diff options
Diffstat (limited to '')
49 files changed, 4249 insertions, 0 deletions
diff --git a/debian/.gitlab-ci.yml b/debian/.gitlab-ci.yml new file mode 100644 index 0000000..f0c060e --- /dev/null +++ b/debian/.gitlab-ci.yml @@ -0,0 +1,9 @@ +--- +include: + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml + +# Skip the reprotest job as long as it is run as root due to problems with +# chrony system tests. +variables: + SALSA_CI_DISABLE_REPROTEST: 1 diff --git a/debian/NEWS b/debian/NEWS new file mode 100644 index 0000000..fe7e4b9 --- /dev/null +++ b/debian/NEWS @@ -0,0 +1,70 @@ +chrony (4.1~pre1-1) experimental; urgency=medium + + Starting with chrony 4.0, it is possible to specify NTP sources in files + having the .sources suffix. In Debian, these files can be placed in + /etc/chrony/sources.d/ or any other directories specified by the 'sourcedir' + directive. + I would like to draw your attention that with chrony 4.1, each line of a + source file *must* be terminated by a trailing newline. Failing that, the NTP + source(s) will be ignored. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 25 Apr 2021 12:44:09 +0200 + +chrony (3.4-2) unstable; urgency=medium + + To reduce the range of operations available to chronyd, and thereby decrease + the kernel attack surface, a system call filter is now active by default + wherever¹ possible. + Please, take into account that this change prevents the use of the + “mailonchange” directive in chrony.conf as the chronyd process will not be + allowed to fork and execute the sendmail binary. Therefore, it is fundamental + to disable the system call filter to continue using this directive! + + To do so, edit the /etc/default/chrony file and substitute the “-F -1” + parameter with “-F 0”. Restart chrony afterward. + + ¹Are currently excluded alpha, ia64, m68k, riscv64, sh4 and sparc64 + architectures due to lack of support in “libseccomp” and/or the Linux kernel. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 10 Feb 2019 18:44:22 +0100 + +chrony (2.2.1-1) unstable; urgency=medium + + In chrony versions before 2.2, the 'chrony.keys' file contained a command + key used for run-time configuration via the 'chronyc' command-line tool. + Starting from this version, support for this authentication method has been + dropped in favor of a Unix domain socket accessible only *locally* by root or + the _chrony system user. Consequently, if you refuse to use the 'chrony.keys' + file template provided by the maintainers when upgrading, please don’t forget + to manually remove the obsolete command key (ID 1) in the aforementioned file. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 07 Feb 2016 17:02:30 +0100 + +chrony (2.1.1-1) unstable; urgency=medium + + From this version, 'chronyd' will strictly act as an NTP client by default. If + you want it to serve time to other systems, please do so by configuring the + 'allow' directive. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 12 Oct 2015 19:12:39 +0200 + +chrony (1.31.1-1) unstable; urgency=medium + + From now on, we use the "hwclockfile" directive in /etc/chrony/chrony.conf. + Basically, it makes the detection of the standard (Local or UTC time) set + in /etc/adjtime — and used by the hardware clock — clearer compared to the + text processing method we used to use in the post install script to complete + the same task. Note that it overrides the "rtconutc" directive. + + Also, we now create the _chrony system user to which chronyd will drop root + privileges. For users already allowing chronyd to drop root privileges in + favor of the user configured by the "user" directive in + /etc/chrony/chrony.conf, your configuration will remain unchanged and will + still work as intended. + However, some users might use a custom init script to accomplish the same + task by invoking chronyd with the '-u' option. We advise you to drop this + option from your init script before upgrading, otherwise you’ll have to + readjust the owner of the /var/l{ib,og}/chrony directories (recursively) to + the user you configured in your init script. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 6 Sep 2015 22:14:54 +0200 diff --git a/debian/README.Debian b/debian/README.Debian new file mode 100644 index 0000000..2188ed9 --- /dev/null +++ b/debian/README.Debian @@ -0,0 +1,29 @@ +Chrony for Debian +----------------- + + Notes about Debian-specific changes: + + - Default chrony’s configuration files are located in the /etc/chrony directory. + It is filled by two important files: + → chrony.conf (configuration of the chronyd daemon, see man 5 chrony.conf + for further information) + + → chrony.keys (lists keys used for NTP packets authentication, see + the “keyfile” directive in the chrony.conf(5) man page) + + - We also provide /etc/ppp/ip-up.d/chrony and /etc/ppp/ip-down.d/chrony + to put chronyd online/offline depending on the PPP link status. + + - Since version 1.31.1-1, we create the _chrony system user to which chronyd + will drop root privileges on initialisation. For users already allowing + chronyd to drop root privileges in favor of the user configured by the "user" + directive in chrony.conf, your configuration will remain unchanged and will + still work as it did. However, if you don’t want to deviate from Debian’s + default configuration, delete or comment out the "user" directive in + chrony.conf and recursively change the owner of the /var/lib/chrony and + /var/log/chrony directories. For example: + + # sed -i 's/^user/#user/' /etc/chrony/chrony.conf + # chown -R _chrony:_chrony /var/l{ib,og}/chrony + + -- Vincent Blut <vincent.debian@free.fr> Fri, 01 Mar 2019 19:02:12 +0100 diff --git a/debian/changelog b/debian/changelog new file mode 100644 index 0000000..8474242 --- /dev/null +++ b/debian/changelog @@ -0,0 +1,2612 @@ +chrony (4.3-2+deb12u1) unstable; urgency=medium + + * debian/usr.sbin.chronyd: + - Modify the AppArmor profile to allow more gpsd socket names. This will + avoid the need for users to override the profile to let chronyd consume PPS + samples or serial time supplied by gpsd over a Unix-domain socket. + Thanks to Ryan Govostes for the report. (Closes: #1034519) + + -- Vincent Blut <vincent.debian@free.fr> Mon, 08 May 2023 22:05:00 +0200 + +chrony (4.3-2) unstable; urgency=medium + + * debian/control: + - Bump Standards-Version to 4.6.2 (no changes needed). + + * debian/copyright: + - Update copyright year for debian/*. + + * debian/.gitlab-ci.yml: + - Use the recommended syntax to skip a job. + + * debian/install: + - Install the chrony-wait.service systemd unit. + + * debian/postinst: + - Ensure that chronyd can read the /etc/chrony/chrony.keys file after + dropping root privileges. + + * debian/postrm: + - Remove the override for /etc/chrony/chrony.keys when purging chrony. + + * debian/rules: + - Do not enable nor start chrony-wait.service for the time being. + + * debian/tests/upstream-simulation-test-suite: + - Run each test only once. Running several iterations is no longer + relevant since we use a hard coded seed. + + [ Taylor Stearns ] + * debian/chrony.conf: + - Replace U+2019 with ASCII quote. (MR: !10) + + -- Vincent Blut <vincent.debian@free.fr> Fri, 27 Jan 2023 22:51:17 +0100 + +chrony (4.3-1) unstable; urgency=medium + + * Import upstream version 4.3: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/copyright: + - Update copyright years. + + [ Bastian Blank ] + * debian/chrony.service: + - Let systemd handle directories. (MR: !9) + + -- Vincent Blut <vincent.debian@free.fr> Wed, 31 Aug 2022 13:32:14 +0200 + +chrony (4.3~pre1-1) experimental; urgency=medium + + * Import upstream version 4.3-pre1: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/chrony.lintian-overrides: + - Update lintian override syntax. + + * debian/control: + - Bump Standards-Version to 4.6.1 (no changes needed). + + * debian/patches/*: + - Drop ensure_awk_commands_in_008-ntpera_test_return_an_integer.patch, + applied upstream. + - Refresh nm-dispatcher-dhcp_Move-server_dir-to-run.patch. + + * debian/tests/upstream-simulation-test-suite: + - Update clknetsim version. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 11 Aug 2022 14:12:25 +0200 + +chrony (4.2-2) unstable; urgency=medium + + * debian/usr.sbin.chronyd: + - Allow reading the chronyd configuration file that timemaster(8) + generates. Thanks to Michael Lestinsky for the report! (Closes: #1004745) + + -- Vincent Blut <vincent.debian@free.fr> Tue, 01 Feb 2022 20:42:35 +0100 + +chrony (4.2-1) unstable; urgency=medium + + * Import upstream version 4.2: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/chrony.service: + - Adopt upstream service unit hardening options. + + * debian/copyright: + - Update copyright years. + + * debian/patches/*: + - Drop patches applied upstream. + - Add ensure_awk_commands_in_008-ntpera_test_return_an_integer.patch + + * debian/test/upstream-simulation-test-suite: + - Update clknetsim version. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 13 Jan 2022 14:01:35 +0100 + +chrony (4.1-4) unstable; urgency=medium + + * debian/: + - Remove empty preinst maintainer script. + + * debian/chrony.lintian-overrides: + - Remove unused overrides. + + * debian/control: + - Bump Standards-Version to 4.6.0 (no changes needed). + + * debian/patches/*: + - Add fix-seccomp-filter-for-BINDTODEVICE-socket-option.patch. + (Closes: #995207) + + * debian/usr.sbin.chronyd: + - Add 'vim:syntax=apparmor' modline. + - Add feature ABI rule. Starting with AppArmor 3.0, policy needs to contain + an abi rule to indicate which feature abi the policy was developed under. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 07 Oct 2021 15:23:28 +0200 + +chrony (4.1-3) unstable; urgency=medium + + * Upload to unstable. + + * debian/patches/: + - Add allow-clone3-and-pread64-in-seccomp-filter.patch. + + * debian/tests/upstream-simulation-test-suite: + - Update clknetsim version. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 15 Aug 2021 15:08:56 +0200 + +chrony (4.1-2) experimental; urgency=medium + + * Merge branch 'debian/unstable' into 'debian/latest'. + + * debian/rules: + - Remove needless dh_auto_test override. + + [ Christian Ehrhardt ] + * debian/tests/helper-functions: + - Improve chronyd restart logic. While rendering the tests more readable, + this also fixes ntp-server-and-nts-auth test on Ubuntu. + + [ Debian Janitor ] + * debian/{control,chrony.maintscript}: + - Remove constraints unnecessary since stretch. + + -- Vincent Blut <vincent.debian@free.fr> Sat, 26 Jun 2021 17:16:45 +0200 + +chrony (4.1-1) experimental; urgency=medium + + * Import upstream version 4.1: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/copyright: + - Update copyright years. + + * debian/upstream/signing-key.asc: + - Update Miroslav Lichvar's key. + + * debian/watch: + - Add upstream version mangle to transform -pre to ~pre. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 14 May 2021 00:25:34 +0200 + +chrony (4.1~pre1-1) experimental; urgency=medium + + * Import upstream version 4.1-pre1: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/control: + - Now that the upstream system tests support 'ss', replace the net-tools + build-dependency by iproute2. + + * debian/NEWS: + - Mention that lines in *.sources files must be terminated by a trailing + newline. + + * debian/patches/: + - Drop allow-IP_TOS-socket-option-in-seccomp-filter.patch. Applied + upstream. + + * debian/postinst: + - Do not redirect 'chronyd -p' stderr to /dev/null. Not needed anymore. + + * debian/sources.d/README: + - Mention that lines in *.sources files must be terminated by a trailing + newline. + + * debian/tests/dynamically-add-source: + - Terminate the line in dummy-server.sources with the newline control + character. + + * debian/tests/fragmented-configuration: + - Do not redirect 'chronyd -p' stderr to /dev/null. Not needed anymore. + + * debian/tests/upstream-simulation-test-suite: + - Update clknetsim version. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 10 May 2021 18:56:53 +0200 + +chrony (4.0-8) unstable; urgency=medium + + * debian/patches/: + - Add allow-BINDTODEVICE-option-in-seccomp-filter.patch to enable support + for binding sockets to a device without having to disable the seccomp + filter. + - Add allow-getuid32-in-seccomp-filter.patch. Upstream found out that + getuid32() needed to be allowed in the seccomp filter to enable some NTS + operations on i686. This may affect other 32-bits architectures. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 13 May 2021 16:51:41 +0200 + +chrony (4.0-7) unstable; urgency=medium + + * debian/patches/: + - Add allow-IP_TOS-socket-option-in-seccomp-filter.patch to enable the use + of the 'dscp' directive. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 08 Apr 2021 16:21:16 +0200 + +chrony (4.0-6) unstable; urgency=medium + + * debian/tests/helper-functions: + - Instead of running 'systemctl restart chrony.service', use + __restart_chronyd() in the __no_system_clock_control() function. + - Run 'sleep 3' only if chronyd has successfully restarted. + + [ Christian Ehrhardt ] + * debian/tests/{dynamically-add-source,ntp-server-and-nts-auth}: + - Reduce default Ubuntu config to make space for testcase config. + + * debian/tests/helper-functions: + - Add more common functions and update some tests to use them. + - Wait after restarting chronyd. Without this, some tests break on Ubuntu by + checking state too early. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 21 Feb 2021 21:59:22 +0100 + +chrony (4.0-5) unstable; urgency=medium + + * Follow DEP-14 branch naming conventions: + master -> debian/latest + upstream -> upstream/latest + + * debian/chrony.service: + - Enable some hardening settings. + + * debian/control: + - Remove Joachim Wiedorn from the Uploaders field. This decision was taken + in agreement with him. Thanks a lot, Joachim, for your work on chrony and + for your benevolence when you handed me its maintenance. + - Point Vcs-Git to the debian/latest branch. + + * debian/dirs: + - Do not create the /etc/apparmor.d/force-complain directory. Not needed + anymore. + + * debian/postrm: + - Remove /run/chrony-dhcp on purge. + + * debian/preinst: + - Drop old migration code snippet. It was used to put the newly provided + AppArmor profile in complain mode when upgrading chrony to prevent + regressions this profile could have caused. (Closes: #905485) + + -- Vincent Blut <vincent.debian@free.fr> Thu, 04 Feb 2021 19:49:22 +0100 + +chrony (4.0-4) unstable; urgency=medium + + * debian/chrony.examples: + - Provide example configuration files. + + * debian/postinst: + - Run adduser unconditionally. + - Use 'chronyd -p' to check the whole configuration. + + * debian/tests/: + - Prevent dynamically-add-source and ntp-server-and-nts-auth tests from + failing on chronyd's preparation step. + - Don't pass 'set -u' to dynamically-add-source and + ntp-server-and-nts-auth scripts. + + * debian/tests/control: + - Mark dynamically-add-source as skippable. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 21 Jan 2021 20:02:39 +0100 + +chrony (4.0-3) unstable; urgency=medium + + * debian/: + - chronyd's configuration can now be fragmented. Please see + /etc/chrony/conf.d/README for more information. + - NTP sources can be specified in /etc/chrony/sources.d. Please see + /etc/chrony/sources.d/README for more information. + + * debian/chrony.conf: + - Include configuration files found in /etc/chrony/conf.d. + - Use NTP sources found in /etc/chrony/sources.d. + - Get TAI-UTC offset and leap seconds from the system tz database by using + the "leapsectz right/UTC" directive. This directive must be commented out + when using time sources serving leap-smeared time. (Closes: #974845) + - Add missing comment. + + * debian/chrony.default: + - Switch the seccomp filter to level 1. + + * debian/chrony.lintian-overrides: + - Override breakout-link. + + * debian/control: + - Add tzdata to the dependencies. + - Bump Standards-Version to 4.5.1 (no changes required). + + * debian/copyright: + - Update copyright year for debian/*. + + * debian/postinst: + - Use dpkg-statoverride to manage mode bits and ownership of + /var/l{ib,og}/chrony. + + * debian/postrm: + - Remove overrides for /var/l{ib,og}/chrony on purge. + + * debian/rules: + - Drop '--without-readline' option. GNU readline support has been dropped + upstream due to license incompatibility. + - Replace -F -1 by -F 1 in the sed invocation. + + * debian/tests/: + - Add fragmented-configuration autopkgtest. + - Add dynamically-add-source autopkgtest. + - Add ntp-server-and-nts-auth autopkgtest. + + * debian/tests/control: + - Mark ntp-server-and-nts-auth as skippable. + + * debian/tests/fragmented-configuration: + - Use another directive for the test since "leapsectz right/UTC" is now + used by default. + + * debian/tests/helper-functions: + - Add __no_system_clock_control() function. + + * debian/tests/upstream-simulation-test-suite: + - Always use the same seed to get deterministic results. + + * debian/upstream/metadata: + - Remove obsolete field Name. Thanks to Debian Janitor <janitor@jelmer.uk>. + + * debian/usr.sbin.chronyd: + - Make use of the @{run} variable. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 18 Jan 2021 21:58:52 +0100 + +chrony (4.0-2) unstable; urgency=medium + + * Merge branch 'experimental' into 'master'. + + * Upload to unstable. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 13 Oct 2020 15:59:33 +0200 + +chrony (4.0-1) experimental; urgency=medium + + * Import upstream version 4.0: + - This release adds support for the Network Time Security (NTS) + authentication mechanism (RFC 8915). + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 07 Oct 2020 19:14:51 +0200 + +chrony (4.0~pre4-2) experimental; urgency=medium + + * debian/postinst: + - Fix user and group ownership of "/var/lib/chrony" to allow chronyd + to write in it. This will also fix a regression in the 104-systemdirs + test. + + -- Vincent Blut <vincent.debian@free.fr> Sat, 03 Oct 2020 11:20:02 +0200 + +chrony (4.0~pre4-1) experimental; urgency=medium + + * Import upstream version 4.0-pre4: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * Merge branch 'master' into experimental. (Closes: #970421) + + * debian/chrony.conf: + - Use NTP sources from /run/chrony-dhcp. + - Save NTS keys and cookies in /var/lib/chrony/. + + * debian/chrony-dnssrv@.service: + - Update "chrony-helper" path. + + * debian/chrony.dhcp: + - Save NTP servers from DHCP to /run/chrony-dhcp/$interface.sources. + + * debian/chrony.lintian-overrides: + - Override executable-in-usr-lib for NetworkManager dispatcher scripts. + - Update NetworkManager dispatcher script name. + + * debian/chrony.ppp.ip-{down,up}: + - Update PID file path. + + * debian/chrony.service: + - Update PID file path. + - Do not run 'chrony-helper update-daemon' after starting chronyd. Not + needed anymore. + + * debian/control: + - Build-depend on libgnutls28-dev to support NTS. + - Build-depend on gnutls-bin for the test suite. + - Bump debhelper-compat to 13. + + * debian/copyright: + - Update copyright years. + + * debian/dirs: + - Remove var/log/chrony as it will be created automatically if it doesn’t + exist. + + * debian/if-{post-down,up}: + - Update PID file path. + + * debian/init: + - Update PID file path. + - Drop the unnecessary '--remove pidfile' option from the stop target. + - Do not run 'chrony-helper update-daemon' after starting chronyd. Not + needed anymore. + + * debian/install: + - Move "chrony-helper" to "/usr/libexec/chrony". + + * debian/links: + - Update source and destination filenames. + + * debian/patches/: + - Drop patches applied upstream. + - Add nm-dispatcher-dhcp_Move-server_dir-to-run.patch. + + * debian/postinst: + - Drop migration code from pre-Stretch. + - Migrate NTP sources obtained from DHCP to /run/chrony-dhcp on upgrade + from chrony < 4.0~pre4-1. + - Remove staled PID file when upgrading from chrony < 4.0~pre4-1. + + * debian/rules: + - Change the default PID file location from /run to /run/chrony. + - Drop dh_missing --fail-missing. This is the default in debhelper 13. + - Enable seccomp support by default on riscv64. + - Update NetworkManager dispatcher script name from 20-chrony to + 20-chrony-onoffline. + - Add DHCP NetworkManager dispatcher script to allow chronyd to use + NTP sources obtained from NM's internal DHCP client. + + * debian/tests/: + - Add some helper functions. Some tests will be updated thereafter + to use them. + + * debian/tests/time-sources-from-dhcp-servers: + - Adapt to the new way of using time sources from DHCP. + - Improve sed invocation. + + * debian/tests/upstream-simulation-test-suite: + - Update clknetsim version. + - Cosmetic changes. + + * debian/tests/upstream-system-tests: + - No need to stop systemd-timesyncd anymore since it is no more + co-installable with chrony anymore. + + * debian/usr.sbin.chronyd: + - Update PID file path. + - Add dac_override and dac_read_search capabilities to give "root" the + ability to write the PID file in /run/chrony/. + - Prefix flag definition by "flags=". + - Sort the capabilities. + - Grant CAP_NET_RAW capability to allow an NTP socket to be bound to a + device using the SO_BINDTODEVICE socket option on kernels before 5.7. + - Add comments regarding capabilities. + - Let chronyd create /var/l{ib,og}/chrony. + - Remove a superfluous rule. + - Allow reading of NTP sources in /run/chrony-dhcp/. + + * debian/watch: + - Make use of special strings. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 02 Oct 2020 21:21:08 +0200 + +chrony (3.5.1-1) unstable; urgency=medium + + * Import upstream version 3.5.1: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + - CVE-2020-14367: create new file when writing pidfile. + + * debian/chrony.lintian-overrides: + - Remove unused override. + + [ Ville Skyttä ] + * debian/chrony.conf: + - Comment spelling fix. (MR: !5) + + -- Vincent Blut <vincent.debian@free.fr> Thu, 20 Aug 2020 14:07:22 +0200 + +chrony (3.5-9) unstable; urgency=medium + + * debian/patches/: + - Add allow-some-*time64-syscalls-in-seccomp-filter.patch. Needed for + 32-bit architectures with new system calls using 64-bit time_t. + (LP: #1878005) + + * debian/tests/control: + - Add needs-internet restriction to the upstream-simulation-test-suite + test. + + [ Christian Ehrhardt ] + * debian/tests/upstream-simulation-test-suite: + - Skip if preparation steps fail. + - Make preparation steps more verbose. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 19 May 2020 16:42:18 +0200 + +chrony (3.5-8) unstable; urgency=medium + + * debian/postrm: + - Stop starting systemd-timesyncd in postrm. This is no longer relevant + since systemd-timesyncd is a standalone package declaring + Conflicts/Replaces/Provides: time-daemon. (Closes: #955773) + + [ Christian Ehrhardt ] + * debian/tests/upstream-system-tests: + - Stop chrony/systemd-timesynd before running these tests. (LP: #1870144) + + -- Vincent Blut <vincent.debian@free.fr> Sun, 05 Apr 2020 17:44:31 +0200 + +chrony (3.5-7) unstable; urgency=medium + + * debian/chrony.maintscript: + - Remove the /etc/NetworkManager/dispatcher.d/20-chrony conffile. + + * debian/control: + - Support seccomp facility on riscv64. It should be noted that the system + call filter will stay disabled by default on this architecture until + Linux >= 5.5 hits unstable. + - Bump libseccomp-dev build-dep to 2.4.3-1~ to provide seccomp facility on + riscv64. + - Break network-manager (<< 1.20.0-1~). Prior to this version, + NetworkManager would not look for dispatcher scripts into + /usr/lib/NetworkManager/dispatcher.d/. + + * debian/dirs: + - Create the usr/lib/NetworkManager/dispatcher.d subdirectories. + + * debian/links: + - Change the location of the NetworkManager dispatcher script. + + * debian/patches/: + - Add allow-renameat2-in-seccomp-filter.patch. Required as the riscv64 + architecture does not support the rename() and renameat() system calls. + + * debian/rules: + - Move the NetworkManager dispatcher script in + /usr/lib/NetworkManager/dispatcher.d/. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 17 Mar 2020 15:21:53 +0100 + +chrony (3.5-6) unstable; urgency=medium + + * debian/chrony.service: + - Don’t conflict with systemd-timesyncd.service. + A few users complain that chronyd does not start at boot. The way the + Conflict= directive works internally might cause both systemd-timesyncd + and chronyd to be inactive at boot. So by relying solely on the + disable-with-time-daemon.conf drop-in file provided by systemd, we should + get rid of this malfunction while still preventing these two time daemons + from being active at the same time. Kudos notably go to Santiago Vila for + the report and providing SSH access to a GCE instance where the issue was + reproducible and Michael Biebl for debugging. (Closes: #947936) + + * debian/control: + - Bump Standards-Version to 4.5.0 (no changes required). + - No need to explicitly conflict with ntp as it now provides time-daemon. + + * debian/copyright: + - Update copyright year for debian/*. + + * debian/patches/: + - Add allow-clock_adjtime-in-seccomp-filter.patch. + glibc 2.31 switched the adjtimex() function to the clock_adjtime + system call. + + * debian/tests/upstream-simulation-test-suite: + - Update clknetsim version. This new version supports glibc >= 2.31 headers. + (LP: #1866753) + + * debian/tests/control: + - Run the upstream-simulation-test-suite as root. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 10 Mar 2020 19:17:16 +0100 + +chrony (3.5-5) unstable; urgency=medium + + * debian/control: + - Bump standard-version to 4.4.1 (no change required). + + * debian/install: + - Install 50-chrony.list in /usr/lib/systemd/ntp-units.d. + + * debian/ntp-units.d/50-chrony.list: + - Allow timedated to interact with chronyd. + + * debian/patches/*: + - Cherry-pick upstream commits to better manage RTCs that don't support + interrupts. This fixes an issue exhibited when a specific upstream system + test is run on the Ubuntu CI. Thank to Christian Ehrhardt for working + with Miroslav Lichvar to address this problem. + + * debian/tests/control: + - Use @builddeps@ as a test dependency for upstream_system_tests. + + [ Christian Ehrhardt ] + * debian/tests/upstream-simulation-test-suite: + - Redirect stderr on make call to stdout. On some architectures (e.g. armhf) + the clksim tests compile but throw some warnings. (MR: !2) + + -- Vincent Blut <vincent.debian@free.fr> Sun, 22 Dec 2019 17:30:40 +0100 + +chrony (3.5-4) unstable; urgency=medium + + * debian/tests/control: + - Add @builddeps@ to the list of dependencies needed by the + upstream-simulation-test-suite test. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 30 Aug 2019 00:49:20 +0200 + +chrony (3.5-3) unstable; urgency=medium + + * debian/chrony.lintian-overrides: + - Override package-supports-alternative-init-but-no-init.d-script. This + is a false positive. chrony-dnssrv@.service isn’t a daemon but a oneshot + service, not started at boot, whose role is to lookup for _ntp._udp DNS SRV + records. + + * debian/chrony.service: + - Pull in time-sync.target and order chrony before it as recommended in + systemd.special(7). + + * debian/control: + - Bump standard-version to 4.4.0 (no changes required). + + * debian/.gitlab-ci.yml: + - Switch to standard Salsa Pipeline. + - Skip the reprotest job for as long as it is run as root due to problems + with chrony system tests. + + * debian/tests/*: + - Revamp the upstream-simulation-test-suite test. + - Adjust dpkg dependencies for upstream-simulation-test-suite. + - Adjust restrictions for upstream-simulation-test-suite. + - Introduce upstream-system-tests. Add a new set of tests for testing + basic chronyd functionality. Destructive tests are run in a virtual + machine. + - Add ethtool to the list of dependencies needed by + run_destructive_system_tests. + - exit 77 if upstream-simulation-test-suite is run on non-Linux and mark + the test as skippable. Thanks to Paul Gevers <elbrus@debian.org> for the + suggestion. + - Make artifacts() exit 1. Again, thanks to Paul Gevers. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 13 Aug 2019 17:57:47 +0200 + +chrony (3.5-2) unstable; urgency=medium + + * Merge branch “experimental” into “master”. + + * debian/chrony.dhcp: + - Fix shellcheck warnings. Patch imported from Fedora. + + * debian/chrony-helper: + - Fix shellcheck warnings. Patch imported from Fedora. + + * debian/clean: + - Drop obsolete entries. + + * debian/copyright: + - Update copyright years. + - Update copyright holder for the configure script. + + * debian/patches/*: + - Add update_processing_of_packet_log.patch. This fixes a regression in + the simulation tests exhibited by the recent clknetsim changes. + (Closes: #931181) + + * debian/rules: + - Use dh_missing --fail-missing. + + * debian/tests/upstream-simulation-test-suite: + - Use a known good clknetsim commit. This should prevent regressions from + on-going “clknetsim” development. + + * debian/usr.sbin.chronyd: + - Grant access rights only to the ntp_signd socket. (Closes: #928170) + + [ Christian Ehrhardt ] + * debian/postrm: + - Re-establish systemd-timesyncd on removal. (MR: !1) + + -- Vincent Blut <vincent.debian@free.fr> Sat, 06 Jul 2019 20:33:41 +0200 + +chrony (3.5-1) experimental; urgency=medium + + * Import upstream version 3.5: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/control: + - Ignore net-tools and procps build-dependencies if the profile nocheck is + active. + + * debian/rules: + - No test suite should be run if nocheck is passed to DEB_BUILD_OPTIONS. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 15 May 2019 18:44:12 +0200 + +chrony (3.5~pre1-1) experimental; urgency=medium + + * Import upstream version 3.5-pre1: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/.gitlab-ci.yml: + - Use .build-package template job instead of .build-unstable. The latter + is deprecated. + + * debian/chrony.keys: + - Fix the comment about the location of the list of supported hash + functions and output encoding. These information are now available by + consulting the “keyfile” directive in the chrony.conf(5) man page. + + * debian/control: + - Drop dependency on lsb-base. Is is required when booting with sysvinit + and initscripts, however initscripts already Depends on lsb-base. + - Build-depend on net-tools and procps. kill, netstat and ps are needed + for the new system tests executed at build time (iff building as root). + + * debian/copyright: + - Add an entry for test/system/* files. + + * debian/patches/*: + - Drop all patches, they have been applied upstream. + + * debian/postinst: + - Drop migration code from pre-stretch. + + * debian/README.Debian: + - Fix information related to the chrony.keys file. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 12 May 2019 22:16:14 +0200 + +chrony (3.4-4) unstable; urgency=medium + + * debian/patches/*: + - Add allow-further-syscalls-in-seccomp-filter.patch. Supplementing the + seccomp filter whitelist with those syscalls is a prerequisite, notably for + the arm64 architecture. + + [ Leigh Brown ] + * debian/patches/*: + - Add allow-recv-send-in-seccomp-filter.patch. Necessary on armel and + ppc64el. Other architectures might also be affected. (Closes: #924494) + + -- Vincent Blut <vincent.debian@free.fr> Mon, 18 Mar 2019 19:35:34 +0100 + +chrony (3.4-3) unstable; urgency=medium + + * debian/.gitlab-ci.yml: + - Check for missing hardening flags. + + * debian/patches/*: + - Add allow-_llseek-in-seccomp-filter.patch. Needed on various 32-bit + plateforms to log the {raw}measurements and statistics information when + the seccomp filter is enabled. Thanks a lot to Francesco Poli (wintermute) + <invernomuto@paranoici.org> for the report. (Closes: #923137) + - Add allow-waitpid-in-seccomp-filter.patch. Needed to correctly stop + chronyd on some plateforms when the seccomp filter is enabled. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 04 Mar 2019 23:32:12 +0100 + +chrony (3.4-2) unstable; urgency=medium + + * debian/.gitlab-ci.yml: + - Replace home-made GitLab CI with the standard Salsa pipeline. + - Allow autopkgtest job to fail. The time-sources-from-dhcp-servers test + currently fails due to a testbed issue on salsa CI. + + * debian/chrony.default: + - Enable the system call filter by default. + + * debian/control: + - Bump standard-version to 4.3.0 (no changes required). + - Use the new debhelper-compat (= 12) notation and drop d/compat. + - Add Pre-Depends: ${misc:Pre-Depends}. Debhelper compatibility level 12 + makes use of the “--skip-systemd-native” flag from “invoke-rc.d”. Adding + Pre-Depends: ${misc:Pre-Depends} to d/control ensure that we have a recent + enough version of “init-system-helpers”. + - Suggest networkd-dispatcher. + + * debian/copyright: + - Add myself as a copyright holder for 2019. + + * debian/links: + - Now that “networkd-dispatcher” is in the Debian archive, link + NetworkManager dispatcher script to networkd-dispatcher routable and off + states. Patch cherry-picked from Ubuntu; thanks to Christian Ehrhardt + <christian.ehrhardt@canonical.com> for working on this. + + * debian/NEWS: + - Report that a system call filter is now enabled by default and the way + to disable it if needed. + + * debian/rules: + - Don’t enable the system call filter on some architectures due to missing + support in the “libseccomp” and/or the Linux kernel. + + * debian/upstream/: + - Strip upstream key from extra signatures. Thanks lintian! + - Remove the Miroslav-Lichvar.txt file as it serves no purpose. + + * debian/usr.sbin.chronyd: + - Don’t include “tunables/sys”. The etc/apparmor.d/tunables/sys file has + been deprecated in AppArmor 2.13.1! The @{sys} variable is now defined in + “tunables/kernelvars” which is included in “tunables/global”. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 13 Feb 2019 17:08:17 +0100 + +chrony (3.4-1) unstable; urgency=medium + + * Import upstream version 3.4: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * Merge branch “experimental” into “master”. + + * debian/chrony.service: + - Conflict with ntpsec.service. + + * debian/copyright: + - Update copyright years. + + * debian/patches/*: + - Remove fix-samplefilt-unit-test-to-work-with-low-precision-clock.patch, + fixed upstream. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 21 Sep 2018 14:12:03 +0200 + +chrony (3.4~pre1-2) experimental; urgency=medium + + * debian/patches/*: + - Cherry-pick upstream patch to fix samplefilt unit test to work with + low-precision clocks. This should prevent chrony from failing to build + from source on HPPA and Alpha. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 10 Sep 2018 18:39:58 +0200 + +chrony (3.4~pre1-1) experimental; urgency=medium + + * Import upstream version 3.4-pre1: + - Please see /usr/share/doc/chrony/NEWS.gz for the release notes. + + * debian/: + - Add “.gitlab-ci.yml” file to use GitLab Continuous Integration. + + * debian/chrony.if-{post-down,up}: + - Use the new “onoffline” command to tell chronyd to switch all sources to + the online or offline status according to the current network configuration. + + * debian/chrony.ppp.ip-{down,up}: + - As for ifupdown scripts, use the “onoffline” command. + + * debian/control: + - Bump standard-version to 4.2.1 (no changes required). + + * debian/patches/*: + - Remove fall-back-to-urandom.patch. Applied in this prerelease. + + * debian/post{inst,rm}: + - Use “command -v” instead of “which” to enhance portability. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 02 Sep 2018 19:14:08 +0200 + +chrony (3.3-3) unstable; urgency=medium + + * debian/: + - Normalize packaging with “wrap-and-sort -ab”. + + * debian/control: + - Bump standard-version to 4.2.0: + ↳ Install upstream release notes as “/usr/share/doc/chrony/NEWS.gz”. + Installing these as “/usr/share/doc/package/changelog.gz” is now + deprecated. + + * debian/patches/: + - Cherry-pick upstream patch to avoid hangs when starting + chronyd on newer kernels by falling back to urandom. + Thanks to Gustavo Scalet <gustavo.scalet@collabora.com> for the report and + the initial patch. (LP: #1787366, Closes: #906276) + + * debian/upstream/metadata: + - Add DEP12 upstream metadata file. + + -- Vincent Blut <vincent.debian@free.fr> Sat, 18 Aug 2018 16:23:19 +0200 + +chrony (3.3-2) unstable; urgency=medium + + * debian/chrony.service: + - Conflict with ntp.service. + + * debian/control: + - Bump standard-version to 4.1.4 (no changes required). + - Switch to the Nettle cryptographic library for hash functions. + + [ Helmut Grohne ] + * debian/rules: + - Pass CC to make and set “--host-system” to fix FTCBFS. (Closes: #895852) + + [ Christian Ehrhardt ] + * debian/usr.sbin.chronyd: + - Support all paths suggested in the man page. + (LP: #1771028, Closes: #898614) + + -- Vincent Blut <vincent.debian@free.fr> Mon, 14 May 2018 21:37:30 +0200 + +chrony (3.3-1) unstable; urgency=medium + + * Import upstream version 3.3: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * Merge branch “experimental” into “master”. + + * debian/copyright: + - Update copyright year. + + * debian/usr.sbin.chronyd: + - Allow CAP_NET_ADMIN to support HW timestamping. (LP: #1761327) + + -- Vincent Blut <vincent.debian@free.fr> Thu, 05 Apr 2018 02:08:31 +0200 + +chrony (3.3~pre1-1) experimental; urgency=medium + + * Import upstream version 3.3-pre1: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/copyright: + - Add “hash_nettle.c” copyright information and update copyright year of + test/unit/* + + -- Vincent Blut <vincent.debian@free.fr> Thu, 15 Mar 2018 13:58:21 +0100 + +chrony (3.2-5) unstable; urgency=medium + + [ Christian Ehrhardt ] + * debian/usr.sbin.chronyd: + - Allow write access to RTC, PPS and PTP devices. + (Closes: #891201, LP: #1751241) + + -- Vincent Blut <vincent.debian@free.fr> Wed, 28 Feb 2018 17:31:08 +0100 + +chrony (3.2-4) unstable; urgency=medium + + * debian/changelog: + - Remove trailing spaces. + + * debian/chrony-dnssrv@.service: + - Use NTP servers obtained from DNS SRV records. + + * debian/chrony-dnssrv@.timer: + - Periodic lookup of DNS SRV records. + + * debian/chrony-helper: + - New helper script to make use of NTP servers obtained from DHCP and + _ntp._udp DNS SRV records. + + * debian/chrony.dhcp: + - Add a dhclient-exit-hook script to add/remove NTP servers depending + on the operations invoked by the DHCP client. (Closes: #889656) + + * debian/chrony.service: + - Run “/usr/lib/chrony/chrony-helper update-daemon” after starting chronyd. + + * debian/control: + - Suggest dnsutils. The dig utility is used to update files with NTP + servers from DNS SRV records. + + * debian/init: + - Run “/usr/lib/chrony/chrony-helper update-daemon” after starting chronyd. + + * debian/install: + - Install the chrony-helper script in /usr/lib/chrony. + - Install chrony-dnssrv@.* files in /lib/systemd/system. + + * debian/postinst: + - Don’t use recursive chown as this is vulnerable to hardlink attacks on + mainline, non-Debian kernels that do not have fs.protected_hardlinks=1. + Thanks Lintian! + + * debian/postrm: + - Remove “/run/chrony” on purge. + + * debian/rules: + - Install the dhclient-exit-hook script in /etc/dhcp/dhclient-enter-hooks. + + * debian/tests/: + - Use autopkgtest to ensure that chronyd can use NTP servers obtained from + DHCP servers. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 20 Feb 2018 18:27:10 +0100 + +chrony (3.2-3) unstable; urgency=medium + + [ Christian Ehrhardt ] + * debian/chrony.default: + - Mention systemd service file in the comment. + + * debian/chrony.service: + - Support the DAEMON_OPTS variable from “/etc/default/chrony” in systemd + environment. (LP: #1746081, Closes: #889012) + + * debian/usr.sbin.chronyd: + - Allow the creation of /run/chrony on demand. + (LP: #1746444, Closes: #889011) + + -- Vincent Blut <vincent.debian@free.fr> Wed, 07 Feb 2018 21:27:09 +0100 + +chrony (3.2-2) unstable; urgency=medium + + * Initial AppArmor profile for chronyd. Thanks to Jamie + Strandboge <jamie@ubuntu.com>. (Closes: #888038) + + * debian/compat: + - Bump to debhelper compat 11. + + * debian/control: + - Bump standard-version to 4.1.3 (no changes required). + - Build depend on debhelper ≥ 11. + - Set “Rules-Requires-Root: no”. + - Move Vcs-* to salsa.debian.org. + + * debian/copyright: + - Add myself as a copyright holder for 2018. + + * debian/postinst: + - Don’t force removal of cron file since it doesn’t exist anymore. + + * debian/preinst: + - Update the chrony version on which to act. + - Add the debhelper token. + + * debian/usr.sbin.chronyd: + - Improve AppArmor profile to support more chronyd features and ease + portability with other distros. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 28 Jan 2018 19:33:46 +0100 + +chrony (3.2-1) unstable; urgency=medium + + * Import upstream version 3.2: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 15 Sep 2017 11:37:10 +0200 + +chrony (3.2~pre2-1) experimental; urgency=medium + + * Import upstream version 3.2-pre2: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/control: + - Bump standard-version to 4.1.0 (no changes required). + + * debian/copyright: + - Update copyright years. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 30 Aug 2017 15:48:37 +0200 + +chrony (3.2~pre1-1) experimental; urgency=medium + + * Import upstream version 3.2-pre1: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/patches/*: + - Remove allow_getpid_in_seccomp_filter.patch and update the series file + accordingly. + + * debian/tests/upstream-simulation-test-suite: + - Run tests in multiple iterations. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 25 Jul 2017 21:13:22 +0200 + +chrony (3.1-5) unstable; urgency=medium + + * debian/chrony.if-up: + - Do not pass the “burst” command to chronyc as the script could return an + error in certain situations. As a consequence, that would prevent ifupdown + from writing the current state of the interfaces in /run/network/ifstate. + Thanks to John Eikenberry <jae@zhar.net> for reporting that issue. + (Closes: #868491) + + * debian/chrony.ppp.ip-up: + - Take the same action as for the “chrony.if-up” script as a precautionary + measure. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 17 Jul 2017 16:47:56 +0200 + +chrony (3.1-4) unstable; urgency=medium + + * Now that Stretch has been released (\o/), let’s upload chrony 3.1 to + unstable. + + * debian/: + - Remove the menu file used to launch “chronyc”. It is a CLI only tool, + thus it probably does not make a lot of sense to keep it in the Debian + menu. + + * debian/control: + - Drop dependency on pre-jessie util-linux version. + - Bump standard-version to 4.0.0 (no changes required). + + * debian/tests/upstream-simulation-test-suite: + - Fix the leading comment which mentioned “vm” despite the fact that the + test runs in a container. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 19 Jun 2017 02:30:10 +0200 + +chrony (3.1-3) experimental; urgency=medium + + * debian/chrony.if-{post-down,up}: + - Remove unnecessary “else” statements. + + * debian/chrony.ppp.ip-down: + - Don’t check and delete “/var/run/chrony-ppp-up”, that file doesn’t exist + anymore. + - Check for pid file existence instead of calling “pidof”. + + * debian/chrony.ppp.ip-up: + - Don’t create “/var/run/chrony-ppp-up” file after the ppp link came up. + - Check for pid file existence instead of calling “pidof”. + - Don’t call “chronyc” using its absolute path. + - Check for the presence of a default route before advising “chronyd” that + the network connectivity to the sources is ready. + + * debian/init: + - Check if “$PIDFILE” exists before taking action. + - Do not print informational messages. + - Remove the “chronyd” pid file when stopping as it doesn’t do it on + its own. + - Rework the “restart|force-reload” pattern. + - Make use of some init-functions. + - Print a message if “chronyd” is already running while attempting to start + it. + - Do not delete “/var/run/chrony-ppp-up”, that file doesn’t exist anymore. + + * d/rules: + - Move the default pid file from “/var/run” to “/run”. + + * d/tests/*: + - Use autopkgtest facility to run the upstream simulation test suite. + + -- Vincent Blut <vincent.debian@free.fr> Sun, 14 May 2017 17:26:15 +0200 + +chrony (3.1-2) experimental; urgency=medium + + * Merge branch 'master' into experimental. (Closes: #861258) + + * debian/patches/*: + - Remove the “fix_time_smoothing_in_interleaved_mode.patch” patch. Not + needed anymore. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 26 Apr 2017 21:17:43 +0200 + +chrony (3.1-1) experimental; urgency=medium + + * Import upstream version 3.1: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/chrony.conf: + - Remove the “hwclockfile” directive. Unneeded now that the configure + script allows us to set the default path to the adjtime file via the + “--with-hwclockfile” option. + + * debian/copyright: + - Update copyright years. + + * debian/rules: + - Specify default path to hwclock adjtime file. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 02 Feb 2017 19:24:30 +0100 + +chrony (3.0-4) unstable; urgency=medium + + * debian/patches/*: + - Backport commit 768bce799bfe to make chrony operable with the syscall + filtering feature enabled in level 1. (Closes: #861258) + + -- Vincent Blut <vincent.debian@free.fr> Wed, 26 Apr 2017 17:39:44 +0200 + +chrony (3.0-3) unstable; urgency=medium + + * debian/patches/*: + - Backport an upstream patch to fix time smoothing in interleaved mode. + (Closes: #854424) + + -- Vincent Blut <vincent.debian@free.fr> Tue, 07 Feb 2017 00:37:24 +0100 + +chrony (3.0-2) unstable; urgency=medium + + * debian/chrony.conf: + - Disable logging by default, it waste some disk space and users are + probably better served by “chronyc sources” and “chronyc sourcestats” + commands anyway. + + * debian/chrony.service: + - Remove the “Restart=on-failure” option. There are possible security + implications for NTP clients. + + * debian/dirs: + - Add etc/logrotate.d to avoid build failure. + + * Remove our logrotate configuration file in favour of the upstream’s one. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 18 Jan 2017 15:26:31 +0100 + +chrony (3.0-1) unstable; urgency=medium + + * Import upstream version 3.0: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * Merge branch “experimental”: + - Enable support for MS-SNTP authentication in Samba. + - Rename --chronysockdir to --chronyrundir. + - Enable seccomp facility on powerpcspe. + + * debian/chrony.conf: + - Make use of the “makestep” directive to step the system clock instead of + slewing it when necessary. + - Drop the “offline” option as per upstream’s advice to render chrony’s + start-up sequence safer. + + * debian/chrony.service: + - Reflect init-helper script deletion. + + * debian/copyright: + - Add myself as a copyright holder for 2017. + - Adjust copyright holders and update some copyright years. Kudos to Paul + Gevers <elbrus@debian.org> for spotting the necessary updates. + + * debian/init: + - Reflect init-helper script deletion. + + * debian/install: + - Don’t install the init-helper script, it has been deleted. + + * debian/README.Debian: + - Remove obsolete information. + + * Remove the init-helper script as it no longer needed. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 17 Jan 2017 22:05:31 +0100 + +chrony (3.0~pre3-1) experimental; urgency=low + + * Import upstream version 3.0-pre3: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 06 Jan 2017 14:20:13 +0100 + +chrony (3.0~pre2-2) experimental; urgency=low + + * Merge branch “master”. + + * Enable seccomp facility on powerpcspe. + + -- Vincent Blut <vincent.debian@free.fr> Tue, 03 Jan 2017 18:17:13 +0100 + +chrony (3.0~pre2-1) experimental; urgency=low + + * Import upstream version 3.0-pre2: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 15 Dec 2016 15:23:44 +0100 + +chrony (3.0~pre1-1) experimental; urgency=low + + * Import upstream version 3.0-pre1: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/copyright: + - Mention new files. + + * debian/rules: + - Enable support for MS-SNTP authentication in Samba. + - Rename --chronysockdir to --chronyrundir. + + -- Vincent Blut <vincent.debian@free.fr> Sat, 10 Dec 2016 16:30:19 +0100 + +chrony (2.4.1-3) unstable; urgency=medium + + * debian/apm: + - Removing that script as APM as been replaced by ACPI long time ago, thus + it’s highly probable that it isn’t useful anymore. + + * debian/chrony.maintscript: + - Remove the apm script’s conffile. + + * debian/chrony.service: + - Supply a systemd service file. + - Update unit section’s description. Add chronyc and chrony.conf man pages + information and remove reference to “/usr/share/doc/chrony.txt.gz” which + is not generated anymore. + - Update unit section’s documentation. + + * debian/dirs: + - Don’t create etc/apm/event.d as the apm script isn’t provided anymore. + + * debian/init: + - Convert to use the init-helper script. + + * debian/init-helper: + - Add a helper script that will be used to maintain feature parity between + the SysV script and the systemd service file. + + * debian/install: + - Install the init-helper script in “/usr/lib/chrony”. + + * debian/rules: + - Don’t install the now removed apm script. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 22 Dec 2016 02:16:54 +0100 + +chrony (2.4.1-2) unstable; urgency=medium + + * debian/chrony.conf: + - Don’t create sample histories by default. Using that feature does not + make a lot of sense when using a pool of rapidely rotating time servers. + - Remove unused directives. + - Improve (well, I hope! ;-) ) the configuration file readability. + - Reword the driftfile directive commentary. + - Shorten the lead-in comment. + + * debian/control: + - Build-depend on pps-tools only on linux. + - Remove libnss3-dev from Build-Depends until #846012 is fixed. + + * debian/init: + - Don’t pass the “-r” option when restarting chronyd as we have disabled + the creation of sample histories by default. + + * debian/rules: + - Drop dh_auto_build override. Nowadays, the documentation is built by + default. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 9 Dec 2016 16:58:32 +0100 + +chrony (2.4.1-1) unstable; urgency=medium + + * Import upstream version 2.4.1: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/chrony.default: + - New file used to pass options to chronyd. Thanks to nutzteil + <nutzteil@web.de> for the suggestion and the initial patch. + (Closes: #834240) + + * debian/compat: + - Bump to debhelper compat 10. + + * debian/control: + - Build depend on debhelper ≥ 10. + + * debian/copyright: + - Use HTTPS for all URI. + + * debian/init: + - Read and execute options assigned to the “DAEMON_OPTS” variable. + + * debian/rules: + - Drop dh “--parallel” option. Enabled by default in debhelper 10. + + -- Vincent Blut <vincent.debian@free.fr> Mon, 21 Nov 2016 12:58:05 +0100 + +chrony (2.4-1) unstable; urgency=medium + + The “Fix decade-old bug reports” release. + + * Import upstream version 2.4: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/chrony.if-{up,post-down}: + - New scripts used to put chronyd online/offline depending on the + state of the connection. (Closes: #240528,#312092,#389961) + + * debian/chrony.keys: + - Highlight “chronyc keygen” command to generate keys. + + * debian/chrony.ppp.ip-down: + - Be sure that there is no default route before going offline. + (Closes: #252131) + + * debian/control: + - Remove install-info dependency. + - Remove texinfo build dependency since documentation in Texinfo format + has been dropped upstream. + - Build depend on asciidoctor ≥ 1.5.3-1~. The version constraint is + important since chrony’s man pages are generated from “adoc” files, a + functionality that has been added in asciidoctor 1.5.3. + + * debian/dirs: + - Add “etc/NetworkManager/dispatcher.d”. + + * debian/doc-base: + - Remove the file since we do not generate chrony.{html,txt} anymore. + + * debian/docs: + - Remove references to chrony.{html,txt}. + + * debian/patches/*: + - Drop fix-ftbfs-on-powerpc-ppc64-ppc64el.diff; applied upstream. + - Update the “series” file accordingly. + + * debian/postinst: + - Use ucfr to associate chrony with its configuration files. Suggested by + Paul Gevers <elbrus@debian.org> + + * debian/postrm: + - Remove all vestiges of the association between chrony and its + configuration files. Also suggested by Paul Gevers <elbrus@debian.org> + + * debian/rules: + - Provide upstream NetworkManager dispatcher script. + + * debian/watch: + - Use HTTPS to fetch new upstream releases. + - Switch to version 4 format. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 17 Jun 2016 17:20:08 +0200 + +chrony (2.3-2) unstable; urgency=low + + * Cherry pick upstream patch to fix FTBFS on PowerPC, ppc64 and ppc64el + architectures. + + -- Vincent Blut <vincent.debian@free.fr> Fri, 20 May 2016 14:21:14 +0200 + +chrony (2.3-1) unstable; urgency=low + + * Import upstream version 2.3: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + (Closes: #818235) + + * debian/chrony.conf: + - Drop the “logchange” directive. Upstream has enabled “logchange” by + default with a threshold of 1 second. We now use that instead of our custom + threshold of 0,5 second which tended to spam syslog. + - Remove obsolete comment. + + * debian/chrony.lintian-overrides: + - Update “chrony.keys” path + + * debian/control: + - Bump standard-version to 3.9.8 (no changes required). + - Use HTTPS transport protocol for the homepage URL. + + * debian/copyright: + - Add some entries about new or untracked files. + + * debian/postinst: + - Move /usr/share/chrony/chrony.keys template to /etc/chrony using ucf. + - Avoid displaying needless prompt when upgrading to chrony ≥ 2.2.1-1. + (Closes: #820087) + + * debian/postrm: + - Remove chrony.keys on purge. + - Remove all vestiges of chrony.keys from the state hashfile. + + * debian/rules: + - Re-enable test suite. + - Remove dh_installinit override. The init script is LSB-compliant so + passing the “default” option or the two-digit sequence number is unneeded. + - Explicitly set the NTP era. With this change, the NTP time will be + mapped from 1970-01-01T00:00:00Z to 2106-02-07T06:28:16Z. Thanks to this + fixed value, chrony build should be reproducible. + - Move the key file template (chrony.keys) in /usr/share/chrony. + - Force /usr/share/chrony/chrony.keys to use 0640 modes. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 18 May 2016 23:13:05 +0200 + +chrony (2.2.1-1) unstable; urgency=medium + + * Import upstream versions 2.2 and 2.2.1: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + - The 2.2.1 release version fixes CVE-2016-1567. (Closes: #812923) + + * debian/chrony.conf: + - Drop the commandkey directive. It is obsolete since the introduction of a + Unix domain command socket in chrony 2.2. + - Fix keyfile directive commentary. + + * debian/chrony.keys: + - New file template. + + * debian/chrony.lintian-overrides: + - New file used to force lintian to stop complaining about the “chrony.keys” + file modes (0640). + + * debian/chrony.ppp.ip-down: + - Drop obsolete authentication method to the chronyd daemon. This is now + handled by the usage of a Unix domain command socket. + + * debian/chrony.ppp.ip-up: + - Drop obsolete authentication method to the chronyd daemon. This is now + handled by the usage of a Unix domain command socket. + - Reinstate the “burst” chronyc command. + + * debian/control: + - Build depend on libseccomp-dev ≥ 2.2.3-3~. We need it to provide syscall + filtering. + - Fix a typo relative to the name of an architecture. + - Build depend on pkg-config. + - Restrict libcap-dev build dependency on Linux only. + - Depend on iproute2 instead of net-tools. + - Drop timelimit dependency. + - Update Vcs-Git to use HTTPS. + - Bump standard-version to 3.9.7 (no changes required). + + * debian/copyright: + - Update copyright year for debian/*. + + * debian/init: + - Make use of “ip r” instead of “netstat -rn”. (Closes: #818234) + - Delete unused “FLAGS” variable. + - Do not execute ip and chronyc through timelimit. + - Don’t call chronyc using its absolute path. + - Check if the value of the DAEMON variable is executable. + - Drop the two seconds delay as it should be unnecessary. + - Drop obsolete authentication method from the putonline() function. + - Fix indentation issue in the putonline() function. + + * debian/logrotate: + - Do not pass the “-a” option to chronyc, it’s no longer necessary. + + * debian/NEWS: + - Add a comment about the command key suppression from the “chrony.keys” + file. + + * debian/patches/: + - Drop 01_do-not-install-copying-file.patch, not needed anymore. + ↳ Remove reference to that patch from the series file. + + * debian/postinst: + - Do not create an ID/key pair for command authentication. Configuration + and monitoring via chronyc is now done using Unix domain socket accessible + by root or by the system user to which chronyd will drop root privileges, + i.e. _chrony. + + * debian/postrm: + - Remove /var/lib/chrony content only on purge. (Closes: #568492) + + * debian/README.Debian: + - Drop obsolete statement. + + * debian/rules: + - Build with --enable-scfilter. + - Install the “chrony.keys” file in /etc/chrony/ with 0640 modes. + - Override dh_fixperms to prevent it from modifying modes of the + “chrony.keys” file. By default, dh_fixperms tries to set the default modes + (0644). + - Move the “chronyd.sock” file from /var/run/chrony to /run/chrony. + + -- Vincent Blut <vincent.debian@free.fr> Sat, 19 Mar 2016 14:42:23 +0100 + +chrony (2.1.1-1) unstable; urgency=medium + + * Import upstream version 2.0 and 2.1.1: + - Please see /usr/share/doc/chrony/changelog.gz for the release notes. + + * debian/: + - Rename ppp scripts from ip-{up,down} to chrony.ppp.ip-{up,down}. + Necessary to let dh_installppp do its magic. + + * debian/chrony.conf: + - Use the new 'pool' directive to specify the pool of NTP servers. + - Use the iburst option to speed up the initial synchronization. + - Drop the minpoll option. There is no point to deviate from upstream here. + Consequently, the default minimum polling interval is now 64 seconds + instead of 256 seconds. + - Enable kernel synchronization of the RTC via the 'rtcsync' directive. + - Drop the commented out 'rtcfile' directive in the configuration file. + - Stricly act as an NTP client by default. Serving time to other systems + should be the decision of the administrator(s). (Closes: #778770) + - Clarify some comments. + - Improve comment about the 'commandkey' directive. + + * debian/control: + - Drop 'Recommends: udev (>= 0.124-1)' since it predates Debian squeeze. + + * debian/copyright: + - Update copyright years. + - Various cleanups. + - Update relative to sys_macosx.{c,h} files. + - The test/simulation/test.common file is under the GPL-2+ license. + Thanks to Paul Gevers <elbrus@debian.org> for catching it. + + * debian/NEWS: + - Comment the deactivation of the NTP server capability by default. + + * debian/patches/: + - Refresh 01_do-not-install-copying-file.patch. + + * debian/README.Debian: + - Fix misleading information. + + * debian/rules: + - No need to install ppp scripts from the 'rules' script. Let dh_installppp + handle that. + + -- Vincent Blut <vincent.debian@free.fr> Wed, 18 Nov 2015 00:11:23 +0100 + +chrony (1.31.1-2) unstable; urgency=medium + + * Rename the NEWS.Debian file to NEWS. dh_installchangelogs doesn’t seems + to be able to deal with the former name. + + -- Vincent Blut <vincent.debian@free.fr> Thu, 17 Sep 2015 21:50:30 +0200 + +chrony (1.31.1-1) unstable; urgency=medium + + * Import upstream version 1.31 and 1.31.1: + - Please see /usr/share/doc/chrony/changelog.gz for release notes. + + * debian/chrony.conf: + - Use the 'hwclockfile' directive. Avoid using text processing methods in + the post install script to find out if the RTC keeps local time or UTC. + (Closes: #778710) + + * debian/clean: + - Add getdate.c + + * debian/control: + - Move chrony from admin to net section. + - Change priority from extra to optional. + - Build depends on libcap-dev. (Closes: #768803) + - Bump standards-version to 3.9.6 (no changes required). + - Set myself as maintainer and Joachim as uploader. + - Update Vcs-Browser URL to use cgit and https. + - Build depends on pps-tools. Provides PPSAPI (RFC-2783) support. + - Improve the synopsis. + - Depend on util-linux (>= 2.20.1-5). Ensure that the 'UTC=' setting + from the '/etc/default/rcS' file have been migrated to UTC/LOCAL in + '/etc/adjtime'. + - Depends on adduser. Needed to create "_chrony" system user/group. + + * debian/copyright: + - Add myself to copyright holders. + - Remove spaces from short name license (fix Lintian warning) + - Filled short license field (RSA-MD) (fix Lintian warning) + - Move comment to the "Comment:" field + + * debian/logrotate: + - Simplify postrotate script. Thanks to Frédéric Brière + <fbriere@fbriere.net> for reporting and diagnosing the issue. + (Closes: #763542) + + * debian/patches: + - Drop patches for issues fixed upstream. + - Rename and update patch. Update the series file accordingly. + + * debian/postinst: + - Pass the '--three-way' option to ucf. + - Remove useless text processing methods as we now use the 'hwclockfile' + directive. (Closes: #778711) + - Create "_chrony" system user/group. + - Update the "new_file" path in the ucf invocation. + - Remove the MAILPASSWORD shell variable as we don’t use it. + + * debian/postrm: + - Drop removal instruction of /etc/cron.weekly/chrony. + - Remove "_chrony" system user/group on purge. + - Don’t pass the --group option to deluser. + + * debian/NEWS.Debian: + - New file incorporating worthwhile changes in this release. + + * debian/README.Debian: + - Fix typo, thanks to Paul Gevers <elbrus@debian.org> for catching it. + - Missing word added. + + * debian/rules: + - Build with all hardening flags. + - Ease the reading of configure options. + - Specify "_chrony" as default chronyd user. This is the system user to + which chronyd will drop root privileges. You'll find further information + in /usr/share/doc/chrony/README.Debian. + (Closes: #688971) + + -- Vincent Blut <vincent.debian@free.fr> Sun, 6 Sep 2015 22:39:22 +0200 + +chrony (1.30-2) unstable; urgency=medium + + * With the following security bugfixes (Closes: #782160): + - Fix CVE-2015-1853: Protect authenticated symmetric NTP + associations against DoS attacks. + - Fix CVE-2015-1821: Fix access configuration with subnet + size indivisible by 4. + - Fix CVE-2015-1822: Fix initialization of reply slots for + authenticated commands. + * debian/control: + - Update e-mail address of myself. + - Add Vincent Blut as co-maintainer. + + -- Joachim Wiedorn <joodebian@joonet.de> Fri, 10 Apr 2015 11:41:31 +0200 + +chrony (1.30-1) unstable; urgency=medium + + * New upstream release with following bugfixes: + - Fix crash when selecting with multiple preferred sources. + - Fix frequency calculation with large frequency offsets. + - Fix code writing drift and RTC files to compile correctly. + - Fix -4/-6 options in chronyc to not reset hostname set by -h. + - Fix refclock sample validation with sub-second polling interval. + - Set stratum correctly with non-PPS SOCK refclock and local stratum. + - Modify dispersion accounting in refclocks to prevent PPS getting + stuck with large dispersion and not accepting new samples. + - Move faq.txt (PHP style) to a plain text file FAQ. Closes: #415729 + + * Add gpg signature of upstream developer for use with uscan. + * Update debian/watch, add check of upstream gpg signature. + * Update all patches. + + * Bugfix: Use /etc/adjtime in postinst script to recognize + UTC hardware clock. Closes: #680498 + * Use logrotate instead of cron script. Closes: #323966 + * debian/rules: disable test simulation. + + * debian/control: remove obsolete build dependency to dpkg-dev. + * debian/install, debian/dirs, debian/clean: Update. + * debian/copyright: Update and add entries. + + -- Joachim Wiedorn <ad_debian@joonet.de> Sun, 10 Aug 2014 19:10:35 +0200 + +chrony (1.29.1-1) unstable; urgency=high + + * New upstream release with bugfix: + - Closes: #737644: Fixing vulnerability: + CVE-2014-0021 - traffic amplification in cmdmon protocol + (incompatible with previous protocol version, but chronyc + supports both). + + -- Joachim Wiedorn <ad_debian@joonet.de> Thu, 06 Feb 2014 15:51:47 +0100 + +chrony (1.29-1) unstable; urgency=medium + + * New upstream release with some bugfixes: + - Closes: #719132: new upstream version, fixes security bugs. + - Closes: #719203: Fixing vulnerabilities: + CVE-2012-4502 - Buffer overflow, + CVE-2012-4503 - Uninitialized data. + + * debian/control: + - Set myself as new maintainer. Closes: #705768 + - Bump to Standards-Version 3.9.5. + - Move to debhelper >= 9 and compat level 9. + - Update package descriptions. + - Add Vcs fields to new git repository. + - Add dependency to lsb-base (for init script). + - Add build dependency to libtomcrypt-dev. + * Move to source format 3.0 (quilt). + * Add the following patch files: (Closes: #637514) + - 01_fix-small-typo-in-manpages + - 03_recreate-always-getdate-c + - 04_do-not-look-for-ncurses (Closes: #646732) + - 05_disable-installation-of-license + * debian/rules: + - Move to dh-based rules file. + - Enable parallel builds. + + * Add debian/watch file. + * Full update of debian/copyright file. + * Add debian/doc-base file. + * Full update of debian/README.Debian file. + * Update debian/postinst, debian/postrm, debian/prerm. + * Remove obsolete debian/preinst. Reduce mailing within postinst. + * Do not use old md5sum file anymore for ucf in postinst script. + * Add status action in init script (debian/init). Closes: #652207 + * Add debian/install file for installing example of chrony.conf. + * Reduce debian/dirs file for use with debhelper 9. + + -- Joachim Wiedorn <ad_debian@joonet.de> Fri, 20 Dec 2013 23:35:25 +0100 + +chrony (1.26-4) unstable; urgency=low + + * QA upload. + * Depend on net-tools, for netstat (closes: #707260). + + -- Colin Watson <cjwatson@debian.org> Mon, 08 Jul 2013 18:00:45 +0100 + +chrony (1.26-3) unstable; urgency=low + + * Orphaned. + + -- John G. Hasler <jhasler@debian.org> Fri, 19 Apr 2013 13:08:31 -0500 + +chrony (1.26-2) unstable; urgency=low + + * Fixed Makefile.in so that getdate.c gets made (and removed + in "clean"). This will go upstream. Moved faq stuff in rules + from binary-indep to binary-arch. + * Restored accidently deleted nmu changelog entry. + + * Applied patch from Moritz Muehlenhoff <jmm@debian.org> + Closes: #655123 Please enabled hardened build flags + + * Fixed upstream. + Closes: #518385 Chrony segfaults on startup (narrowed down to + chronyc and "burst") + + * Added DEB_BUILD_OPTIONS=noopt to rules. + Added build-arch and build-indep to rules. + Prefix is now 'usr'. + Changed to dh_installman. + Fixed "clean:" target. + Closes: #479389 Improvements for debian/rules + + * Fixed upstream. + Closes: #195620 Strange "System time : xxx seconds slow of NTP time" + output + + * Upstream changes should have fixed this. + Closes:#294030 chronyd makes the whole system briefly (< 1 second) + freeze + + * Fixed by upstream changes and new LSB headers. + Closes: #407466 Chrony won't access hardware clock but prevents + hwclock from doing so either + + -- John G. Hasler <jhasler@debian.org> Sun, 01 Jul 2012 22:05:56 -0500 + +chrony (1.26-1) unstable; urgency=low + + * New upstream release + Closes: #348554: chrony and hwclock packages not coordinated. + Closes: #572964: RTC support is missing. + Closes: #642209: add RTC support for linux 3.0. + Closes: #644241: new upstream version 1.26 available. + + * Applied patches from Joachim Wiedorn <ad_debian@joonet.de>: + Fixed several typos in man pages and README. + Added version.h. + Moved default chrony.conf to debian/ . + Renamed cron and init files. + Removed debian/NEWS.Debian, debian/info. + Added debian/clean. + Updated debian/copyright. COPYING stays. Upstream requires it. + Fixed debian/menu, debian/control, updated debian/compat. + Added "--without-readline" to debian/rules: rewrite later. + Minor fixes to initscript: rewrite later. + + Closes: #646732 Move from readline support to editline support. + Closes: #598253 Fix typo in LSB init headers ($hwclock to $time). + Closes: #600403 Fix init check with PPP connection. + + -- John G. Hasler <jhasler@debian.org> Sun, 17 Jun 2012 21:55:47 -0500 + +chrony (1.24-3.1) unstable; urgency=low + + * Non-maintainer upload. + * Add patch (directly over the source...), to work with kernels > 3.0.0, + by Paul Martin at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628919#15. + (Closes: #628919) + * Fix readline build-depends from "libreadline5-dev | libreadline-dev" to + libreadline-gplv2-dev because chrony is GPLv2 only. (Closes: #634447) + * Update copyright file to say that chrony is GPLv2 only. (Closes: #637526) + + -- Ana Beatriz Guerrero Lopez <ana@debian.org> Fri, 12 Aug 2011 12:32:26 +0200 + +chrony (1.24-3) unstable; urgency=high + + * Applied (modifed) patch from Gregor Herrmann. + + Closes: #593145: fails to configure on installation + Closes: #552162: chrony incorrectly thinks that it has failed to + (re)start + Closes: #592930: invoke-rc.d: initscript chrony, action "start" failed. + + -- John G. Hasler <jhasler@debian.org> Tue, 14 Sep 2010 10:06:47 -0500 + +chrony (1.24-2) unstable; urgency=low + + * Fixed regression that caused default CHRONY_IOC_ lines to + vanish from io_linux.h thereby breaking hppa and ia64. + + Closes: #588930: FTBFS [ia64,hppa]: "I don't know the values of the + _IOC_* constants on your architecture" + + * $remote_fs was added in 1.24-1. Depending on networking is neither + necessary nor desireable. + + Closes: #590888: Dependencies on init.d script insuficcient + + * Still need to rewrite scripts. + + -- John G. Hasler <jhasler@newsguy.com> Fri, 30 Jul 2010 20:32:55 -0500 + +chrony (1.24-1) unstable; urgency=low + + * New upstream release. The scripts will be rewritten and many more bugs + taken care of in -2. Right now I want to get 1.24 out there. + + * Applied patch from Petter Reinholdtsen to init.d + + Closes: #541806: misses syslog dependency in LSB headers + + * Chrony cannot be linked to libreadline6 because it is GPLv2 only. + + Closes: #553739 replacing libreadline5-dev build dependency with + libreadline-dev + + * "configure" rewritten upstream, eliminating "+=". + + Closes: #573036: RTC support disabled (due to Bashism in configure line 293) + + * Removed "install-info" from scripts. + + Closes: #568703: dpkg warnings + + * client.c has been rewritten upstream. + + Closes: #573032 + + * Fixed typos. + + Closes: #434629: 'man chrony', 'cronyc', 'cronyd' typos: "parateters" x 2, + "priviliges" + + * Added debian/source/format containing "1.0". + + -- John G. Hasler <jhasler@newsguy.com> Tue, 22 Jun 2010 16:01:29 -0500 + +chrony (1.23-7) unstable; urgency=high + + * Applied patches from upstream to fix remote DOS: + + CVE-2010-0292 Don't reply to invalid cmdmon packets + + CVE-2010-0293 Limit client log memory size + + CVE-2010-0294 Limit rate of syslog messages + + -- John G. Hasler <jhasler@newsguy.com> Tue, 02 Feb 2010 19:37:50 -0600 + +chrony (1.23-6) unstable; urgency=low + + * Commented out rtcfile directive in chrony.conf because it can cause + lockups with certain combinations of motherboard and kernel (this is + a known kernel bug). + + Closes: #508298: chronyd unreachable and does not work (clock drifts) + + * Chrony no longer uses the ppp/ip-up.d and ppp/ip-up.d files and the new + init.d file won't hang if chronyc hangs. + + Closes: #448481: /etc/ppp/ip-up.d/chrony doesn't work when bindaddress is set. + + * Cannot reproduce on current version on amd64. + + Closes: #412961: error in tracking report (on amd64?) + + -- John Hasler <jhasler@debian.org> Wed, 10 Dec 2008 14:16:37 -0600 + +chrony (1.23-5) unstable; urgency=low + + * Replaced background kill with 'timelimit' in initscript. + + Closes: #505094: chrony: kills random netstat processes + + * Added 'Recommends: udev (>= 0.124-1)' + + Closes: #497113: /dev/rtc renamed to /dev/rtc0 with linux-image-2.6-*/2.6.26+15 + + * Had previously applied patch from Nathanael Nerode to fix configure + bug but forgot to close the bug. + + Closes: #392273: Recursive dependency disease: chrony shouldn't depend on ncurses + + -- John Hasler <jhasler@debian.org> Sun, 09 Nov 2008 20:19:22 -0600 + +chrony (1.23-4) unstable; urgency=low + + * Fixed dependency of init script on Pppconfig ip-up.d script by moving + those lines into the init script. + + * Added checks to try to make sure that Chronyd is really, really running. + Changed Netstat call to use -n, added code to kill it if it hangs. + Added code to kill Chronyc if it can't contact Chronyd. + Discussed the HPET/rtc problem in NEWS.Debian. + + Closes: #504000: init script hangs for a while might break upgrade + + * Added missing initialization to create_instance() in ntp_core.c. + This was why UTI_NormaliseTimeval() was being called with huge + values at times. + + * See comment on #195620 in 1.21z-6 below. If you know of more LP64 + bugs reopen #348412 with a patch. + + Closes: #348412: chronyc not LP64 compliant + + * Added comment about sources being discarded to chrony.conf as suggested + by Andreas Hübner in #268289. + + * This is normal behavior. + + Closes: #287060: trimrtc takes 40 seconds to take effect + + -- John Hasler <jhasler@debian.org> Thu, 06 Nov 2008 10:38:58 -0600 + +chrony (1.23-3) unstable; urgency=high + + * Rewrote UTI_NormaliseTimeval()in util.c to use divide/remainder + instead of loops at the suggestion of Gabor Gombas. This prevents the + problem of the loop running until the sun goes out when the function + is called with a very large value for tv_usec on 64-bit architectures. + Also fixed some other spots where the same loop was being used. + + Closes: #474294 Goes into endless loop + Closes: #447011 chronyd stalls with 100% CPU usage + + I still don't know why the function is being called with such a + large value, however. + + * Changed default servers in chrony,conf to Debian servers. + + Closes: #434483: chrony: Should use NTP servers in Debian pool + + -- John Hasler <jhasler@debian.org> Sat, 26 Apr 2008 11:47:44 -0500 + +chrony (1.23-2) experimental; urgency=low + + * Added default IOC's to io_linux.h. + Closes: #477043: chrony_1.23-1(ia64/experimental): FTBFS: IOC + constants unknown on ia64 + Closes: #476963: chrony_1.23-1(hppa/experimental): FTBFS: "I don't + know the values of the _IOC_* constants for your architecture" + + -- John Hasler <jhasler@debian.org> Sun, 20 Apr 2008 13:29:29 -0500 + +chrony (1.23-1) experimental; urgency=low + + * New upstream release + This is 1.23 with Debian patches applied (including some for LP64). + I'm uploading this to Experimental to get it tested on x86_64 to see + if #474294 is fixed. + + -- John Hasler <jhasler@debian.org> Sat, 19 Apr 2008 14:49:15 -0500 + +chrony (1.21z-6) unstable; urgency=low + + * Applied patches from Eric Lammerts <eric@lammerts.org> and Goswin von + Brederlow <brederlo@informatik.uni-tuebingen.de> to cast the value + returned by ntohl to int32_t and so cause correct sign-extension near + line 1655 in client.c. Also fixed similar bugs in the same area. I'm + not sure this entirely fixes the chronyc number display problem, + though. I've not closed #348412 here because chrony is still not + fully LP64 compliant. + Closes: #195620: Strange "System time : xxx seconds slow of + NTP time" output + + * Replaced addrfilt.c with addrfilt.c from upstream git repository. + This fixes the recursive structure definition problems. + + * Replaced 'route' with 'netstat -r' in the initscript. + + * Applied patch for configure script from Nathanael Nerode + <neroden@gcc.gnu.org> to delete the superfluous "lncurses" at line + 327. + Closes: #392273: Recursive dependency disease: chrony shouldn't depend + on ncurses + + * Added test to reject servers claiming stratum less than 1 in + ntp_core.c "Test 7". Bill Unruh <unruh@physics.ubc.ca> has run across + a server that sometimes claims to be stratum 0, which causes + considerable confusion. + + -- John Hasler <jhasler@debian.org> Fri, 16 Feb 2007 17:47:40 -0600 + +chrony (1.21z-5) unstable; urgency=high + + * Applied postinst patch from Lionel Elie Mamane to test for the + existence of old .keys and .conf files before renaming them. + Closes: #397759: fails to configure: mv: cannot stat `/etc/chrony/chrony.keys.1.21-2': + No such file or directory + + * Added burst command to /etc/ppp/ip-up.d/chrony to give chronyd a kick in the butt. + Shouldn't need that, though. + Initscript now calls /etc/ppp/ip-up.d/chrony if a default route exists. + Closes: #397739: Not connecting to sources after reboot - dialup + + -- John Hasler <jhasler@debian.org> Sun, 26 Nov 2006 08:07:20 -0600 + +chrony (1.21z-4) unstable; urgency=low + + * Added test for /usr/bin/mail to postinst. + Closes: #386651: chrony: Requires /usr/bin/mail but doesn't depend on it + Closes: #390280: chrony: missing dependency on mail + + * Added LSB headers to initscript + + * Corrected erroneous use of 'dpkg --compare-version' in preinst and postinst. + Closes: #386733: fails to configure (bad upgrade check) + + * Added rm to postinst to remove keyfile possibly left by a failed install. + Closes: #390278: usage of tempfile /etc/chrony/chrony.keys is doubtful + + -- John Hasler <jhasler@debian.org> Sat, 7 Oct 2006 13:39:49 -0500 + +chrony (1.21z-3) unstable; urgency=low + + * Changed upstream version number from 1.21 to 1.21z to satisfy Debian + archive software. + + * Replaced impure chrony_1.21.orig.tar.gz. + Closes: #340030: chrony: Tarball is impure + + * Now Provides, Conflicts, Replaces time-daemon + Closes: #330839: time-daemon pseudopackage + + * Corrected typos. + Closes: #321121: chrony: typo in 'Conflicts:' field: s/ntpsimple/ntp-simple/ and s/ntprefclock/ntp-refclock/ + + * Rewrote postinst and postrm to use ucf. Wrote preinst to protect chrony.conf from dpkg. + Closes: #351332: chrony: conffile change prompt prevents smooth upgrade from sarge to etch + + * Deleted last few lines of chrony.conf as they no longer apply. + + * Deleted .arch-ids from contrib and examples. + + * Fixed typo in chronyc.1 + Closes: #349871: chrony: typo in chrnoyc.1 results in missing word + + * Corrected references in man pages. + Closes: #345034: chrony: man pages refer to wrong sections + + * Added "allow 172.16/12" to chrony.conf. + Closes: #252952: chrony: default allow should also have 172.16/12 + + * Channged server lines in chrony.conf to follow ntp.org current recommendation. + Closes: #243534: chrony: new pool.ntp.org setup doesn't work well + + * Fixed FSF address in debian/copyright. + + -- John Hasler <jhasler@debian.org> Fri, 1 Sep 2006 10:52:52 -0500 + +chrony (1.21-2) unstable; urgency=high + + * Patched io_linux.h to add missing architectures. + Closes: #339764: chrony - FTBFS: #error "I don't know the values of the + _IOC_* constants for your architecture" + + * Fixed brown-bag error in rules. + Closes: #339853: /usr/sbin/chronyd is missing + + -- John Hasler <jhasler@debian.org> Sat, 19 Nov 2005 10:12:49 -0600 + +chrony (1.21-1) unstable; urgency=low + + * New upstream release + Closes: #328292: New version of chrony avalaible + Closes: #301592: Fails to read RTC and floods logfiles + + * Enabled RTC as upstream has installed a work-around for the HPET bug. + + * Switched to libreadline5. + Closes: #326379: please rebuild with libreadline5-dev as build dependency + + * Patched addrfilt.c to fix gcc 4.0 build problem. + Closes: #298709: chrony: FTBFS (amd64/gcc-4.0): array type has incomplete element type + + * There are lots more minor things to fix but I'm uploading now to close + the serious bugs. I'll upload another version with some improvements + in a few weeks. + + -- John Hasler <jhasler@debian.org> Tue, 15 Nov 2005 18:39:49 -0600 + +chrony (1.20-8) unstable; urgency=high + + * Added test for /usr/bin/mail in postinst. + Closes: #307061: Install failure: Cannot configure on system without mailx + I consider this bug serious because it can cause installation to fail + and so I want to get the fix into Sarge. + + * Fixed typo in chrony.conf, replaced '/etc/init.d/chrony restart' + with 'invoke-rc.d chrony restart'. + Closes: #305090: Typo in chrony.conf, should mention invoke-rc.d + + * Added README.Debian explaining that rtc is off by default. + + -- John Hasler <jhasler@debian.org> Sat, 30 Apr 2005 18:47:30 -0500 + +chrony (1.20-7) unstable; urgency=low + + * Added info-4 to debian/rules. + Closes: #287142: chrony: Can't find chrony.info-4 + + * Corrected "See Also" section in chrony man page. Now mentions + chronyc(1), chronyd(8), and chrony.conf(5). + Closes: #287444: chrony.1.gz: SEE ALSO on man page has wrong section. + + * Edited chrony.conf to disable rtc by default and explain why: + on some systems that use genrtc or the HPET real-time clock it + fails and causes chronyd to fill up the log. The failure is + probably due to a kernel bug, bug the logging should be + throttled. + + * Added more explanatory comments at the servers directive in + chrony.conf. + + * The postinst script now sends a message to root saying where the + password is, whether Chrony is assuming UTC or local time, + that rtc updating is disabled, why, and how to change it. + + * Added missing '#' to + "Can't tell how your clock is set: assuming local time." + in postinst. + + -- John Hasler <jhasler@debian.org> Tue, 12 Apr 2005 17:59:13 -0500 + +chrony (1.20-6) unstable; urgency=low + + * Fixed error in chrony.conf where the non-existent 'online' directive + was mentioned. + Closes: #257235 misleading instructions in chrony.conf + + * Patched Makefile.in to generate faq.html. + Closes: #265936 /usr/share/doc/chrony/faq.txt.gz: how to read? + + -- John Hasler <jhasler@debian.org> Sat, 4 Dec 2004 17:47:31 -0600 + +chrony (1.20-5) unstable; urgency=low + + * Put pool.ntp.org servers in chrony.conf as defaults. + + * Fixed erroneous references to chronyd(1) in some man pages. + Closes: #241746 SEE ALSO chronyd(1) should be (8) + + * I got a new motherboard and can no longer reproduce this. + If you can please reopen the bug. + Closes: #223518 Rtc stuff is broken + + * Edited chrony.conf(5). + Closes: #241745 many more features have been added + + * Edited chrony.conf to add logchange and mailonchange and to + enable rtc by default. + Closes: #226644 /etc/chrony/chrony.conf: rtc; not all options are noted in conf file + + * Fixed upstream: see NEWS. + Closes: #124089 mistake in the chrony manual + Closes: #177366: trailing blank on log lines + Closes: #195618 failure to use /dev/misc/rtc floods logfiles + Closes: #53066 "acquisitionport" directive and doc fixes [patch] + Closes: #100880 RFE: don't use /proc when uname(2) will do + Closes: #163470: different bindaddresses for ntp port and control port + Closes: #200174: Chrony breaks under Kernel 2.5 (two bugs) + + -- John Hasler <jhasler@debian.org> Sat, 10 Apr 2004 22:00:00 -0500 + +chrony (1.20-4) unstable; urgency=low + + * Added '#include <asm/types>' to rtc_linux.c to fix Alpha build problem. + Also removed spinlock stuff from configure. + + -- John Hasler <jhasler@debian.org> Fri, 26 Dec 2003 21:00:00 -0600 + +chrony (1.20-3) unstable; urgency=low + + * Removed all inclusions of kernel headers. + Hopefully Chrony will now build on m68k. + + -- John Hasler <jhasler@debian.org> Tue, 23 Dec 2003 19:00:00 -0600 + +chrony (1.20-2) unstable; urgency=low + + * Removed spinlock.h and mc146818.h from rtc_linux.c. linux/rtc.h and + RTC_UIE=0x10 provide everything needed now. + Closes: #223134 FTBFS: Errors in kernel headers + + * However, rtc is now broken (and appears to have been broken for some time) + on 440BX chipsets with 2.4 kernels. + + -- John Hasler <jhasler@debian.org> Fri, 12 Dec 2003 13:00:00 -0600 + +chrony (1.20-1) unstable; urgency=low + + * New upstream release. + + * Frank Otto's patch to sys_linux.c, function guess_hz_and_shift_hz now + incorporated upstream. + Closes: #198557 Fatal error: chronyd can't determine hz for kernel with HZ=200 + + * Security and 64 bit patches are now incorporated upstream + along with most non-i386 architecture patches. + + * Put correct links in /usr/share/doc/chrony/timeservers. + Closes: #189686 /usr/share/doc/timeservers links are broken + + * Put correct links in chrony.conf. + Closes: #210886 bad link in chrony.conf + + * Put missing newlines in apm and chrony.keys. + Closes: #211604 Build-warning: some files misses final newline + + * Removed conflict with ntpdate. + + -- John Hasler <jhasler@debian.org> Tue, 7 Oct 2003 22:00:00 -0500 + +chrony (1.19-10) unstable; urgency=low + + * Put linux/linkage.h ahead of linux/spinlock.h as I meant to in + the first place. + + -- John Hasler <john@dhh.gt.org> Sun, 13 Jul 2003 7:00:00 -0500 + +chrony (1.19-9) unstable; urgency=low + + * Added "#include <linux/linkage.h>" to rtc_linux.c to fix mips + build failure. + Closes: #200165 chrony doesn't build on mips and mipsel + + -- John Hasler <john@dhh.gt.org> Sat, 12 Jul 2003 10:00:00 -0500 + +chrony (1.19-8) unstable; urgency=low + + * Added bison to build-depends because of addition of getdate.y + + -- John Hasler <john@dhh.gt.org> Tue, 3 Jun 2003 10:00:00 -0500 + +chrony (1.19-7) unstable; urgency=high + + * Closes: #186498 chronyc hangs if no chronyd is running + Added test for running daemon to ip-{up|down} scripts. + Disabled trimrtc for ALPHA + Closes: #195615 GPL violation - generated file without source + * Added a copy of getdate.y to source. + + -- John Hasler <john@dhh.gt.org> Sun, 1 Jun 2003 7:00:00 -0500 + +chrony (1.19-6) unstable; urgency=low + + * Closes: #179842 "CROAK" redefined + Added '#undef CROAK' before CROAK redefiniton in pktlength.h, + added '-DALPHA' to 'alpha' condition in configure, added + 'ifdef ALPHA' around CROAK redefinition. + * Replaced many signed and unsigned longs as well as some ints, + shorts, and chars with stdint.h types in candm.h, md5.h, ntp.h, + clientlog.h, and ntp_io.c. This should fix all 64-bit problems. + + -- John Hasler <john@dhh.gt.org> Fri, 14 Mar 2003 19:00:00 -0600 + +chrony (1.19-5) unstable; urgency=high + + * Closes: #184065 Assertion `sizeof(NTP_int32) == 4' failed on alpha + Fixed several spots where the author assumed that a long is 32 bits. + There are many more misuses of long as well as several of short and + char but I think I got the only ones likely to cause trouble. + + -- John Hasler <john@dhh.gt.org> Fri, 14 Mar 2003 11:00:00 -0600 + +chrony (1.19-4) unstable; urgency=low + + * Closes: #179538 FTBFS: missing build-depends on makeinfo + Added texinfo to build-depends. + * CLoses: #179508: chrony(c|d) show wrong version numbers + Removed spurious version.h. + + -- John Hasler <john@dhh.gt.org> Sun, 2 Feb 2003 19:00:00 -0600 + +chrony (1.19-3) unstable; urgency=low + + * Updated author's address in copyright file. + * Closes: #163446 patch, that scripts can handle all commandkeys + Applied debugged patch. + * Closes: #107863 doesn't know about APM + Put apm script in debian/ and added rules to copy it to + etc/apm/event.d as instructed by the apmd maintainer. + + -- John Hasler <john@dhh.gt.org> Fri, 31 Jan 2003 18:00:00 -0600 + +chrony (1.19-2) unstable; urgency=low + + * Closes: #100879 unnecessary dependency on libm + Applied patch from Zack Weinberg <zack@codesourcery.com> + * Closes: #124091 the force-reload command of /etc/init.d/chrony should + use the -r option. + Added -r option. + + -- John Hasler <john@dhh.gt.org> Wed, 29 Jan 2003 10:00:00 -0600 + +chrony (1.19-1) unstable; urgency=low + + * New upstream release. + * Closes: #178338 New upstream version fixes crashes caused by adjtimex + failure + * Closes: #178101 /etc/ppp/ip-{up,down}.d/chrony installed with + incorrect permissions + This bug was previously reported and fixed in 18-1 + * Closes: #176130 got an error when I use ppp_on_boot + Changed 'update-rc.d chrony defaults 83' to + 'update-rc.d chrony defaults 14' in init.d so that chrony + will come up before ppp. + * Added code to postinst to read /etc/default/rcS and + set rtconutc appropriately in chrony.conf. + * Rewrote password generator in postinst. + * Closes: #100879 unnecessary dependency on libm + I don't know why this wasn't closed months ago. + * Closes: #103447 typo in "/etc/init.d/chrony" + * Closes: #124087 problems with /etc/init.d/chrony + Fixed script. + * Closes: #161350 /etc/ppp/ip-down.d/chrony cat unnecessary + Fixed scripts. + * Closes: #113840 ntp has been split - add conflicts? + Added ntp-simple and ntp-refclock to conflicts. + + -- John Hasler <john@dhh.gt.org> Sun, 26 Jan 2003 15:00:00 -0600 + +chrony (1.18-2) unstable; urgency=low + + * Corrects error in changelog which resulted + in uploads being erroneously classified as NMUs. + * Closes: #138142, #104774, #142670, #105344, #101039 + * Closes: #162427, #56756, #98951, #99799, #139633 + * Closes: #163469, #163408, #167416 + + -- John Hasler <john@dhh.gt.org> Sun, 3 Nov 2002 20:00:00 -0600 + +chrony (1.18-1) unstable; urgency=low + + * New upstream release. + * Closes: #138142 new upstream release + * Added Mark Brown's Alpha and PowerPC patch. + * Closes: #104774 hppa build failure + Applied patch. + * Closes: #142670 compilation errors on sparc + Applied patch. + * Closes: #105344 ip-{up, down}.d/chrony not executable + Fixed debian/rules. + * Closes: #101039 does not run on Alpha + Fixed by above mentioned Mark Brown patch. + * Closes: #162427 description should mention NTP + Fixed description. + * Closes: #56756 README.debian should caution about hwclock + Fixed README.debian. + * Closes: #98951 no chrony.keys file installed + Not reproducible, probable user error. + * Closes: #99799 logs world readable + Added umask 022 to log script. + * Closes: #139633 documentation error + Added rtconutc to chrony.conf. + * Closes: #163469 no default case in init.d script + Corrected typo. + * Closes: #163408 PIDFILE wrongly defined in ip-{up,down} + No chrony script uses any such variable. + * Closes: #167416 needs Build-Depends: libreadline4-dev + + -- <john@dhh.gt.org> Sun, 3 Nov 2002 10:00:00 -0600 + +chrony (1.14-7) unstable; urgency=medium + + * Changed rtc_linux.c to not include linux/mc146818rtc.h + when building for sparc, because Moshe Zadka says this + will allow chrony to build there. + * Closes: #142670 + + -- <jhasler@debian.org> Wed, 17 Apr 2002 17:00:00 -0500 + +chrony (1.14-6) unstable; urgency=low + + * Changed architecture back to 'any'. + * Applied portability patch from LaMont Jones. + * Closes: #104774 + + -- <jhasler@debian.org> Mon, 1 Apr 2002 21:00:00 -0600 + +chrony (1.14-5) unstable; urgency=low + + * Changed architecture from 'any' to 'i386 sparc'. + Neither I nor the author can test on anything but i386. If + you want chrony on anything else send me a tested patch. + * Closes: #101039 + * Closes: #104774 + + -- <john@dhh.gt.org> Fri, 28 Dec 2001 20:10:00 -0600 + +chrony (1.14-4) unstable; urgency=low + + * Fixed bug in man pages. + * Closes: #95134 + + -- <john@dhh.gt.org> Tue, 24 Apr 2001 20:10:00 -0500 + +chrony (1.14-3) unstable; urgency=low + + * Replaced <linux/spinlock.h> in rtc_linux.c with + typedef int spinlock_t as suggested by Paul Slootman. + * Put #define CROAK(message) assert(0) in pktlength.h + to fix Alpha build problem. + * Closes: #86991 + + -- <john@dhh.gt.org> Sat, 24 Feb 2001 22:45:00 -0600 + +chrony (1.14-2) unstable; urgency=low + + * Closes: #84597 + + -- <john@dhh.gt.org> Sat, 3 Feb 2001 21:25:00 -0600 + +chrony (1.14-1) unstable; urgency=low + + * New upstream release. + * Fixed more sprintfs. + * Closes: #50793, #52570, #48216, #65209, #62924, #70377, #61485, #76661 + + -- <john@dhh.gt.org> Mon, 20 Nov 2000 20:25:00 -0600 + +chrony (1.10-3) unstable; urgency=low + + * Patched cron,weekly script with (corrected) patch + from Rene H. Larsen <renehl@post1.tele.dk>. + * Updated author address in copyright file. + * Compiled with egcs. + * Closes: #41885, #41551 + + -- <john@dhh.gt.org> Sun, 25 July 1999 12:14:00 -0500 + +chrony (1.10-2) unstable; urgency=low + + * Patched rtc_linux.c with patch for SPARC from + bmc@visi.net. + + -- <john@dhh.gt.org> Mon, 17 May 1999 22:30:00 -0500 + +chrony (1.10-1) unstable; urgency=low + + * New upstream release. + * Upstream version number is 1.1. Debian version + number is 1.10 because previous upstream number + was 1.02. + + -- <john@dhh.gt.org> Wed, 12 May 1999 20:30:00 -0500 + +chrony (1.02-7) unstable; urgency=low + + * Changed configure to permit building on non-Intel. + + -- <john@dhh.gt.org> Wed, 5 May 1999 18:00:00 -0500 + +chrony (1.02-6) unstable; urgency=low + + * Fixed postrm bug. + + -- <john@dhh.gt.org> Thur, 29 Apr 1999 18:00:00 -0500 + +chrony (1.02-5) unstable; urgency=low + + * Fixed bugs 34954 and 36921. + * Moved to priority extra. + * Added README.debian text about rtc. + + -- <john@dhh.gt.org> Thur, 15 Apr 1999 21:30:00 -0500 + +chrony (1.02-4) unstable; urgency=low + + * Replaced sprintf's with snprintf's. + + -- <john@dhh.gt.org> Sun, 28 Feb 1999 16:53:00 -0600 + +chrony (1.02-3) unstable; urgency=low + + * Fixed bugs in cron.weekly, ip-up.d, and ip-down.d. + * Bug 29981 is also fixed. + + -- <john@dhh.gt.org> Sun, 6 Dec 1998 9:53:00 -0600 + +chrony (1.02-2) unstable; urgency=low + + * Added cron.weekly. + * Changed ip-up.d, ip-down.d, and cron.weekly to read the + password from chrony.keys. + * Added code to postinst to generate a random password and + put it in chrony.keys. + + -- <john@dhh.gt.org> Thur, 3 Dec 1998 19:00:08 -0600 + +chrony (1.02-1) unstable; urgency=low + + * Initial Release. + + -- <john@dhh.gt.org> Fri, 6 Nov 1998 23:00:08 -0600 diff --git a/debian/chrony-dnssrv@.service b/debian/chrony-dnssrv@.service new file mode 100644 index 0000000..86d374f --- /dev/null +++ b/debian/chrony-dnssrv@.service @@ -0,0 +1,17 @@ +[Unit] +Description=DNS SRV lookup of %I for chrony +After=chrony.service network-online.target +Wants=network-online.target + +[Service] +Type=oneshot +ExecStart=/usr/libexec/chrony/chrony-helper update-dnssrv-servers %I +ProtectSystem=strict +PrivateDevices=yes +ProtectHome=yes +ReadWritePaths=/run +PrivateTmp=yes +PrivateDevices=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes diff --git a/debian/chrony-dnssrv@.timer b/debian/chrony-dnssrv@.timer new file mode 100644 index 0000000..8495e01 --- /dev/null +++ b/debian/chrony-dnssrv@.timer @@ -0,0 +1,9 @@ +[Unit] +Description=Periodic DNS SRV lookup of %I for chrony + +[Timer] +OnActiveSec=0 +OnUnitInactiveSec=1h + +[Install] +WantedBy=timers.target diff --git a/debian/chrony-helper b/debian/chrony-helper new file mode 100755 index 0000000..5099161 --- /dev/null +++ b/debian/chrony-helper @@ -0,0 +1,264 @@ +#!/bin/bash +# This script configures running chronyd to use NTP servers obtained from +# DHCP and _ntp._udp DNS SRV records. Files with servers from DHCP are managed +# externally (e.g. by a dhclient script). Files with servers from DNS SRV +# records are updated here using the dig utility. The script can also list +# and set static sources in the chronyd configuration file. +# +# Modified for Debian by Vincent Blut <vincent.debian@free.fr>. + +chronyc=/usr/bin/chronyc +chrony_conf=/etc/chrony/chrony.conf +chrony_service=chrony.service +helper_dir=/run/chrony-helper +added_servers_file=$helper_dir/added_servers + +dhclient_servers_files="/var/lib/dhcp/chrony.servers.*" +dnssrv_servers_files="$helper_dir/dnssrv@*" +dnssrv_timer_prefix=chrony-dnssrv@ + +chrony_command() { + $chronyc -n -m "$1" +} + +is_running() { + chrony_command "tracking" &> /dev/null +} + +get_servers_files() { + echo "$dhclient_servers_files" + echo "$dnssrv_servers_files" +} + +is_update_needed() { + for file in $(get_servers_files) $added_servers_file; do + [ -e "$file" ] && return 0 + done + return 1 +} + +update_daemon() { + local all_servers_with_args all_servers added_servers + + if ! is_running; then + rm -f $added_servers_file + return 0 + fi + + all_servers_with_args=$(cat $(get_servers_files) 2> /dev/null) + + all_servers=$( + echo "$all_servers_with_args" | + while read -r server serverargs; do + echo "$server" + done | sort -u) + added_servers=$( ( + cat $added_servers_file 2> /dev/null + echo "$all_servers_with_args" | + while read -r server serverargs; do + [ -z "$server" ] && continue + chrony_command "add server $server $serverargs" &> /dev/null && + echo "$server" + done) | sort -u) + + comm -23 <(echo -n "$added_servers") <(echo -n "$all_servers") | + while read -r server; do + chrony_command "delete $server" &> /dev/null + done + + added_servers=$(comm -12 <(echo -n "$added_servers") <(echo -n "$all_servers")) + + if [ -n "$added_servers" ]; then + echo "$added_servers" > $added_servers_file + else + rm -f $added_servers_file + fi +} + +get_dnssrv_servers() { + local name=$1 output + + if ! command -v dig &> /dev/null; then + echo "Missing dig (DNS lookup utility)" >&2 + return 1 + fi + + output=$(dig "$name" srv +short +ndots=2 +search 2> /dev/null) || return 0 + + echo "$output" | while read -r _ _ port target; do + server=${target%.} + [ -z "$server" ] && continue + echo "$server port $port iburst" + done +} + +check_dnssrv_name() { + local name=$1 + + if [ -z "$name" ]; then + echo "No DNS SRV name specified" >&2 + return 1 + fi + + if [ "${name:0:9}" != _ntp._udp ]; then + echo "DNS SRV name $name doesn't start with _ntp._udp" >&2 + return 1 + fi +} + +update_dnssrv_servers() { + local name=$1 + local srv_file=$helper_dir/dnssrv@$name servers + + check_dnssrv_name "$name" || return 1 + + servers=$(get_dnssrv_servers "$name") + if [ -n "$servers" ]; then + echo "$servers" > "$srv_file" + else + rm -f "$srv_file" + fi +} + +set_dnssrv_timer() { + local state=$1 name=$2 + local srv_file=$helper_dir/dnssrv@$name servers + local timer + + timer=$dnssrv_timer_prefix$(systemd-escape "$name").timer || return 1 + + check_dnssrv_name "$name" || return 1 + + if [ "$state" = enable ]; then + systemctl enable "$timer" + systemctl start "$timer" + elif [ "$state" = disable ]; then + systemctl stop "$timer" + systemctl disable "$timer" + rm -f "$srv_file" + fi +} + +list_dnssrv_timers() { + systemctl --all --full -t timer list-units | grep "^$dnssrv_timer_prefix" | \ + sed "s|^$dnssrv_timer_prefix\(.*\)\.timer.*|\1|" | + while read -r name; do + systemd-escape --unescape "$name" + done +} + +prepare_helper_dir() { + mkdir -p $helper_dir + exec 100> $helper_dir/lock + if ! flock -w 20 100; then + echo "Failed to lock $helper_dir" >&2 + return 1 + fi +} + +is_source_line() { + local pattern="^[ \t]*(server|pool|peer|refclock)[ \t]+[^ \t]+" + [[ "$1" =~ $pattern ]] +} + +list_static_sources() { + while read -r line; do + if is_source_line "$line"; then + echo "$line" + fi + done < $chrony_conf +} + +set_static_sources() { + local new_config tmp_conf + + new_config=$( + sources=$( + while read -r line; do + is_source_line "$line" && echo "$line" + done) + + while read -r line; do + if ! is_source_line "$line"; then + echo "$line" + continue + fi + + tmp_sources=$( + local removed=0 + + echo "$sources" | while read -r line2; do + if [ "$removed" -ne 0 ] || [ "$line" != "$line2" ]; then + echo "$line2" + else + removed=1 + fi + done) + + [ "$sources" == "$tmp_sources" ] && continue + sources=$tmp_sources + echo "$line" + done < $chrony_conf + + echo "$sources" + ) + + tmp_conf=${chrony_conf}.tmp + + cp -a $chrony_conf $tmp_conf && + echo "$new_config" > $tmp_conf && + mv $tmp_conf $chrony_conf || return 1 + + systemctl try-restart $chrony_service +} + +print_help() { + echo "Usage: $0 COMMAND" + echo + echo "Commands:" + echo " update-daemon" + echo " update-dnssrv-servers NAME" + echo " enable-dnssrv NAME" + echo " disable-dnssrv NAME" + echo " list-dnssrv" + echo " list-static-sources" + echo " set-static-sources < sources.list" + echo " is-running" + echo " command CHRONYC-COMMAND" +} + +case "$1" in + update-daemon|add-dhclient-servers|remove-dhclient-servers) + is_update_needed || exit 0 + prepare_helper_dir && update_daemon + ;; + update-dnssrv-servers) + prepare_helper_dir && update_dnssrv_servers "$2" && update_daemon + ;; + enable-dnssrv) + set_dnssrv_timer enable "$2" + ;; + disable-dnssrv) + set_dnssrv_timer disable "$2" && prepare_helper_dir && update_daemon + ;; + list-dnssrv) + list_dnssrv_timers + ;; + list-static-sources) + list_static_sources + ;; + set-static-sources) + set_static_sources + ;; + is-running) + is_running + ;; + command|forced-command) + chrony_command "$2" + ;; + *) + print_help + exit 2 +esac + +exit $? diff --git a/debian/chrony.conf b/debian/chrony.conf new file mode 100644 index 0000000..bd63609 --- /dev/null +++ b/debian/chrony.conf @@ -0,0 +1,47 @@ +# Welcome to the chrony configuration file. See chrony.conf(5) for more +# information about usable directives. + +# Include configuration files found in /etc/chrony/conf.d. +confdir /etc/chrony/conf.d + +# Use Debian vendor zone. +pool 2.debian.pool.ntp.org iburst + +# Use time sources from DHCP. +sourcedir /run/chrony-dhcp + +# Use NTP sources found in /etc/chrony/sources.d. +sourcedir /etc/chrony/sources.d + +# This directive specify the location of the file containing ID/key pairs for +# NTP authentication. +keyfile /etc/chrony/chrony.keys + +# This directive specify the file into which chronyd will store the rate +# information. +driftfile /var/lib/chrony/chrony.drift + +# Save NTS keys and cookies. +ntsdumpdir /var/lib/chrony + +# Uncomment the following line to turn logging on. +#log tracking measurements statistics + +# Log files location. +logdir /var/log/chrony + +# Stop bad estimates upsetting machine clock. +maxupdateskew 100.0 + +# This directive enables kernel synchronisation (every 11 minutes) of the +# real-time clock. Note that it can't be used along with the 'rtcfile' directive. +rtcsync + +# Step the system clock instead of slewing it if the adjustment is larger than +# one second, but only in the first three clock updates. +makestep 1 3 + +# Get TAI-UTC offset and leap seconds from the system tz database. +# This directive must be commented out when using time sources serving +# leap-smeared time. +leapsectz right/UTC diff --git a/debian/chrony.default b/debian/chrony.default new file mode 100644 index 0000000..028f63d --- /dev/null +++ b/debian/chrony.default @@ -0,0 +1,6 @@ +# This is a configuration file for /etc/init.d/chrony and +# /lib/systemd/system/chrony.service; it allows you to pass various options to +# the chrony daemon without editing the init script or service file. + +# Options to pass to chrony. +DAEMON_OPTS="-F 1" diff --git a/debian/chrony.dhcp b/debian/chrony.dhcp new file mode 100644 index 0000000..f3dacd7 --- /dev/null +++ b/debian/chrony.dhcp @@ -0,0 +1,27 @@ +CHRONY_SOURCEDIR=/run/chrony-dhcp +SERVERFILE=$CHRONY_SOURCEDIR/$interface.sources + +chrony_config() { + rm -f "$SERVERFILE" + mkdir -p "$CHRONY_SOURCEDIR" + for server in $new_ntp_servers; do + echo "server $server iburst" >> "$SERVERFILE" + done + /usr/bin/chronyc reload sources > /dev/null 2>&1 || : +} + +chrony_restore() { + if [ -f "$SERVERFILE" ]; then + rm -f "$SERVERFILE" + /usr/bin/chronyc reload sources > /dev/null 2>&1 || : + fi +} + +case $reason in + BOUND|RENEW|REBIND|REBOOT) + chrony_config + ;; + EXPIRE|FAIL|RELEASE|STOP) + chrony_restore + ;; +esac diff --git a/debian/chrony.examples b/debian/chrony.examples new file mode 100644 index 0000000..1a0e8e2 --- /dev/null +++ b/debian/chrony.examples @@ -0,0 +1 @@ +examples/chrony.conf* diff --git a/debian/chrony.if-post-down b/debian/chrony.if-post-down new file mode 100644 index 0000000..4cc0796 --- /dev/null +++ b/debian/chrony.if-post-down @@ -0,0 +1,11 @@ +#!/bin/sh + +set -e + +[ -x /usr/sbin/chronyd ] || exit 0 + +if [ -e /run/chrony/chronyd.pid ]; then + chronyc onoffline > /dev/null 2>&1 +fi + +exit 0 diff --git a/debian/chrony.if-up b/debian/chrony.if-up new file mode 100644 index 0000000..4cc0796 --- /dev/null +++ b/debian/chrony.if-up @@ -0,0 +1,11 @@ +#!/bin/sh + +set -e + +[ -x /usr/sbin/chronyd ] || exit 0 + +if [ -e /run/chrony/chronyd.pid ]; then + chronyc onoffline > /dev/null 2>&1 +fi + +exit 0 diff --git a/debian/chrony.keys b/debian/chrony.keys new file mode 100644 index 0000000..a2d655d --- /dev/null +++ b/debian/chrony.keys @@ -0,0 +1,10 @@ +# This file is solely used for NTP authentication with symmetric keys +# as defined by RFC 1305 and RFC 5905. +# +# It can contain ID/key pairs which can be generated using the “keygen” option +# from “chronyc”; for example: +# chronyc keygen 1 SHA256 256 >> /etc/chrony/chrony.keys +# would generate a 256-bit SHA-256 key using ID 1. +# +# A list of supported hash functions and output encoding is available by +# consulting the "keyfile" directive in the chrony.conf(5) man page. diff --git a/debian/chrony.lintian-overrides b/debian/chrony.lintian-overrides new file mode 100644 index 0000000..83260a6 --- /dev/null +++ b/debian/chrony.lintian-overrides @@ -0,0 +1,7 @@ +# The “chrony.keys” file must not be world readable as it could contain +# symmetric keys used for NTP authentication. +chrony: non-standard-file-perm 0640 != 0644 [usr/share/chrony/chrony.keys] + +# NetworkManager does not execute dispatcher scripts in /usr/libexec. +chrony: executable-in-usr-lib [usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp] +chrony: executable-in-usr-lib [usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline] diff --git a/debian/chrony.maintscript b/debian/chrony.maintscript new file mode 100644 index 0000000..740a898 --- /dev/null +++ b/debian/chrony.maintscript @@ -0,0 +1 @@ +rm_conffile /etc/NetworkManager/dispatcher.d/20-chrony 3.5-7~ chrony diff --git a/debian/chrony.ppp.ip-down b/debian/chrony.ppp.ip-down new file mode 100644 index 0000000..c077551 --- /dev/null +++ b/debian/chrony.ppp.ip-down @@ -0,0 +1,13 @@ +#!/bin/sh +# This script tells chronyd that the connection is down +# so that it won't try to contact the server. +# John Hasler <jhasler@debian.org> 1998-2003 +# Any possessor of a copy of this program may treat it as if it +# were in the public domain. I waive all rights. +# Modified by Vincent Blut <vincent.debian@free.fr> + +if [ -e /run/chrony/chronyd.pid ]; then + chronyc onoffline > /dev/null 2>&1 +fi + +exit 0 diff --git a/debian/chrony.ppp.ip-up b/debian/chrony.ppp.ip-up new file mode 100644 index 0000000..9c8d089 --- /dev/null +++ b/debian/chrony.ppp.ip-up @@ -0,0 +1,12 @@ +#!/bin/sh +# This script tells chronyd that the connection is up so that it can +# contact the server. John Hasler <jhasler@debian.org> 1998-2003 +# Any possessor of a copy of this program may treat it as if it +# were in the public domain. I waive all rights. +# Modified by Vincent Blut <vincent.debian@free.fr> + +if [ -e /run/chrony/chronyd.pid ]; then + chronyc onoffline > /dev/null 2>&1 +fi + +exit 0 diff --git a/debian/chrony.service b/debian/chrony.service new file mode 100644 index 0000000..50d08fa --- /dev/null +++ b/debian/chrony.service @@ -0,0 +1,65 @@ +[Unit] +Description=chrony, an NTP client/server +Documentation=man:chronyd(8) man:chronyc(1) man:chrony.conf(5) +Conflicts=openntpd.service ntp.service ntpsec.service +Wants=time-sync.target +Before=time-sync.target +After=network.target +ConditionCapability=CAP_SYS_TIME + +[Service] +Type=forking +PIDFile=/run/chrony/chronyd.pid +EnvironmentFile=-/etc/default/chrony +User=_chrony +# Daemon is started as root, but still sandboxed +ExecStart=!/usr/sbin/chronyd $DAEMON_OPTS + +CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE +CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE +CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN +CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT +CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM +DeviceAllow=char-pps rw +DeviceAllow=char-ptp rw +DeviceAllow=char-rtc rw +DevicePolicy=closed +LockPersonality=yes +MemoryDenyWriteExecute=yes +NoNewPrivileges=yes +PrivateTmp=yes +ProcSubset=pid +ProtectControlGroups=yes +ProtectHome=yes +ProtectHostname=yes +ProtectKernelLogs=yes +ProtectKernelModules=yes +ProtectKernelTunables=yes +ProtectProc=invisible +ProtectSystem=strict +# Used for gps refclocks +ReadWritePaths=/run +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +RestrictSUIDSGID=yes +SystemCallArchitectures=native +SystemCallFilter=~@cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap + +ConfigurationDirectory=chrony +RuntimeDirectory=chrony +RuntimeDirectoryMode=0700 +# See dumpdir in chrony.conf(5) +RuntimeDirectoryPreserve=restart +StateDirectory=chrony +StateDirectoryMode=0750 +LogsDirectory=chrony +LogsDirectoryMode=0750 + +# Adjust restrictions for /usr/sbin/sendmail (mailonchange directive) +NoNewPrivileges=no +ReadWritePaths=-/var/spool +RestrictAddressFamilies=AF_NETLINK + +[Install] +Alias=chronyd.service +WantedBy=multi-user.target diff --git a/debian/clean b/debian/clean new file mode 100644 index 0000000..70f5857 --- /dev/null +++ b/debian/clean @@ -0,0 +1 @@ +getdate.c diff --git a/debian/conf.d/README b/debian/conf.d/README new file mode 100644 index 0000000..de1fa8e --- /dev/null +++ b/debian/conf.d/README @@ -0,0 +1,7 @@ +Files found under the /etc/chrony/conf.d directory with the .conf suffix are +parsed in the lexicographical order of the file names when chronyd starts up. +This enables a fragmented configuration of chronyd. + +Although those files can contain any directives listed in chrony.conf(5), +it would be wiser to add NTP sources in the /etc/chrony/sources.d +directory. Please read /etc/chrony/sources.d/README for more information. diff --git a/debian/control b/debian/control new file mode 100644 index 0000000..e5ceea2 --- /dev/null +++ b/debian/control @@ -0,0 +1,54 @@ +Source: chrony +Section: net +Priority: optional +Maintainer: Vincent Blut <vincent.debian@free.fr> +Standards-Version: 4.6.2 +Build-Depends: asciidoctor, + bison, + debhelper-compat (= 13), + dh-apparmor, + gnutls-bin <!nocheck>, + iproute2 [linux-any] <!nocheck>, + libcap-dev [linux-any], + libedit-dev, + libgnutls28-dev, + libseccomp-dev (>= 2.4.3-1~) [amd64 arm64 armel armhf hppa i386 mips mipsel mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x x32], + nettle-dev, + pkg-config, + pps-tools [linux-any], + procps <!nocheck> +Homepage: https://chrony.tuxfamily.org +Vcs-Git: https://salsa.debian.org/debian/chrony.git -b debian/latest +Vcs-Browser: https://salsa.debian.org/debian/chrony +Rules-Requires-Root: no + +Package: chrony +Architecture: linux-any +Pre-Depends: ${misc:Pre-Depends} +Depends: adduser, + iproute2 [linux-any], + tzdata, + ucf, + ${misc:Depends}, + ${shlibs:Depends} +Suggests: dnsutils, + networkd-dispatcher +Breaks: network-manager (<< 1.20.0-1~) +Conflicts: time-daemon +Provides: time-daemon +Replaces: time-daemon +Description: Versatile implementation of the Network Time Protocol + It consists of a pair of programs: + . + chronyd: This is a daemon which runs in background on the system. + It obtains measurements (e.g. via the network) of the system's offset + relative to other systems and adjusts the system time accordingly. For + isolated systems, the user can periodically enter the correct time by + hand (using 'chronyc'). In either case 'chronyd' determines the rate + at which the computer gains or loses time, and compensates for this. + Chronyd implements the NTP protocol and can act as either a client or + a server. + . + chronyc: This is a command-line driven control and monitoring program. + An administrator can use this to fine-tune various parameters within + the daemon, add or delete servers etc whilst the daemon is running. diff --git a/debian/copyright b/debian/copyright new file mode 100644 index 0000000..f9f65f6 --- /dev/null +++ b/debian/copyright @@ -0,0 +1,187 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Upstream-Name: chrony +Upstream-Contact: Miroslav Lichvar <mlichvar@redhat.com> +Source: https://download.tuxfamily.org/chrony/ + +Files: * +Copyright: 2009-2021, Miroslav Lichvar + 1997-2007, Richard P. Curnow +License: GPL-2 + +Files: main.c + sys_linux.c +Copyright: 2012-2020, Miroslav Lichvar + 2009, John G. Hasler + 1997-2003, Richard P. Curnow +License: GPL-2 + +Files: ntp_io.c +Copyright: 2009, 2013-2016, 2018-2021, Miroslav Lichvar + 2009, Timo Teras + 1997-2003, Richard P. Curnow +License: GPL-2 + +Files: sys_macosx.? +Copyright: 2015, 2017, 2020, Bryan Christianson + 2001, J. Hannken-Illjes + 1997-2001, Richard P. Curnow +License: GPL-2 + +Files: sys_netbsd.? +Copyright: 2001, J. Hannken-Illjes + 1997-2001, Richard P. Curnow +License: GPL-2 + +Files: debian/* +Copyright: 2015-2023, Vincent Blut + 2012-2014, Joachim Wiedorn + 2000-2012, John Hasler +License: GPL-2 + +Files: test/simulation/test.common +Copyright: 2013-2014, Miroslav Lichvar +License: GPL-2+ + +Files: privops.c +Copyright: 2015, Bryan Christianson + 2017, Miroslav Lichvar +License: GPL-2 + +Files: privops.h +Copyright: 2015, Bryan Christianson +License: GPL-2 + +Files: contrib/bryan_christianson_1/chronylogrotate.sh +Copyright: 2015, Bryan Christianson +License: GPL-2 + +Files: test/unit/* +Copyright: 2016-2022, Miroslav Lichvar +License: GPL-2 + +Files: hwclock.? +Copyright: 2016-2018, 2022, Miroslav Lichvar +License: GPL-2 + +Files: ntp_io_linux.? +Copyright: 2016-2019, 2021-2022 Miroslav Lichvar +License: GPL-2 + +Files: ntp_signd.? +Copyright: 2016, Miroslav Lichvar +License: GPL-2 + +Files: client.c +Copyright: 1997-2003, Richard P. Curnow + 2016, Lonnie Abelbeck + 2009-2022, Miroslav Lichvar +License: GPL-2 + +Files: configure +Copyright: 1997-2003, Richard P. Curnow + 2016, Bryan Christianson + 2009, 2012-2021, Miroslav Lichvar + 2019, Stefan R. Filipek +License: GPL-2 + +Files: doc/chrony.conf.adoc +Copyright: 1997-2003, Richard P. Curnow + 2016, Stephen Wadeley + 2009-2022, Miroslav Lichvar + 2017, Bryan Christianson +License: GPL-2 + +Files: doc/chronyc.adoc +Copyright: 1997-2003, Richard P. Curnow + 2016, Stephen Wadeley + 2009-2017, 2019-2022, Miroslav Lichvar +License: GPL-2 + +Files: refclock.c +Copyright: 2009-2011, 2013-2014, 2016-2019, 2022 Miroslav Lichvar +License: GPL-2 + +Files: refclock_phc.c +Copyright: 2013, 2017, Miroslav Lichvar +License: GPL-2 + +Files: regress.c +Copyright: 1997-2003, Richard P. Curnow + 2011, 2016-2017, Miroslav Lichvar +License: GPL-2 + +Files: sched.c +Copyright: 1997-2003, Richard P. Curnow + 2011, 2013-2016, Miroslav Lichvar +License: GPL-2 + +Files: sourcestats.c +Copyright: 1997-2003, Richard P. Curnow + 2011-2014, 2016-2018, 2021, Miroslav Lichvar +License: GPL-2 + +Files: stubs.c +Copyright: 2014-2016, Miroslav Lichvar +License: GPL-2 + +Files: hash_nettle.c +Copyright: 2018, Miroslav Lichvar +License: GPL-2 + +Files: test/system/* +Copyright: 2019, Miroslav Lichvar +License: GPL-2 + +Files: md5.* +Copyright: 1990, RSA Data Security, Inc. All rights reserved. +License: RSA-MD + License to copy and use this software is granted provided that + it is identified as the "RSA Data Security, Inc. MD5 Message- + Digest Algorithm" in all material mentioning or referencing this + software or this function. + . + License is also granted to make and use derivative works + provided that such works are identified as "derived from the RSA + Data Security, Inc. MD5 Message-Digest Algorithm" in all + material mentioning or referencing the derived work. + . + RSA Data Security, Inc. makes no representations concerning + either the merchantability of this software or the suitability + of this software for any particular purpose. It is provided "as + is" without express or implied warranty of any kind. + . + These notices must be retained in any copies of any part of this + documentation and/or software. + +License: GPL-2 + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License version 2 as + published by the Free Software Foundation. + . + This package is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + . + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. + . + On Debian systems, the complete text of the GNU General Public License + version 2 can be found in the file `/usr/share/common-licenses/GPL-2'. + +License: GPL-2+ + This package is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + . + This package is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + . + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/> + . + On Debian systems, the complete text of the GNU General Public License + version 2 can be found in `/usr/share/common-licenses/GPL-2'. diff --git a/debian/dirs b/debian/dirs new file mode 100644 index 0000000..152a039 --- /dev/null +++ b/debian/dirs @@ -0,0 +1,6 @@ +etc/chrony +etc/logrotate.d +etc/ppp/ip-down.d +etc/ppp/ip-up.d +usr/lib/NetworkManager/dispatcher.d +var/lib/chrony diff --git a/debian/docs b/debian/docs new file mode 100644 index 0000000..e12f653 --- /dev/null +++ b/debian/docs @@ -0,0 +1,3 @@ +FAQ +NEWS +README diff --git a/debian/init b/debian/init new file mode 100644 index 0000000..ce121d7 --- /dev/null +++ b/debian/init @@ -0,0 +1,69 @@ +#! /bin/sh +# +# Written by Miquel van Smoorenburg <miquels@drinkel.ow.org>. +# Modified for Debian GNU/Linux by Ian Murdock <imurdock@gnu.ai.mit.edu>. +# Modified for Debian by Christoph Lameter <clameter@debian.org> +# Modified for chrony by John Hasler <jhasler@debian.org> 1998-2012 +# Modified for Debian by Vincent Blut <vincent.debian@free.fr> + +### BEGIN INIT INFO +# Provides: chrony +# Required-Start: $remote_fs +# Required-Stop: $remote_fs +# Should-Start: $syslog $network $named $time +# Should-Stop: $syslog $network $named $time +# Default-Start: 2 3 4 5 +# Default-Stop: 0 1 6 +# Short-Description: Controls chronyd NTP time daemon +# Description: Chronyd is the NTP time daemon in the Chrony package +### END INIT INFO + +PATH=/bin:/usr/bin:/sbin:/usr/sbin +DAEMON=/usr/sbin/chronyd +NAME="chronyd" +DESC="time daemon" +PIDFILE=/run/chrony/chronyd.pid + +[ -x "$DAEMON" ] || exit 0 + +. /lib/lsb/init-functions + +# Override this variable by editing /etc/default/chrony. +DAEMON_OPTS="" +if [ -f /etc/default/chrony ]; then + . /etc/default/chrony +fi + +case "$1" in + start) + if $0 status > /dev/null ; then + log_success_msg "$NAME is already running" + else + log_daemon_msg "Starting $DESC" "$NAME" + start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS + log_end_msg $? + fi + ;; + + stop) + log_daemon_msg "Stopping $DESC" "$NAME" + start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE --exec $DAEMON + log_end_msg $? + ;; + + restart|force-reload) + $0 stop + $0 start + ;; + + status) + status_of_proc -p $PIDFILE "$DAEMON" "$NAME" && exit 0 || exit $? + ;; + + *) + log_action_msg "Usage: /etc/init.d/chrony {start|stop|restart|force-reload|status}" + exit 1 + ;; +esac + +exit 0 diff --git a/debian/install b/debian/install new file mode 100644 index 0000000..5e0f25b --- /dev/null +++ b/debian/install @@ -0,0 +1,8 @@ +debian/chrony-dnssrv@.* lib/systemd/system +debian/chrony-helper usr/libexec/chrony +debian/chrony.conf usr/share/chrony +debian/conf.d etc/chrony +debian/ntp-units.d/50-chrony.list usr/lib/systemd/ntp-units.d +debian/sources.d etc/chrony +debian/usr.sbin.chronyd etc/apparmor.d +examples/chrony-wait.service lib/systemd/system diff --git a/debian/links b/debian/links new file mode 100644 index 0000000..31cfb4a --- /dev/null +++ b/debian/links @@ -0,0 +1,5 @@ +# Update sources in response to systemd-networkd events (LP: #1718227). +# This is reusing the NetworkManager dispatch script which has no hard +# dependency to NetworkManager (not using any of its arguments) +usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline usr/lib/networkd-dispatcher/routable.d/chrony-onoffline +usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline usr/lib/networkd-dispatcher/off.d/chrony-onoffline diff --git a/debian/ntp-units.d/50-chrony.list b/debian/ntp-units.d/50-chrony.list new file mode 100644 index 0000000..6b9cca0 --- /dev/null +++ b/debian/ntp-units.d/50-chrony.list @@ -0,0 +1 @@ +chrony.service diff --git a/debian/patches/nm-dispatcher-dhcp_Move-server_dir-to-run.patch b/debian/patches/nm-dispatcher-dhcp_Move-server_dir-to-run.patch new file mode 100644 index 0000000..2df6629 --- /dev/null +++ b/debian/patches/nm-dispatcher-dhcp_Move-server_dir-to-run.patch @@ -0,0 +1,19 @@ +Description: Move server_dir path to /run +Author: Vincent Blut <vincent.debian@free.fr> +Forwarded: no +Last-Update: 2020-09-16 +--- +This patch header follows DEP-3: http://dep.debian.net/deps/dep3/ +Index: chrony/examples/chrony.nm-dispatcher.dhcp +=================================================================== +--- chrony.orig/examples/chrony.nm-dispatcher.dhcp ++++ chrony/examples/chrony.nm-dispatcher.dhcp +@@ -10,7 +10,7 @@ action=$2 + + chronyc=/usr/bin/chronyc + server_options=iburst +-server_dir=/var/run/chrony-dhcp ++server_dir=/run/chrony-dhcp + + dhcp_server_file=$server_dir/$interface.sources + dhcp_ntp_servers="$DHCP4_NTP_SERVERS $DHCP6_DHCP6_NTP_SERVERS" diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 0000000..f5b7c27 --- /dev/null +++ b/debian/patches/series @@ -0,0 +1 @@ +nm-dispatcher-dhcp_Move-server_dir-to-run.patch diff --git a/debian/postinst b/debian/postinst new file mode 100644 index 0000000..8a00a77 --- /dev/null +++ b/debian/postinst @@ -0,0 +1,80 @@ +#!/bin/sh +# postinst script for chrony +# +# see: dh_installdeb(1) + +set -e + + +# targets: configure|abort-upgrade|abort-remove|abort-deconfigure + +case "$1" in + configure) + + adduser --force-badname \ + --system \ + --group \ + --quiet \ + --gecos "Chrony daemon" \ + --home /var/lib/chrony \ + --no-create-home _chrony + + if command -v ucf >/dev/null + then + ucf --three-way /usr/share/chrony/chrony.conf /etc/chrony/chrony.conf + ucf --three-way /usr/share/chrony/chrony.keys /etc/chrony/chrony.keys + if [ -x "$(command -v ucfr)" ]; then + ucfr chrony /etc/chrony/chrony.conf + ucfr chrony /etc/chrony/chrony.keys + fi + fi + + # Change the user and group ownership of "/var/l{ib,og}/chrony" iif + # the chronyd's configuration does not contain the "user" directive. + # Also, update these directories' mode bits to 0750 to follow upstream. + # + # We must also ensure that chronyd can read /etc/chrony/chrony.keys + # after dropping root privileges. + if ! chronyd -p | grep -q "^user"; then + for d in /var/lib/chrony /var/log/chrony /etc/chrony/chrony.keys; do + if ! dpkg-statoverride --list "$d" >/dev/null; then + if [ "$d" = "/etc/chrony/chrony.keys" ]; then + dpkg-statoverride --update --add root _chrony 0640 "$d" + else + dpkg-statoverride --update --add _chrony _chrony 0750 "$d" + fi + fi + done + fi + + if [ -n "$2" ] && dpkg --compare-versions "$2" lt 4.0~pre4-1; then + # Migrate NTP sources obtained from DHCP to /run/chrony-dhcp + mkdir -p /run/chrony-dhcp + for file in $(find /var/lib/dhcp/ -type f -name "chrony.servers.*"); do + sed 's/.*/server &/' < "$file" > /run/chrony-dhcp/"${file##*servers.}.sources" + done + + # Remove the staled PID file resulting from migrating its path from + # /run to /run/chrony/. Overriding dh_installinit and + # dh_systemd_start to use the --no-restart-after-upgrade option + # was a possibility but chronyd would have been down even longer + # during the upgrade. + rm -f /run/chronyd.pid + fi + ;; + + abort-upgrade|abort-remove|abort-deconfigure) + ;; + + *) + echo "postinst called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac + +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + +exit 0 diff --git a/debian/postrm b/debian/postrm new file mode 100644 index 0000000..79713e3 --- /dev/null +++ b/debian/postrm @@ -0,0 +1,56 @@ +#!/bin/sh +# postrm script for chrony +# +# see: dh_installdeb(1) + +set -e + +# targets: purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear + +case "$1" in + purge) + rm -f /var/lib/chrony/* + rm -f /etc/chrony/chrony.conf + rm -f /etc/chrony/chrony.keys + if command -v ucf >/dev/null + then + ucf --purge /etc/chrony/chrony.conf + ucf --purge /etc/chrony/chrony.keys + if [ -x "$(command -v ucfr)" ]; then + ucfr --purge chrony /etc/chrony/chrony.conf + ucfr --purge chrony /etc/chrony/chrony.keys + fi + fi + rm -rf /etc/chrony + rm -rf /run/chrony || true + rm -rf /run/chrony-dhcp || true + rm -rf /var/lib/chrony + rm -rf /var/log/chrony + # Remove "_chrony" system user/group + if [ -x "$(command -v deluser)" ] + then + deluser --quiet --system _chrony > /dev/null 2>&1 || true + fi + + for d in /var/lib/chrony /var/log/chrony /etc/chrony/chrony.keys; do + if dpkg-statoverride --list "$d" >/dev/null; then + dpkg-statoverride --remove "$d" + fi + done + ;; + + remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear) + ;; + + *) + echo "postrm called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac + +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + +exit 0 diff --git a/debian/prerm b/debian/prerm new file mode 100644 index 0000000..ec12057 --- /dev/null +++ b/debian/prerm @@ -0,0 +1,28 @@ +#!/bin/sh +# prerm script for chrony +# +# see: dh_installdeb(1) + +set -e + +# targets: remove|upgrade|deconfigure|failed-upgrade + +case "$1" in + remove|upgrade|deconfigure) + ;; + + failed-upgrade) + ;; + + *) + echo "prerm called with unknown argument \`$1'" >&2 + exit 1 + ;; +esac + +# dh_installdeb will replace this with shell code automatically +# generated by other debhelper scripts. + +#DEBHELPER# + +exit 0 diff --git a/debian/rules b/debian/rules new file mode 100755 index 0000000..202e0e8 --- /dev/null +++ b/debian/rules @@ -0,0 +1,49 @@ +#!/usr/bin/make -f + +-include /usr/share/dpkg/buildtools.mk +export CC + +include /usr/share/dpkg/architecture.mk + +export DEB_BUILD_MAINT_OPTIONS=hardening=+all + +BASE=debian/chrony + +%: + dh $@ + +override_dh_auto_configure: + dh_auto_configure -- --mandir=/usr/share/man \ + --sysconfdir=/etc/chrony \ + --with-user=_chrony \ + --enable-scfilter \ + --chronyrundir=/run/chrony \ + --with-ntp-era=$(shell date -d '1970-01-01 00:00:00+00:00' +'%s') \ + --enable-ntp-signd \ + --with-hwclockfile=/etc/adjtime \ + --with-pidfile=/run/chrony/chronyd.pid \ + --host-system=Linux + +override_dh_install: + dh_install + install -m 0640 -t $(BASE)/usr/share/chrony/ debian/chrony.keys + install -m 0755 -T examples/chrony.nm-dispatcher.dhcp ${BASE}/usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp + install -m 0755 -T examples/chrony.nm-dispatcher.onoffline $(BASE)/usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline + install -m 0644 -T examples/chrony.logrotate $(BASE)/etc/logrotate.d/chrony + dh_apparmor --profile-name=usr.sbin.chronyd -pchrony + install -D -p -m 0644 debian/chrony.dhcp $(BASE)/etc/dhcp/dhclient-exit-hooks.d/chrony + +override_dh_fixperms: + dh_fixperms -X usr/share/chrony/chrony.keys + +override_dh_installinit: + dh_installinit +# Disable the system call filter on architectures mentioned below +# due to missing support in libseccomp and/or in the Linux kernel. +ifneq (,$(filter $(DEB_HOST_ARCH), alpha ia64 m68k sh4 sparc64)) + sed -i '/DAEMON_OPTS=/s/"-F 1"/""/' $(BASE)/etc/default/chrony +endif + +override_dh_installsystemd: + dh_installsystemd chrony.service + dh_installsystemd --no-enable --no-start chrony-wait.service diff --git a/debian/source/format b/debian/source/format new file mode 100644 index 0000000..163aaf8 --- /dev/null +++ b/debian/source/format @@ -0,0 +1 @@ +3.0 (quilt) diff --git a/debian/sources.d/README b/debian/sources.d/README new file mode 100644 index 0000000..184eaec --- /dev/null +++ b/debian/sources.d/README @@ -0,0 +1,12 @@ +Only NTP sources can be specified in the /etc/chrony/sources.d directory. +Files in this directory must end with the ".sources" suffix. They can only +contain the "peer", "pool" and "server" directives and must have all +lines terminated by a trailing newline. + +There is no need to restart chronyd for these time sources to be usable, +running 'chronyc reload sources' is sufficient. + +Example: + +# echo 'server 192.0.2.1 iburst' > /etc/chrony/sources.d/local-ntp-server.sources +# chronyc reload sources diff --git a/debian/tests/control b/debian/tests/control new file mode 100644 index 0000000..5586711 --- /dev/null +++ b/debian/tests/control @@ -0,0 +1,28 @@ +Tests: upstream-simulation-test-suite +Depends: @builddeps@, build-essential, ca-certificates, wget +Restrictions: isolation-container, build-needed, skippable, needs-root, needs-internet + +Tests: time-sources-from-dhcp-servers +Depends: @, isc-dhcp-server, isc-dhcp-client, iproute2, kmod +Restrictions: isolation-machine, needs-root + +Features: test-name=run_system_tests +Test-Command: debian/tests/upstream-system-tests +Depends: @builddeps@ +Restrictions: build-needed, isolation-container, needs-root + +Features: test-name=run_destructive_system_tests +Test-Command: debian/tests/upstream-system-tests -d 1[0-9][0-9]-* +Depends: @, @builddeps@, ethtool +Restrictions: build-needed, isolation-machine, needs-root + +Tests: fragmented-configuration +Restrictions: isolation-container, needs-root + +Tests: dynamically-add-source +Depends: @, dpkg-dev +Restrictions: isolation-container, needs-root, skippable + +Tests: ntp-server-and-nts-auth +Depends: @, dpkg-dev, gnutls-bin +Restrictions: isolation-container, needs-root, skippable diff --git a/debian/tests/dynamically-add-source b/debian/tests/dynamically-add-source new file mode 100644 index 0000000..1e4c160 --- /dev/null +++ b/debian/tests/dynamically-add-source @@ -0,0 +1,27 @@ +#!/bin/sh +# Make sure that NTP sources from /etc/chrony/sources.d are usable. + +set -e + +. debian/tests/helper-functions + +server_addr="192.0.2.1" + +printf "Preparing chronyd configuration: " +__no_system_clock_control +__restart_chronyd && __test_ok || __test_skip + +printf "Adding a dummy server to the list of NTP sources: " +printf "server $server_addr\n" > /etc/chrony/sources.d/dummy-server.sources && __test_ok || __test_fail + +printf "Reloading NTP sources: " +__reload_sources + +printf "Checking for dummy server availability: " +__check_sources "$server_addr" + +printf "Checking for dummy server availability after restarting chronyd: " +__restart_chronyd +__check_sources "$server_addr" + +exit 0 diff --git a/debian/tests/fragmented-configuration b/debian/tests/fragmented-configuration new file mode 100644 index 0000000..2135df3 --- /dev/null +++ b/debian/tests/fragmented-configuration @@ -0,0 +1,17 @@ +#!/bin/sh +# Make sure that fragmented configuration works as expected. + +set -e + +. debian/tests/helper-functions + +printf 'Setting "authselectmode prefer" as authentication policy: ' +echo "authselectmode prefer" > /etc/chrony/conf.d/authentication-policy.conf && __test_ok || __test_fail + +printf "Restart chronyd: " +systemctl --quiet restart chrony.service && __test_ok || __test_fail + +printf "Checking that chronyd uses the defined authentication policy: " +chronyd -p | grep -q "authselectmode prefer" && __test_ok || __test_fail + +exit 0 diff --git a/debian/tests/helper-functions b/debian/tests/helper-functions new file mode 100644 index 0000000..7df6ee9 --- /dev/null +++ b/debian/tests/helper-functions @@ -0,0 +1,53 @@ +__no_system_clock_control() { + if ! dpkg-vendor --derives-from Ubuntu; then + sed -i '/^DAEMON_OPTS=/s/"\(.*\)"/"\1 -x"/' /etc/default/chrony + mkdir -p /etc/systemd/system/chrony.service.d + cat <<EOF > /etc/systemd/system/chrony.service.d/override.conf +[Unit] +ConditionCapability= +EOF + systemctl daemon-reload + fi +} + +__test_fail() { + printf 'FAIL\n' >&2 + return 1 +} + +__test_ok() { + printf 'OK\n' + return 0 +} + +__test_skip() { + [ -n "$1" ] && printf 'SKIP: (%s)\n' "$1" || printf 'SKIP\n' + exit 77 +} + +__reload_sources() { + chronyc reload sources > /dev/null 2>&1 && __test_ok || __test_fail +} + +__restart_chronyd() { + systemctl --quiet restart chrony.service + rc=$? + sleep 3 + return $rc +} + +__check_sources() { + chronyc sources | grep -q "$1" && __test_ok || __test_fail +} + +__check_auth() { + chronyc -c authdata | grep -q "$1" && __test_ok || __test_fail +} + +# Ubuntu's default config is fully populated causing issues with the test +# If any of those tests run on Ubuntu, clear some and restart the daemon +# to pick this up before entering the tests. +if grep -q "^pool.*ubuntu.pool.ntp.org" /etc/chrony/chrony.conf; then + sudo sed -i -e '/^pool.*ubuntu.pool.ntp.org/d' /etc/chrony/chrony.conf + __restart_chronyd +fi diff --git a/debian/tests/ntp-server-and-nts-auth b/debian/tests/ntp-server-and-nts-auth new file mode 100644 index 0000000..b7d8877 --- /dev/null +++ b/debian/tests/ntp-server-and-nts-auth @@ -0,0 +1,59 @@ +#!/bin/sh +# Check that chronyd is able to authenticate NTP packets when NTS is enabled +# on the server. + +set -e + +. debian/tests/helper-functions + +cert_dir="/var/lib/chrony" +cert_template="$cert_dir/cert.cfg" +cert_file="$cert_dir/server.crt" +priv_key="$cert_dir/server.key" +server_addr="127.0.1.1" +server_name="chrony-nts-test" + +create_cert_template() { + printf "Creating certificate template: " + cat <<EOF > "$cert_template" +cn = "$server_name" +serial = 001 +activation_date = "$(date -d '1 year ago' +'%Y-%m-%d') 00:00:00 UTC" +expiration_date = "$(date -d '1 year' +'%Y-%m-%d') 00:00:00 UTC" +signing_key +encryption_key +EOF +} + +generate_cert() { + printf "Generating self-signed certificate: " + certtool --generate-privkey --key-type=ed25519 --outfile "$priv_key" > /dev/null 2>&1 + certtool --generate-self-signed --load-privkey "$priv_key" --template "$cert_template" \ + --outfile "$cert_file" > /dev/null 2>&1 +} + +server_config() { + printf "Preparing chronyd configuration: " + cat <<EOF > /etc/chrony/conf.d/local-server-config.conf +server $server_name nts minpoll -6 maxpoll -6 +ntsserverkey $priv_key +ntsservercert $cert_file +ntstrustedcerts $cert_file +EOF + + __no_system_clock_control + __restart_chronyd +} + +echo "$server_addr $server_name" >> /etc/hosts + +create_cert_template && __test_ok || __test_skip "unable to create certificate template" + +generate_cert && __test_ok || __test_skip "unable to generate self-signed certificate" + +server_config && __test_ok || __test_skip + +printf "Checking if server authenticates NTP packets: " +__check_auth "$server_addr,NTS" + +exit 0 diff --git a/debian/tests/time-sources-from-dhcp-servers b/debian/tests/time-sources-from-dhcp-servers new file mode 100644 index 0000000..f5e7899 --- /dev/null +++ b/debian/tests/time-sources-from-dhcp-servers @@ -0,0 +1,44 @@ +#!/bin/sh +# Ensure that NTP servers obtained from DHCP are made available to chronyd and +# that they are removed when releasing the DHCP lease. + +set -e + +prepare_iface() { + modprobe dummy + ip link add name dummy0 type dummy + ip address add 192.168.1.1/24 dev dummy0 + ip link set dev dummy0 up +} + +dhcpd_config() { +cat <<EOF > /etc/dhcp/dhcpd.conf +default-lease-time 600; +max-lease-time 7200; +authorative; + +subnet 192.168.1.0 netmask 255.255.255.0 { + option subnet-mask 255.255.255.0; + option broadcast-address 192.168.1.255; + option ntp-servers 192.168.1.50; + range 192.168.1.42 192.168.1.100; +} +EOF + +sed -i '/INTERFACESv4=/s/".*"/"dummy0"/' /etc/default/isc-dhcp-server +} + +chk_time_src() { + chronyc -n sources | grep -q -F '192.168.1.50' +} + +printf "Preparing the dummy network interface and dhcpd configuration…\n" +if prepare_iface && dhcpd_config; then + systemctl restart isc-dhcp-server && dhclient dummy0 && printf "Done!\n\n" +fi + +printf "Check if the NTP server is made available to chronyd…\n" +chk_time_src && printf "SUCCESS!\n\n" + +printf "Release the current lease and check if the NTP server has been correctly removed…\n" +dhclient -r dummy0 > /dev/null 2>&1 && ! chk_time_src && printf "SUCCESS!\n\n" diff --git a/debian/tests/upstream-simulation-test-suite b/debian/tests/upstream-simulation-test-suite new file mode 100644 index 0000000..a0b8517 --- /dev/null +++ b/debian/tests/upstream-simulation-test-suite @@ -0,0 +1,41 @@ +#!/bin/sh +# Upstream makes use of “clknetsim” to test how well “chronyd” controls the +# system clocks in various conditions. Due to “clknetsim” not being available +# in Debian, let’s use autopkgtest facility to build it in a container and +# test “chronyd” from there. + +set -e + +testdir="$PWD/test/simulation" +clknetsim_ver=f00531b +clknetsim_src=https://github.com/mlichvar/clknetsim/archive/"$clknetsim_ver"/clknetsim-"$clknetsim_ver".tar.gz +clknetsim_archive=$(basename "$clknetsim_src") + +export CLKNETSIM_PATH="$AUTOPKGTEST_TMP" + +# Always use the same seed to get deterministic results +export CLKNETSIM_RANDOM_SEED=24505 + +DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) + +# The simulation tests are only supported on Linux. +dpkg-architecture -ilinux-any || exit 77 + +prepare_clknetsim() { + # This symbolic link is necessary to prevent clknetsim from FTBFS. + ln -s /usr/include/"$DEB_HOST_MULTIARCH"/sys/time.h /usr/include/sys/ + + wget -P "$CLKNETSIM_PATH" "$clknetsim_src" 2>&1 || exit 77 + tar -xvzf "$CLKNETSIM_PATH"/"$clknetsim_archive" \ + -C "$CLKNETSIM_PATH" --strip-components=1 2>&1 || exit 77 + + if [ ! -x "$CLKNETSIM_PATH/clknetsim" ] && [ ! -e "$CLKNETSIM_PATH/clknetsim.so" ]; then + make -C "$CLKNETSIM_PATH" 2>&1 + fi +} + +run_test() { + cd "$testdir" && ./run +} + +prepare_clknetsim && run_test diff --git a/debian/tests/upstream-system-tests b/debian/tests/upstream-system-tests new file mode 100755 index 0000000..bd28a0c --- /dev/null +++ b/debian/tests/upstream-system-tests @@ -0,0 +1,24 @@ +#!/bin/sh +# Run the upstream system tests in a container. Destructive tests will be run in +# a VM as they may adjust/step the system clock, block the RTC, etc. +# In case of failure, test’s logs will be put into the directory specified by +# the $AUTOPKGTEST_ARTIFACTS environment variable. + +set -e + +testdir=$PWD/test/system +logdir="$testdir/tmp/*" + +# some tests need chrony installed, but make sure to avoid the test daemon is +# fighting with the systems chrony service over the clock +systemctl stop chrony.service 2>/dev/null || true + +run_test() { + cd "$testdir" && ./run "$@" +} + +artifacts() { + cp $logdir "$AUTOPKGTEST_ARTIFACTS" && exit 1 +} + +run_test "$@" || artifacts diff --git a/debian/upstream/metadata b/debian/upstream/metadata new file mode 100644 index 0000000..937fa97 --- /dev/null +++ b/debian/upstream/metadata @@ -0,0 +1,8 @@ +Documentation: https://chrony.tuxfamily.org/documentation.html +Changelog: https://chrony.tuxfamily.org/news.html +FAQ: https://chrony.tuxfamily.org/faq.html +Contact: chrony-users@chrony.tuxfamily.org +Security-Contact: Miroslav Lichvar <mlichvar@redhat.com> +Bug-Submit: chrony-users@chrony.tuxfamily.org +Repository: https://git.tuxfamily.org/chrony/chrony.git +Repository-Browse: https://git.tuxfamily.org/chrony/chrony.git/ diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc new file mode 100644 index 0000000..e12834f --- /dev/null +++ b/debian/upstream/signing-key.asc @@ -0,0 +1,52 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGCc9dwBEADLydyZIqgarshQeCtIlWAgP3coy0mdJwxet1CvXwF1xpq18Qi1 +Tt9RZL64SkbQ8sKryBqnPjKZdOfVT5FwUucjp9L+/j7Bhk0tqv30EIQ57rnDLJ9T +c4LG1leO+Tc5Ym/0tvv4uMjkxr4KAKHPYrweHk6EAw06bbJ02mfy9xhlITSfyyFl +QRoRTEjy8N2IDutA4QzbZm0T5kvI7k7s/ILG5vyNo53X5PI/rWrSqmPZ5qs0lvDv +tA+rxOJp+FvlvOyBuv3ftIX0kAwRU+x/ET2Yd9qQWnXRx9d9D2UpFXm9DHfCDJYR +F56D0O3hf+rrCa/uSutIqmR33j5Wz4bYjWdmg4wbRQaoVxJl5AUrWuYEFwcCuY2B +FFgttLPb0qHpeBwuWaWJ9U6HM7qY3WEI2C/OWM0XFM8ERezedNEf7O2GTsoVVcm+ +LRg31R3eJzipKMAGZWScSDSRAXhh6oZhflMRjYKGvwRfgeos/Sl2bdYL80hqyjGV +jMhEYDC9sfLXRyLU+9FexruIzSLR8Vornma3zjzu9pRkbfTHb8FfBMt9MZEWraF2 +7riRq/zJE9QPWnBL/C8rdaXXxflBmGctn7RDKGOvxZ7SxPzzHbl5tV/Fizhkeph/ +v8YLVuCOk0pIpX65mFun3Xw5IF01x1GMzU1xYezExti9yBNiv9HVqf1DWwARAQAB +tCZNaXJvc2xhdiBMaWNodmFyIDxtbGljaHZhckByZWRoYXQuY29tPokCVAQTAQgA +PhYhBI83XH6NDuElo9O9UVN+K3b3aA2sBQJgnPXcAhsDBQkSzAMABQsJCAcCBhUK +CQgLAgQWAgMBAh4BAheAAAoJEFN+K3b3aA2sl8IQAJ9AMppV6cdxzt8g2Ypz0hw1 +6+9T5DjbYE/s0lozFQhCoYfo+SZyc3+yyKzlxI3ryHwFk9NjXGZZ8QjzT7FLj7/s +nKDjv5hUCOAi9Q+k217xwlBueeMyheeVaGGGa+Hv5CF1fZx/MtxiShUqu8oSqUyP +nW8lPGz73MfGAPT7kijVnz73pbht0vrZ9I+r8dnQGiweGBohexfCvmncrTyhjM8r +nvecycYBNnXhupzpmSMZgIA1s2v7oVmTnV0bntxE/gr7+SPk7KozhD12K8OU8deJ +cDD8F7NKa9Oe5NtuGVN4IPqp5cgj7GAyIj0sYss9Jknu4jX0imR5kwH6GbgFa7c/ +kU+fKTz57Rs1OGr3glYpMnNftXSWbC2V/OJxHVEcMk8HwKLgnQjtmKLVGeCo5iS6 +LFQuWaxpfjvxVjGSpnNu19cHVUhDM9cTP1DhUd4LdnltHQ+/xjwgzTgE4GJ1ZB0W +vhvxcdb69Sf50bGd4/WuURRoYSE7M6UKRwfXmMpyTiNhZz+3XjAoScA9AS7q9xfS +y3OddQEle/+qNFdABB12WmCgRhWemHzTZDXydIJuw+ucLO7U5RrDdqdaHkRVXJ9G +4mdk+3FgUlYgB9GY4pHQdqGdE60838R2zY9x0gK8cHU+FaRPAiTU8SJL0wb/Rko7 +qbZUY/6bgrDoXp4otAP2uQINBGCc9dwBEADKy14JeburwGpEhfZ/sQj9ljojB886 +0TsR51s7F+j016SbdeC0mTmecI3ckd4CyVhi3ZHx6MR6UGKezy4DUtvUrgHOB0Pg +azuReIPRJsAydLnlGMVNRXMkkV310foC2m6UAnNrPW1ukWjMC7kDcWcJH1wpZD0J +rCJkxQNCp7VqR3PrhK9Sdoui0Euw/wSupu9pfcfM/ZPYKgGm18PsR7IrPn3zzBuS +Zhzqnh2LbKvtiVtVbwZwOEIdwyh/TkGg/YWWxIlAt5zJpS5Dxf69vbVkz2u5bgRw +Z1+eeiU11Zvrw1A8GdrKy32iskAsWzS8L0Nj5+Ujssgp7iFkdsWbP/ijwzIbSlAQ +FR3G6Fbuojwk1ONglTD2ib2A9olBJ3GTXlBiTkrhtuNC0izRhBRbA+2IF29Vx40A ++XItyouz/4R4twBudyLEE4mhOVYAXQ43t82An+VmmenNw0EAfZWm9kTM/uRXa+2e +mJhUVG5sUp7DHtJsMHKlXt6H1dHyrxOxKdE/GwYOd3QqslPISGw+cFHvfSZoTBZ8 +7OXpcJL/x29xIPdnYLtc1m+ZDM7rxhB7QiLpCMtQfqc0Dn0/ojgvpW5kR4T7JSfU +tNbxDSRPpxBLBsT8vaUR65lkiiOGYfsrI2/71v7zsAHdUbL8U34AXjjmsJpc/p9K +SU9NfGZ1IJnN+QARAQABiQI8BBgBCAAmFiEEjzdcfo0O4SWj071RU34rdvdoDawF +AmCc9dwCGwwFCRLMAwAACgkQU34rdvdoDaz7kQ/+N5DND+9YMXyUI+jwaT7YyFVX +5uEyD1iplfheP/XgsADwv6OOGMPp8Rq++0ZNg7Gkp9FedY9noEQlyrmQWcf7+iVz ++6qQ5N1HnJpeyH8U3fjfoJCN74lLK7eMpFIMlB/8Mv3nTBt4faoQUD9EcYg4HtfD ++mFKUEp6t7j+9snEzywSZaqf2Pfhl1Gqb3Mg6gRZ77Peong5km40n+ra4rNXLi7+ +n3pXeBzVGPy5iOTJWG8sG4FhqUjsilJU7chd9y6j51ne1Lkze0DbGMoxp5SW5JBo +vysLjWyKORrOGr2lEk3O0gS3QmJ3hCLe5re4YNErSh0AurP2pP8PMpdchcuYEbrD +uEAhU9mTEOo2VALmkBsdK4VkK/WpDTSRA7B0wUEfKcaRady3A13FF0knskkUhWS7 +foRMbw0MV7oXW2R2Bi9ROoOYLSUCp6GzbtozDs4gXA4r4QLKjcNj6KunyVS2r4wS +OQSNcQKpspiBMSRUpR3S7matPXFc2NxDo98dt2E8zyjTiP6ruI01E+AcovDstzzd +QQdJ+UqjkVidCnwMlRHsLIUgKie862ebCV1pynlUKgToORMJDgfK8/zN5qoK5wUY +qoS4oohubShEwNWCEBlyGz/Ldb6qEK6b2GiX5JN5EJZLcXxZA0bfHSiMaRZPLj4j +W23ALtrl30a0MaWqnDo= +=kLnA +-----END PGP PUBLIC KEY BLOCK----- diff --git a/debian/usr.sbin.chronyd b/debian/usr.sbin.chronyd new file mode 100644 index 0000000..bc52d4f --- /dev/null +++ b/debian/usr.sbin.chronyd @@ -0,0 +1,85 @@ +# vim:syntax=apparmor +# Last Modified: Sun Sep 05 16:48:05 2021 + +abi <abi/3.0>, + +#include <tunables/global> + +/usr/sbin/chronyd flags=(attach_disconnected) { + #include <abstractions/base> + #include <abstractions/nameservice> + + # For /run/chrony to be created + capability chown, + + # Give “root” the ability to read and write the PID file + capability dac_override, + capability dac_read_search, + + # Needed to support HW timestamping + capability net_admin, + + # Needed to allow NTP server sockets to be bound to a privileged port + capability net_bind_service, + + # Needed to allow an NTP socket to be bound to a device using the + # SO_BINDTODEVICE socket option on kernels before 5.7 + capability net_raw, + + # Needed to drop privileges + capability setgid, + capability setuid, + + # Needed to set the SCHED_FIFO real-time scheduler at the specified priority + # using the '-P' option + capability sys_nice, + + # Needed to lock chronyd into RAM + capability sys_resource, + + # Needed to set the system/real-time clock + capability sys_time, + + /usr/sbin/chronyd mr, + + /etc/chrony/{,**} r, + /var/lib/chrony/{,*} rw, + /var/log/chrony/{,*} rw, + @{run}/chrony/{,*} rw, + @{run}/chrony-dhcp/{,*} r, + + # Using the “tempcomp” directive gives chronyd the ability to improve + # the stability and accuracy of the clock by compensating the temperature + # changes measured by a sensor close to the oscillator. + @{sys}/class/hwmon/hwmon[0-9]*/temp[0-9]*_input r, + @{sys}/devices/virtual/thermal/thermal_zone[0-9]*/hwmon[0-9]*/temp[0-9]*_input r, + + # Support all paths suggested in the man page (LP: #1771028). Assume these + # are common use cases; others should be set as local include (see below). + # Configs using a 'chrony.' prefix like the tempcomp config file example + /etc/chrony.* r, + # Example gpsd socket is outside @{run}/chrony/ + @{run}/chrony.*.sock rw, + # To sign replies to MS-SNTP clients by the smbd daemon + /var/lib/samba/ntp_signd/socket rw, + + # rtc + /etc/adjtime r, + /dev/rtc{,[0-9]*} rw, + + # gps devices + /dev/pps[0-9]* rw, + /dev/ptp[0-9]* rw, + + # Allow reading the chronyd configuration file that timemaster(8) generates + @{run}/timemaster/chrony.conf r, + + # For use with clocks that report via shared memory (e.g. gpsd), + # you may need to give ntpd access to all of shared memory, though + # this can be considered dangerous. See https://launchpad.net/bugs/722815 + # for details. To enable, add this to local/usr.sbin.chronyd: + # capability ipc_owner, + + # Site-specific additions and overrides. See local/README for details. + #include <local/usr.sbin.chronyd> +} diff --git a/debian/watch b/debian/watch new file mode 100644 index 0000000..7fc35e4 --- /dev/null +++ b/debian/watch @@ -0,0 +1,3 @@ +version=4 +opts="pgpsigurlmangle=s/\.tar\.gz$/-tar-gz-asc.txt/,uversionmangle=s/-pre/~pre/" \ +https://download.tuxfamily.org/@PACKAGE@/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@ |