctrl-agent
@@ -0,0 +1,32 @@
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile kea-ctrl-agent /usr/sbin/kea-ctrl-agent {
+  include <abstractions/base>
+
+  network inet stream,
+  network inet6 stream,
+
+  /etc/kea/ r,
+  /etc/kea/** r,
+  /usr/sbin/kea-ctrl-agent mr,
+
+  owner /run/kea/kea-ctrl-agent.kea-ctrl-agent.pid rw,
+  owner /run/lock/kea/logger_lockfile rwk,
+
+  # Control sockets
+  # Before LP: #1863100, these were in /tmp. For compatibility, let's keep both
+  # locations
+  owner /{tmp,run/kea}/kea-ddns-ctrl-socket rw,
+  owner /{tmp,run/kea}/kea4-ctrl-socket rw,
+  owner /{tmp,run/kea}/kea6-ctrl-socket rw,
+
+  owner /var/log/kea/kea-ctrl-agent.log rw,
+  owner /var/log/kea/kea-ctrl-agent.log.[0-9]* rw,
+  owner /var/log/kea/kea-ctrl-agent.log.lock rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.kea-ctrl-agent>
+
+}
diff --git a/debian/usr.sbin.kea-dhcp-ddns b/debian/usr.sbin.kea-dhcp-ddns
new file mode 100644
index 0000000..cb29b68
--- /dev/null
+++ b/debian/usr.sbin.kea-dhcp-ddns
@@ -0,0 +1,33 @@
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile kea-dhcp-ddns /usr/sbin/kea-dhcp-ddns {
+  include <abstractions/base>
+  include <abstractions/nameservice>
+  include <abstractions/openssl>
+
+  network inet dgram,
+  network netlink raw,
+
+  /etc/kea/ r,
+  /etc/kea/** r,
+  /usr/sbin/kea-dhcp-ddns mr,
+
+  owner /run/kea/kea-dhcp-ddns.kea-dhcp-ddns.pid rw,
+  owner /run/lock/kea/logger_lockfile rwk,
+  owner /run/kea/logger_lockfile rwk,
+
+  # Control sockets
+  # Before LP: #1863100, these were in /tmp. For compatibility, let's keep both
+  # locations
+  owner /{tmp,run/kea}/kea-ddns-ctrl-socket w,
+  owner /{tmp,run/kea}/kea-ddns-ctrl-socket.lock rwk,
+
+  owner /var/log/kea/kea-ddns.log rw,
+  owner /var/log/kea/kea-ddns.log.[0-9]* rw,
+  owner /var/log/kea/kea-ddns.log.lock rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.kea-dhcp-ddns>
+}
diff --git a/debian/usr.sbin.kea-dhcp4 b/debian/usr.sbin.kea-dhcp4
new file mode 100644
index 0000000..20d2c82
--- /dev/null
+++ b/debian/usr.sbin.kea-dhcp4
@@ -0,0 +1,47 @@
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile kea-dhcp4 /usr/sbin/kea-dhcp4 {
+  include <abstractions/base>
+  include <abstractions/nameservice>
+
+  # for MySQL access, localhost
+  include <abstractions/mysql>
+  include <abstractions/openssl>
+
+  capability net_bind_service,
+  capability net_raw,
+
+  network inet dgram,
+  network inet stream,
+  network netlink raw,
+  network packet raw,
+
+  /etc/gss/mech.d/ r,
+  /etc/gss/mech.d/* r,
+
+  /etc/kea/ r,
+  /etc/kea/** r,
+  /usr/sbin/kea-dhcp4 mr,
+  /usr/sbin/kea-lfc Px,
+
+  owner /run/kea/kea-dhcp4.kea-dhcp4.pid rw,
+  owner /run/lock/kea/logger_lockfile rwk,
+
+  # Control sockets
+  # Before LP: #1863100, these were in /tmp. For compatibility, let's keep both
+  # locations
+  owner /{tmp,run/kea}/kea4-ctrl-socket w,
+  owner /{tmp,run/kea}/kea4-ctrl-socket.lock rwk,
+
+  # this includes .completed, .output, .pid, .[0-9]
+  owner /var/lib/kea/kea-leases4.csv* rw,
+
+  owner /var/log/kea/kea-dhcp4.log rw,
+  owner /var/log/kea/kea-dhcp4.log.[0-9]* rw,
+  owner /var/log/kea/kea-dhcp4.log.lock rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.kea-dhcp4>
+}
diff --git a/debian/usr.sbin.kea-dhcp6 b/debian/usr.sbin.kea-dhcp6
new file mode 100644
index 0000000..d8aca09
--- /dev/null
+++ b/debian/usr.sbin.kea-dhcp6
@@ -0,0 +1,46 @@
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile kea-dhcp6 /usr/sbin/kea-dhcp6 {
+  include <abstractions/base>
+  include <abstractions/nameservice>
+
+  # for MySQL access, localhost
+  include <abstractions/mysql>
+  include <abstractions/openssl>
+
+  network inet dgram,
+  network inet stream,
+  network netlink raw,
+  network packet raw,
+
+  /etc/gss/mech.d/ r,
+  /etc/gss/mech.d/* r,
+
+  /etc/kea/ r,
+  /etc/kea/** r,
+  /usr/sbin/kea-dhcp6 mr,
+  /usr/sbin/kea-lfc Px,
+
+  owner /run/kea/kea-dhcp6.kea-dhcp6.pid rw,
+  owner /run/lock/kea/logger_lockfile rwk,
+
+  # Control sockets
+  # Before LP: #1863100, these were in /tmp. For compatibility, let's keep both
+  # locations
+  owner /{tmp,run/kea}/kea6-ctrl-socket w,
+  owner /{tmp,run/kea}/kea6-ctrl-socket.lock rwk,
+
+  owner /var/lib/kea/kea-dhcp6-serverid rw,
+
+  # this includes .completed, .output, .pid, .[0-9]
+  owner /var/lib/kea/kea-leases6.csv* rw,
+
+  owner /var/log/kea/kea-dhcp6.log rw,
+  owner /var/log/kea/kea-dhcp6.log.[0-9]* rw,
+  owner /var/log/kea/kea-dhcp6.log.lock rwk,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.kea-dhcp6>
+}
diff --git a/debian/usr.sbin.kea-lfc b/debian/usr.sbin.kea-lfc
new file mode 100644
index 0000000..ae165fa
--- /dev/null
+++ b/debian/usr.sbin.kea-lfc
@@ -0,0 +1,33 @@
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile kea-lfc /usr/sbin/kea-lfc {
+  include <abstractions/base>
+  include <abstractions/nameservice>
+
+  network inet dgram,
+
+  /usr/sbin/kea-lfc mr,
+
+  owner /run/kea/logger_lockfile rwk,
+  owner /run/lock/kea/logger_lockfile rw,
+
+  # Control sockets
+  # Before LP: #1863100, these were in /tmp. For compatibility, let's keep both
+  # locations
+  owner /{tmp,run/kea}/kea4-ctrl-socket.lock r,
+  owner /{tmp,run/kea}/kea6-ctrl-socket.lock r,
+
+  # this includes .completed, .output, .pid, .[0-9]
+  owner /var/lib/kea/kea-leases4.csv* rw,
+
+  # this includes .completed, .output, .pid, .[0-9]
+  owner /var/lib/kea/kea-leases6.csv* rw,
+
+  owner /var/log/kea/kea-dhcp4.log w,
+  owner /var/log/kea/kea-dhcp6.log w,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.kea-lfc>
+}
diff --git a/debian/watch b/debian/watch
new file mode 100644
index 0000000..7e174c3
--- /dev/null
+++ b/debian/watch
@@ -0,0 +1,8 @@
+version=4
+opts=\
+compression=xz,\
+uversionmangle=s/((rc|b)\d+)$/~$1/;s/-P(\d+)$/.P$1/,\
+dirversionmangle=s/((rc|b)\d+)$/~$1/;s/-P(\d+)$/.P$1/,\
+dversionmangle=s/\.dfsg\./-/;s/[\.\+]dfsg$//,\
+pgpsigurlmangle=s/$/.asc/ \
+ https://ftp.isc.org/isc/kea/(\d+\.\d*[02468]+\.\d+)/kea-(.+)\.tar\.gz
diff --git a/debian/watch.include-odd-versions b/debian/watch.include-odd-versions
new file mode 100644
index 0000000..be33fe3
--- /dev/null
+++ b/debian/watch.include-odd-versions
@@ -0,0 +1,8 @@
+version=4
+opts=\
+compression=xz,\
+uversionmangle=s/((rc|b)\d+)$/~$1/;s/-P(\d+)$/.P$1/,\
+dirversionmangle=s/((rc|b)\d+)$/~$1/;s/-P(\d+)$/.P$1/,\
+dversionmangle=s/\.dfsg\./-/;s/[\.\+]dfsg$//,\
+pgpsigurlmangle=s/$/.asc/ \
+ https://ftp.isc.org/isc/kea/(\d+\.\d+\.\d+)/kea-(.+)\.tar\.gz