summaryrefslogtreecommitdiffstats
path: root/debian
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--debian/.gitlab-ci.yml9
-rw-r--r--debian/NEWS70
-rw-r--r--debian/README.Debian29
-rw-r--r--debian/changelog2612
-rw-r--r--debian/chrony-dnssrv@.service17
-rw-r--r--debian/chrony-dnssrv@.timer9
-rwxr-xr-xdebian/chrony-helper264
-rw-r--r--debian/chrony.conf47
-rw-r--r--debian/chrony.default6
-rw-r--r--debian/chrony.dhcp27
-rw-r--r--debian/chrony.examples1
-rw-r--r--debian/chrony.if-post-down11
-rw-r--r--debian/chrony.if-up11
-rw-r--r--debian/chrony.keys10
-rw-r--r--debian/chrony.lintian-overrides7
-rw-r--r--debian/chrony.maintscript1
-rw-r--r--debian/chrony.ppp.ip-down13
-rw-r--r--debian/chrony.ppp.ip-up12
-rw-r--r--debian/chrony.service65
-rw-r--r--debian/clean1
-rw-r--r--debian/conf.d/README7
-rw-r--r--debian/control54
-rw-r--r--debian/copyright187
-rw-r--r--debian/dirs6
-rw-r--r--debian/docs3
-rw-r--r--debian/init69
-rw-r--r--debian/install8
-rw-r--r--debian/links5
-rw-r--r--debian/ntp-units.d/50-chrony.list1
-rw-r--r--debian/patches/nm-dispatcher-dhcp_Move-server_dir-to-run.patch19
-rw-r--r--debian/patches/series1
-rw-r--r--debian/postinst80
-rw-r--r--debian/postrm56
-rw-r--r--debian/prerm28
-rwxr-xr-xdebian/rules49
-rw-r--r--debian/source/format1
-rw-r--r--debian/sources.d/README12
-rw-r--r--debian/tests/control28
-rw-r--r--debian/tests/dynamically-add-source27
-rw-r--r--debian/tests/fragmented-configuration17
-rw-r--r--debian/tests/helper-functions53
-rw-r--r--debian/tests/ntp-server-and-nts-auth59
-rw-r--r--debian/tests/time-sources-from-dhcp-servers44
-rw-r--r--debian/tests/upstream-simulation-test-suite41
-rwxr-xr-xdebian/tests/upstream-system-tests24
-rw-r--r--debian/upstream/metadata8
-rw-r--r--debian/upstream/signing-key.asc52
-rw-r--r--debian/usr.sbin.chronyd85
-rw-r--r--debian/watch3
49 files changed, 4249 insertions, 0 deletions
diff --git a/debian/.gitlab-ci.yml b/debian/.gitlab-ci.yml
new file mode 100644
index 0000000..f0c060e
--- /dev/null
+++ b/debian/.gitlab-ci.yml
@@ -0,0 +1,9 @@
+---
+include:
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+ - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
+
+# Skip the reprotest job as long as it is run as root due to problems with
+# chrony system tests.
+variables:
+ SALSA_CI_DISABLE_REPROTEST: 1
diff --git a/debian/NEWS b/debian/NEWS
new file mode 100644
index 0000000..fe7e4b9
--- /dev/null
+++ b/debian/NEWS
@@ -0,0 +1,70 @@
+chrony (4.1~pre1-1) experimental; urgency=medium
+
+ Starting with chrony 4.0, it is possible to specify NTP sources in files
+ having the .sources suffix. In Debian, these files can be placed in
+ /etc/chrony/sources.d/ or any other directories specified by the 'sourcedir'
+ directive.
+ I would like to draw your attention that with chrony 4.1, each line of a
+ source file *must* be terminated by a trailing newline. Failing that, the NTP
+ source(s) will be ignored.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 25 Apr 2021 12:44:09 +0200
+
+chrony (3.4-2) unstable; urgency=medium
+
+ To reduce the range of operations available to chronyd, and thereby decrease
+ the kernel attack surface, a system call filter is now active by default
+ wherever¹ possible.
+ Please, take into account that this change prevents the use of the
+ “mailonchange” directive in chrony.conf as the chronyd process will not be
+ allowed to fork and execute the sendmail binary. Therefore, it is fundamental
+ to disable the system call filter to continue using this directive!
+
+ To do so, edit the /etc/default/chrony file and substitute the “-F -1”
+ parameter with “-F 0”. Restart chrony afterward.
+
+ ¹Are currently excluded alpha, ia64, m68k, riscv64, sh4 and sparc64
+ architectures due to lack of support in “libseccomp” and/or the Linux kernel.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 10 Feb 2019 18:44:22 +0100
+
+chrony (2.2.1-1) unstable; urgency=medium
+
+ In chrony versions before 2.2, the 'chrony.keys' file contained a command
+ key used for run-time configuration via the 'chronyc' command-line tool.
+ Starting from this version, support for this authentication method has been
+ dropped in favor of a Unix domain socket accessible only *locally* by root or
+ the _chrony system user. Consequently, if you refuse to use the 'chrony.keys'
+ file template provided by the maintainers when upgrading, please don’t forget
+ to manually remove the obsolete command key (ID 1) in the aforementioned file.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 07 Feb 2016 17:02:30 +0100
+
+chrony (2.1.1-1) unstable; urgency=medium
+
+ From this version, 'chronyd' will strictly act as an NTP client by default. If
+ you want it to serve time to other systems, please do so by configuring the
+ 'allow' directive.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 12 Oct 2015 19:12:39 +0200
+
+chrony (1.31.1-1) unstable; urgency=medium
+
+ From now on, we use the "hwclockfile" directive in /etc/chrony/chrony.conf.
+ Basically, it makes the detection of the standard (Local or UTC time) set
+ in /etc/adjtime — and used by the hardware clock — clearer compared to the
+ text processing method we used to use in the post install script to complete
+ the same task. Note that it overrides the "rtconutc" directive.
+
+ Also, we now create the _chrony system user to which chronyd will drop root
+ privileges. For users already allowing chronyd to drop root privileges in
+ favor of the user configured by the "user" directive in
+ /etc/chrony/chrony.conf, your configuration will remain unchanged and will
+ still work as intended.
+ However, some users might use a custom init script to accomplish the same
+ task by invoking chronyd with the '-u' option. We advise you to drop this
+ option from your init script before upgrading, otherwise you’ll have to
+ readjust the owner of the /var/l{ib,og}/chrony directories (recursively) to
+ the user you configured in your init script.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 6 Sep 2015 22:14:54 +0200
diff --git a/debian/README.Debian b/debian/README.Debian
new file mode 100644
index 0000000..2188ed9
--- /dev/null
+++ b/debian/README.Debian
@@ -0,0 +1,29 @@
+Chrony for Debian
+-----------------
+
+ Notes about Debian-specific changes:
+
+ - Default chrony’s configuration files are located in the /etc/chrony directory.
+ It is filled by two important files:
+ → chrony.conf (configuration of the chronyd daemon, see man 5 chrony.conf
+ for further information)
+
+ → chrony.keys (lists keys used for NTP packets authentication, see
+ the “keyfile” directive in the chrony.conf(5) man page)
+
+ - We also provide /etc/ppp/ip-up.d/chrony and /etc/ppp/ip-down.d/chrony
+ to put chronyd online/offline depending on the PPP link status.
+
+ - Since version 1.31.1-1, we create the _chrony system user to which chronyd
+ will drop root privileges on initialisation. For users already allowing
+ chronyd to drop root privileges in favor of the user configured by the "user"
+ directive in chrony.conf, your configuration will remain unchanged and will
+ still work as it did. However, if you don’t want to deviate from Debian’s
+ default configuration, delete or comment out the "user" directive in
+ chrony.conf and recursively change the owner of the /var/lib/chrony and
+ /var/log/chrony directories. For example:
+
+ # sed -i 's/^user/#user/' /etc/chrony/chrony.conf
+ # chown -R _chrony:_chrony /var/l{ib,og}/chrony
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 01 Mar 2019 19:02:12 +0100
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..8474242
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,2612 @@
+chrony (4.3-2+deb12u1) unstable; urgency=medium
+
+ * debian/usr.sbin.chronyd:
+ - Modify the AppArmor profile to allow more gpsd socket names. This will
+ avoid the need for users to override the profile to let chronyd consume PPS
+ samples or serial time supplied by gpsd over a Unix-domain socket.
+ Thanks to Ryan Govostes for the report. (Closes: #1034519)
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 08 May 2023 22:05:00 +0200
+
+chrony (4.3-2) unstable; urgency=medium
+
+ * debian/control:
+ - Bump Standards-Version to 4.6.2 (no changes needed).
+
+ * debian/copyright:
+ - Update copyright year for debian/*.
+
+ * debian/.gitlab-ci.yml:
+ - Use the recommended syntax to skip a job.
+
+ * debian/install:
+ - Install the chrony-wait.service systemd unit.
+
+ * debian/postinst:
+ - Ensure that chronyd can read the /etc/chrony/chrony.keys file after
+ dropping root privileges.
+
+ * debian/postrm:
+ - Remove the override for /etc/chrony/chrony.keys when purging chrony.
+
+ * debian/rules:
+ - Do not enable nor start chrony-wait.service for the time being.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Run each test only once. Running several iterations is no longer
+ relevant since we use a hard coded seed.
+
+ [ Taylor Stearns ]
+ * debian/chrony.conf:
+ - Replace U+2019 with ASCII quote. (MR: !10)
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 27 Jan 2023 22:51:17 +0100
+
+chrony (4.3-1) unstable; urgency=medium
+
+ * Import upstream version 4.3:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/copyright:
+ - Update copyright years.
+
+ [ Bastian Blank ]
+ * debian/chrony.service:
+ - Let systemd handle directories. (MR: !9)
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 31 Aug 2022 13:32:14 +0200
+
+chrony (4.3~pre1-1) experimental; urgency=medium
+
+ * Import upstream version 4.3-pre1:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/chrony.lintian-overrides:
+ - Update lintian override syntax.
+
+ * debian/control:
+ - Bump Standards-Version to 4.6.1 (no changes needed).
+
+ * debian/patches/*:
+ - Drop ensure_awk_commands_in_008-ntpera_test_return_an_integer.patch,
+ applied upstream.
+ - Refresh nm-dispatcher-dhcp_Move-server_dir-to-run.patch.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Update clknetsim version.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 11 Aug 2022 14:12:25 +0200
+
+chrony (4.2-2) unstable; urgency=medium
+
+ * debian/usr.sbin.chronyd:
+ - Allow reading the chronyd configuration file that timemaster(8)
+ generates. Thanks to Michael Lestinsky for the report! (Closes: #1004745)
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 01 Feb 2022 20:42:35 +0100
+
+chrony (4.2-1) unstable; urgency=medium
+
+ * Import upstream version 4.2:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/chrony.service:
+ - Adopt upstream service unit hardening options.
+
+ * debian/copyright:
+ - Update copyright years.
+
+ * debian/patches/*:
+ - Drop patches applied upstream.
+ - Add ensure_awk_commands_in_008-ntpera_test_return_an_integer.patch
+
+ * debian/test/upstream-simulation-test-suite:
+ - Update clknetsim version.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 13 Jan 2022 14:01:35 +0100
+
+chrony (4.1-4) unstable; urgency=medium
+
+ * debian/:
+ - Remove empty preinst maintainer script.
+
+ * debian/chrony.lintian-overrides:
+ - Remove unused overrides.
+
+ * debian/control:
+ - Bump Standards-Version to 4.6.0 (no changes needed).
+
+ * debian/patches/*:
+ - Add fix-seccomp-filter-for-BINDTODEVICE-socket-option.patch.
+ (Closes: #995207)
+
+ * debian/usr.sbin.chronyd:
+ - Add 'vim:syntax=apparmor' modline.
+ - Add feature ABI rule. Starting with AppArmor 3.0, policy needs to contain
+ an abi rule to indicate which feature abi the policy was developed under.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 07 Oct 2021 15:23:28 +0200
+
+chrony (4.1-3) unstable; urgency=medium
+
+ * Upload to unstable.
+
+ * debian/patches/:
+ - Add allow-clone3-and-pread64-in-seccomp-filter.patch.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Update clknetsim version.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 15 Aug 2021 15:08:56 +0200
+
+chrony (4.1-2) experimental; urgency=medium
+
+ * Merge branch 'debian/unstable' into 'debian/latest'.
+
+ * debian/rules:
+ - Remove needless dh_auto_test override.
+
+ [ Christian Ehrhardt ]
+ * debian/tests/helper-functions:
+ - Improve chronyd restart logic. While rendering the tests more readable,
+ this also fixes ntp-server-and-nts-auth test on Ubuntu.
+
+ [ Debian Janitor ]
+ * debian/{control,chrony.maintscript}:
+ - Remove constraints unnecessary since stretch.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sat, 26 Jun 2021 17:16:45 +0200
+
+chrony (4.1-1) experimental; urgency=medium
+
+ * Import upstream version 4.1:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/copyright:
+ - Update copyright years.
+
+ * debian/upstream/signing-key.asc:
+ - Update Miroslav Lichvar's key.
+
+ * debian/watch:
+ - Add upstream version mangle to transform -pre to ~pre.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 14 May 2021 00:25:34 +0200
+
+chrony (4.1~pre1-1) experimental; urgency=medium
+
+ * Import upstream version 4.1-pre1:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/control:
+ - Now that the upstream system tests support 'ss', replace the net-tools
+ build-dependency by iproute2.
+
+ * debian/NEWS:
+ - Mention that lines in *.sources files must be terminated by a trailing
+ newline.
+
+ * debian/patches/:
+ - Drop allow-IP_TOS-socket-option-in-seccomp-filter.patch. Applied
+ upstream.
+
+ * debian/postinst:
+ - Do not redirect 'chronyd -p' stderr to /dev/null. Not needed anymore.
+
+ * debian/sources.d/README:
+ - Mention that lines in *.sources files must be terminated by a trailing
+ newline.
+
+ * debian/tests/dynamically-add-source:
+ - Terminate the line in dummy-server.sources with the newline control
+ character.
+
+ * debian/tests/fragmented-configuration:
+ - Do not redirect 'chronyd -p' stderr to /dev/null. Not needed anymore.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Update clknetsim version.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 10 May 2021 18:56:53 +0200
+
+chrony (4.0-8) unstable; urgency=medium
+
+ * debian/patches/:
+ - Add allow-BINDTODEVICE-option-in-seccomp-filter.patch to enable support
+ for binding sockets to a device without having to disable the seccomp
+ filter.
+ - Add allow-getuid32-in-seccomp-filter.patch. Upstream found out that
+ getuid32() needed to be allowed in the seccomp filter to enable some NTS
+ operations on i686. This may affect other 32-bits architectures.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 13 May 2021 16:51:41 +0200
+
+chrony (4.0-7) unstable; urgency=medium
+
+ * debian/patches/:
+ - Add allow-IP_TOS-socket-option-in-seccomp-filter.patch to enable the use
+ of the 'dscp' directive.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 08 Apr 2021 16:21:16 +0200
+
+chrony (4.0-6) unstable; urgency=medium
+
+ * debian/tests/helper-functions:
+ - Instead of running 'systemctl restart chrony.service', use
+ __restart_chronyd() in the __no_system_clock_control() function.
+ - Run 'sleep 3' only if chronyd has successfully restarted.
+
+ [ Christian Ehrhardt ]
+ * debian/tests/{dynamically-add-source,ntp-server-and-nts-auth}:
+ - Reduce default Ubuntu config to make space for testcase config.
+
+ * debian/tests/helper-functions:
+ - Add more common functions and update some tests to use them.
+ - Wait after restarting chronyd. Without this, some tests break on Ubuntu by
+ checking state too early.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 21 Feb 2021 21:59:22 +0100
+
+chrony (4.0-5) unstable; urgency=medium
+
+ * Follow DEP-14 branch naming conventions:
+ master -> debian/latest
+ upstream -> upstream/latest
+
+ * debian/chrony.service:
+ - Enable some hardening settings.
+
+ * debian/control:
+ - Remove Joachim Wiedorn from the Uploaders field. This decision was taken
+ in agreement with him. Thanks a lot, Joachim, for your work on chrony and
+ for your benevolence when you handed me its maintenance.
+ - Point Vcs-Git to the debian/latest branch.
+
+ * debian/dirs:
+ - Do not create the /etc/apparmor.d/force-complain directory. Not needed
+ anymore.
+
+ * debian/postrm:
+ - Remove /run/chrony-dhcp on purge.
+
+ * debian/preinst:
+ - Drop old migration code snippet. It was used to put the newly provided
+ AppArmor profile in complain mode when upgrading chrony to prevent
+ regressions this profile could have caused. (Closes: #905485)
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 04 Feb 2021 19:49:22 +0100
+
+chrony (4.0-4) unstable; urgency=medium
+
+ * debian/chrony.examples:
+ - Provide example configuration files.
+
+ * debian/postinst:
+ - Run adduser unconditionally.
+ - Use 'chronyd -p' to check the whole configuration.
+
+ * debian/tests/:
+ - Prevent dynamically-add-source and ntp-server-and-nts-auth tests from
+ failing on chronyd's preparation step.
+ - Don't pass 'set -u' to dynamically-add-source and
+ ntp-server-and-nts-auth scripts.
+
+ * debian/tests/control:
+ - Mark dynamically-add-source as skippable.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 21 Jan 2021 20:02:39 +0100
+
+chrony (4.0-3) unstable; urgency=medium
+
+ * debian/:
+ - chronyd's configuration can now be fragmented. Please see
+ /etc/chrony/conf.d/README for more information.
+ - NTP sources can be specified in /etc/chrony/sources.d. Please see
+ /etc/chrony/sources.d/README for more information.
+
+ * debian/chrony.conf:
+ - Include configuration files found in /etc/chrony/conf.d.
+ - Use NTP sources found in /etc/chrony/sources.d.
+ - Get TAI-UTC offset and leap seconds from the system tz database by using
+ the "leapsectz right/UTC" directive. This directive must be commented out
+ when using time sources serving leap-smeared time. (Closes: #974845)
+ - Add missing comment.
+
+ * debian/chrony.default:
+ - Switch the seccomp filter to level 1.
+
+ * debian/chrony.lintian-overrides:
+ - Override breakout-link.
+
+ * debian/control:
+ - Add tzdata to the dependencies.
+ - Bump Standards-Version to 4.5.1 (no changes required).
+
+ * debian/copyright:
+ - Update copyright year for debian/*.
+
+ * debian/postinst:
+ - Use dpkg-statoverride to manage mode bits and ownership of
+ /var/l{ib,og}/chrony.
+
+ * debian/postrm:
+ - Remove overrides for /var/l{ib,og}/chrony on purge.
+
+ * debian/rules:
+ - Drop '--without-readline' option. GNU readline support has been dropped
+ upstream due to license incompatibility.
+ - Replace -F -1 by -F 1 in the sed invocation.
+
+ * debian/tests/:
+ - Add fragmented-configuration autopkgtest.
+ - Add dynamically-add-source autopkgtest.
+ - Add ntp-server-and-nts-auth autopkgtest.
+
+ * debian/tests/control:
+ - Mark ntp-server-and-nts-auth as skippable.
+
+ * debian/tests/fragmented-configuration:
+ - Use another directive for the test since "leapsectz right/UTC" is now
+ used by default.
+
+ * debian/tests/helper-functions:
+ - Add __no_system_clock_control() function.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Always use the same seed to get deterministic results.
+
+ * debian/upstream/metadata:
+ - Remove obsolete field Name. Thanks to Debian Janitor <janitor@jelmer.uk>.
+
+ * debian/usr.sbin.chronyd:
+ - Make use of the @{run} variable.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 18 Jan 2021 21:58:52 +0100
+
+chrony (4.0-2) unstable; urgency=medium
+
+ * Merge branch 'experimental' into 'master'.
+
+ * Upload to unstable.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 13 Oct 2020 15:59:33 +0200
+
+chrony (4.0-1) experimental; urgency=medium
+
+ * Import upstream version 4.0:
+ - This release adds support for the Network Time Security (NTS)
+ authentication mechanism (RFC 8915).
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 07 Oct 2020 19:14:51 +0200
+
+chrony (4.0~pre4-2) experimental; urgency=medium
+
+ * debian/postinst:
+ - Fix user and group ownership of "/var/lib/chrony" to allow chronyd
+ to write in it. This will also fix a regression in the 104-systemdirs
+ test.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sat, 03 Oct 2020 11:20:02 +0200
+
+chrony (4.0~pre4-1) experimental; urgency=medium
+
+ * Import upstream version 4.0-pre4:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * Merge branch 'master' into experimental. (Closes: #970421)
+
+ * debian/chrony.conf:
+ - Use NTP sources from /run/chrony-dhcp.
+ - Save NTS keys and cookies in /var/lib/chrony/.
+
+ * debian/chrony-dnssrv@.service:
+ - Update "chrony-helper" path.
+
+ * debian/chrony.dhcp:
+ - Save NTP servers from DHCP to /run/chrony-dhcp/$interface.sources.
+
+ * debian/chrony.lintian-overrides:
+ - Override executable-in-usr-lib for NetworkManager dispatcher scripts.
+ - Update NetworkManager dispatcher script name.
+
+ * debian/chrony.ppp.ip-{down,up}:
+ - Update PID file path.
+
+ * debian/chrony.service:
+ - Update PID file path.
+ - Do not run 'chrony-helper update-daemon' after starting chronyd. Not
+ needed anymore.
+
+ * debian/control:
+ - Build-depend on libgnutls28-dev to support NTS.
+ - Build-depend on gnutls-bin for the test suite.
+ - Bump debhelper-compat to 13.
+
+ * debian/copyright:
+ - Update copyright years.
+
+ * debian/dirs:
+ - Remove var/log/chrony as it will be created automatically if it doesn’t
+ exist.
+
+ * debian/if-{post-down,up}:
+ - Update PID file path.
+
+ * debian/init:
+ - Update PID file path.
+ - Drop the unnecessary '--remove pidfile' option from the stop target.
+ - Do not run 'chrony-helper update-daemon' after starting chronyd. Not
+ needed anymore.
+
+ * debian/install:
+ - Move "chrony-helper" to "/usr/libexec/chrony".
+
+ * debian/links:
+ - Update source and destination filenames.
+
+ * debian/patches/:
+ - Drop patches applied upstream.
+ - Add nm-dispatcher-dhcp_Move-server_dir-to-run.patch.
+
+ * debian/postinst:
+ - Drop migration code from pre-Stretch.
+ - Migrate NTP sources obtained from DHCP to /run/chrony-dhcp on upgrade
+ from chrony < 4.0~pre4-1.
+ - Remove staled PID file when upgrading from chrony < 4.0~pre4-1.
+
+ * debian/rules:
+ - Change the default PID file location from /run to /run/chrony.
+ - Drop dh_missing --fail-missing. This is the default in debhelper 13.
+ - Enable seccomp support by default on riscv64.
+ - Update NetworkManager dispatcher script name from 20-chrony to
+ 20-chrony-onoffline.
+ - Add DHCP NetworkManager dispatcher script to allow chronyd to use
+ NTP sources obtained from NM's internal DHCP client.
+
+ * debian/tests/:
+ - Add some helper functions. Some tests will be updated thereafter
+ to use them.
+
+ * debian/tests/time-sources-from-dhcp-servers:
+ - Adapt to the new way of using time sources from DHCP.
+ - Improve sed invocation.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Update clknetsim version.
+ - Cosmetic changes.
+
+ * debian/tests/upstream-system-tests:
+ - No need to stop systemd-timesyncd anymore since it is no more
+ co-installable with chrony anymore.
+
+ * debian/usr.sbin.chronyd:
+ - Update PID file path.
+ - Add dac_override and dac_read_search capabilities to give "root" the
+ ability to write the PID file in /run/chrony/.
+ - Prefix flag definition by "flags=".
+ - Sort the capabilities.
+ - Grant CAP_NET_RAW capability to allow an NTP socket to be bound to a
+ device using the SO_BINDTODEVICE socket option on kernels before 5.7.
+ - Add comments regarding capabilities.
+ - Let chronyd create /var/l{ib,og}/chrony.
+ - Remove a superfluous rule.
+ - Allow reading of NTP sources in /run/chrony-dhcp/.
+
+ * debian/watch:
+ - Make use of special strings.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 02 Oct 2020 21:21:08 +0200
+
+chrony (3.5.1-1) unstable; urgency=medium
+
+ * Import upstream version 3.5.1:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+ - CVE-2020-14367: create new file when writing pidfile.
+
+ * debian/chrony.lintian-overrides:
+ - Remove unused override.
+
+ [ Ville Skyttä ]
+ * debian/chrony.conf:
+ - Comment spelling fix. (MR: !5)
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 20 Aug 2020 14:07:22 +0200
+
+chrony (3.5-9) unstable; urgency=medium
+
+ * debian/patches/:
+ - Add allow-some-*time64-syscalls-in-seccomp-filter.patch. Needed for
+ 32-bit architectures with new system calls using 64-bit time_t.
+ (LP: #1878005)
+
+ * debian/tests/control:
+ - Add needs-internet restriction to the upstream-simulation-test-suite
+ test.
+
+ [ Christian Ehrhardt ]
+ * debian/tests/upstream-simulation-test-suite:
+ - Skip if preparation steps fail.
+ - Make preparation steps more verbose.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 19 May 2020 16:42:18 +0200
+
+chrony (3.5-8) unstable; urgency=medium
+
+ * debian/postrm:
+ - Stop starting systemd-timesyncd in postrm. This is no longer relevant
+ since systemd-timesyncd is a standalone package declaring
+ Conflicts/Replaces/Provides: time-daemon. (Closes: #955773)
+
+ [ Christian Ehrhardt ]
+ * debian/tests/upstream-system-tests:
+ - Stop chrony/systemd-timesynd before running these tests. (LP: #1870144)
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 05 Apr 2020 17:44:31 +0200
+
+chrony (3.5-7) unstable; urgency=medium
+
+ * debian/chrony.maintscript:
+ - Remove the /etc/NetworkManager/dispatcher.d/20-chrony conffile.
+
+ * debian/control:
+ - Support seccomp facility on riscv64. It should be noted that the system
+ call filter will stay disabled by default on this architecture until
+ Linux >= 5.5 hits unstable.
+ - Bump libseccomp-dev build-dep to 2.4.3-1~ to provide seccomp facility on
+ riscv64.
+ - Break network-manager (<< 1.20.0-1~). Prior to this version,
+ NetworkManager would not look for dispatcher scripts into
+ /usr/lib/NetworkManager/dispatcher.d/.
+
+ * debian/dirs:
+ - Create the usr/lib/NetworkManager/dispatcher.d subdirectories.
+
+ * debian/links:
+ - Change the location of the NetworkManager dispatcher script.
+
+ * debian/patches/:
+ - Add allow-renameat2-in-seccomp-filter.patch. Required as the riscv64
+ architecture does not support the rename() and renameat() system calls.
+
+ * debian/rules:
+ - Move the NetworkManager dispatcher script in
+ /usr/lib/NetworkManager/dispatcher.d/.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 17 Mar 2020 15:21:53 +0100
+
+chrony (3.5-6) unstable; urgency=medium
+
+ * debian/chrony.service:
+ - Don’t conflict with systemd-timesyncd.service.
+ A few users complain that chronyd does not start at boot. The way the
+ Conflict= directive works internally might cause both systemd-timesyncd
+ and chronyd to be inactive at boot. So by relying solely on the
+ disable-with-time-daemon.conf drop-in file provided by systemd, we should
+ get rid of this malfunction while still preventing these two time daemons
+ from being active at the same time. Kudos notably go to Santiago Vila for
+ the report and providing SSH access to a GCE instance where the issue was
+ reproducible and Michael Biebl for debugging. (Closes: #947936)
+
+ * debian/control:
+ - Bump Standards-Version to 4.5.0 (no changes required).
+ - No need to explicitly conflict with ntp as it now provides time-daemon.
+
+ * debian/copyright:
+ - Update copyright year for debian/*.
+
+ * debian/patches/:
+ - Add allow-clock_adjtime-in-seccomp-filter.patch.
+ glibc 2.31 switched the adjtimex() function to the clock_adjtime
+ system call.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Update clknetsim version. This new version supports glibc >= 2.31 headers.
+ (LP: #1866753)
+
+ * debian/tests/control:
+ - Run the upstream-simulation-test-suite as root.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 10 Mar 2020 19:17:16 +0100
+
+chrony (3.5-5) unstable; urgency=medium
+
+ * debian/control:
+ - Bump standard-version to 4.4.1 (no change required).
+
+ * debian/install:
+ - Install 50-chrony.list in /usr/lib/systemd/ntp-units.d.
+
+ * debian/ntp-units.d/50-chrony.list:
+ - Allow timedated to interact with chronyd.
+
+ * debian/patches/*:
+ - Cherry-pick upstream commits to better manage RTCs that don't support
+ interrupts. This fixes an issue exhibited when a specific upstream system
+ test is run on the Ubuntu CI. Thank to Christian Ehrhardt for working
+ with Miroslav Lichvar to address this problem.
+
+ * debian/tests/control:
+ - Use @builddeps@ as a test dependency for upstream_system_tests.
+
+ [ Christian Ehrhardt ]
+ * debian/tests/upstream-simulation-test-suite:
+ - Redirect stderr on make call to stdout. On some architectures (e.g. armhf)
+ the clksim tests compile but throw some warnings. (MR: !2)
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 22 Dec 2019 17:30:40 +0100
+
+chrony (3.5-4) unstable; urgency=medium
+
+ * debian/tests/control:
+ - Add @builddeps@ to the list of dependencies needed by the
+ upstream-simulation-test-suite test.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 30 Aug 2019 00:49:20 +0200
+
+chrony (3.5-3) unstable; urgency=medium
+
+ * debian/chrony.lintian-overrides:
+ - Override package-supports-alternative-init-but-no-init.d-script. This
+ is a false positive. chrony-dnssrv@.service isn’t a daemon but a oneshot
+ service, not started at boot, whose role is to lookup for _ntp._udp DNS SRV
+ records.
+
+ * debian/chrony.service:
+ - Pull in time-sync.target and order chrony before it as recommended in
+ systemd.special(7).
+
+ * debian/control:
+ - Bump standard-version to 4.4.0 (no changes required).
+
+ * debian/.gitlab-ci.yml:
+ - Switch to standard Salsa Pipeline.
+ - Skip the reprotest job for as long as it is run as root due to problems
+ with chrony system tests.
+
+ * debian/tests/*:
+ - Revamp the upstream-simulation-test-suite test.
+ - Adjust dpkg dependencies for upstream-simulation-test-suite.
+ - Adjust restrictions for upstream-simulation-test-suite.
+ - Introduce upstream-system-tests. Add a new set of tests for testing
+ basic chronyd functionality. Destructive tests are run in a virtual
+ machine.
+ - Add ethtool to the list of dependencies needed by
+ run_destructive_system_tests.
+ - exit 77 if upstream-simulation-test-suite is run on non-Linux and mark
+ the test as skippable. Thanks to Paul Gevers <elbrus@debian.org> for the
+ suggestion.
+ - Make artifacts() exit 1. Again, thanks to Paul Gevers.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 13 Aug 2019 17:57:47 +0200
+
+chrony (3.5-2) unstable; urgency=medium
+
+ * Merge branch “experimental” into “master”.
+
+ * debian/chrony.dhcp:
+ - Fix shellcheck warnings. Patch imported from Fedora.
+
+ * debian/chrony-helper:
+ - Fix shellcheck warnings. Patch imported from Fedora.
+
+ * debian/clean:
+ - Drop obsolete entries.
+
+ * debian/copyright:
+ - Update copyright years.
+ - Update copyright holder for the configure script.
+
+ * debian/patches/*:
+ - Add update_processing_of_packet_log.patch. This fixes a regression in
+ the simulation tests exhibited by the recent clknetsim changes.
+ (Closes: #931181)
+
+ * debian/rules:
+ - Use dh_missing --fail-missing.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Use a known good clknetsim commit. This should prevent regressions from
+ on-going “clknetsim” development.
+
+ * debian/usr.sbin.chronyd:
+ - Grant access rights only to the ntp_signd socket. (Closes: #928170)
+
+ [ Christian Ehrhardt ]
+ * debian/postrm:
+ - Re-establish systemd-timesyncd on removal. (MR: !1)
+
+ -- Vincent Blut <vincent.debian@free.fr> Sat, 06 Jul 2019 20:33:41 +0200
+
+chrony (3.5-1) experimental; urgency=medium
+
+ * Import upstream version 3.5:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/control:
+ - Ignore net-tools and procps build-dependencies if the profile nocheck is
+ active.
+
+ * debian/rules:
+ - No test suite should be run if nocheck is passed to DEB_BUILD_OPTIONS.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 15 May 2019 18:44:12 +0200
+
+chrony (3.5~pre1-1) experimental; urgency=medium
+
+ * Import upstream version 3.5-pre1:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/.gitlab-ci.yml:
+ - Use .build-package template job instead of .build-unstable. The latter
+ is deprecated.
+
+ * debian/chrony.keys:
+ - Fix the comment about the location of the list of supported hash
+ functions and output encoding. These information are now available by
+ consulting the “keyfile” directive in the chrony.conf(5) man page.
+
+ * debian/control:
+ - Drop dependency on lsb-base. Is is required when booting with sysvinit
+ and initscripts, however initscripts already Depends on lsb-base.
+ - Build-depend on net-tools and procps. kill, netstat and ps are needed
+ for the new system tests executed at build time (iff building as root).
+
+ * debian/copyright:
+ - Add an entry for test/system/* files.
+
+ * debian/patches/*:
+ - Drop all patches, they have been applied upstream.
+
+ * debian/postinst:
+ - Drop migration code from pre-stretch.
+
+ * debian/README.Debian:
+ - Fix information related to the chrony.keys file.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 12 May 2019 22:16:14 +0200
+
+chrony (3.4-4) unstable; urgency=medium
+
+ * debian/patches/*:
+ - Add allow-further-syscalls-in-seccomp-filter.patch. Supplementing the
+ seccomp filter whitelist with those syscalls is a prerequisite, notably for
+ the arm64 architecture.
+
+ [ Leigh Brown ]
+ * debian/patches/*:
+ - Add allow-recv-send-in-seccomp-filter.patch. Necessary on armel and
+ ppc64el. Other architectures might also be affected. (Closes: #924494)
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 18 Mar 2019 19:35:34 +0100
+
+chrony (3.4-3) unstable; urgency=medium
+
+ * debian/.gitlab-ci.yml:
+ - Check for missing hardening flags.
+
+ * debian/patches/*:
+ - Add allow-_llseek-in-seccomp-filter.patch. Needed on various 32-bit
+ plateforms to log the {raw}measurements and statistics information when
+ the seccomp filter is enabled. Thanks a lot to Francesco Poli (wintermute)
+ <invernomuto@paranoici.org> for the report. (Closes: #923137)
+ - Add allow-waitpid-in-seccomp-filter.patch. Needed to correctly stop
+ chronyd on some plateforms when the seccomp filter is enabled.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 04 Mar 2019 23:32:12 +0100
+
+chrony (3.4-2) unstable; urgency=medium
+
+ * debian/.gitlab-ci.yml:
+ - Replace home-made GitLab CI with the standard Salsa pipeline.
+ - Allow autopkgtest job to fail. The time-sources-from-dhcp-servers test
+ currently fails due to a testbed issue on salsa CI.
+
+ * debian/chrony.default:
+ - Enable the system call filter by default.
+
+ * debian/control:
+ - Bump standard-version to 4.3.0 (no changes required).
+ - Use the new debhelper-compat (= 12) notation and drop d/compat.
+ - Add Pre-Depends: ${misc:Pre-Depends}. Debhelper compatibility level 12
+ makes use of the “--skip-systemd-native” flag from “invoke-rc.d”. Adding
+ Pre-Depends: ${misc:Pre-Depends} to d/control ensure that we have a recent
+ enough version of “init-system-helpers”.
+ - Suggest networkd-dispatcher.
+
+ * debian/copyright:
+ - Add myself as a copyright holder for 2019.
+
+ * debian/links:
+ - Now that “networkd-dispatcher” is in the Debian archive, link
+ NetworkManager dispatcher script to networkd-dispatcher routable and off
+ states. Patch cherry-picked from Ubuntu; thanks to Christian Ehrhardt
+ <christian.ehrhardt@canonical.com> for working on this.
+
+ * debian/NEWS:
+ - Report that a system call filter is now enabled by default and the way
+ to disable it if needed.
+
+ * debian/rules:
+ - Don’t enable the system call filter on some architectures due to missing
+ support in the “libseccomp” and/or the Linux kernel.
+
+ * debian/upstream/:
+ - Strip upstream key from extra signatures. Thanks lintian!
+ - Remove the Miroslav-Lichvar.txt file as it serves no purpose.
+
+ * debian/usr.sbin.chronyd:
+ - Don’t include “tunables/sys”. The etc/apparmor.d/tunables/sys file has
+ been deprecated in AppArmor 2.13.1! The @{sys} variable is now defined in
+ “tunables/kernelvars” which is included in “tunables/global”.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 13 Feb 2019 17:08:17 +0100
+
+chrony (3.4-1) unstable; urgency=medium
+
+ * Import upstream version 3.4:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * Merge branch “experimental” into “master”.
+
+ * debian/chrony.service:
+ - Conflict with ntpsec.service.
+
+ * debian/copyright:
+ - Update copyright years.
+
+ * debian/patches/*:
+ - Remove fix-samplefilt-unit-test-to-work-with-low-precision-clock.patch,
+ fixed upstream.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 21 Sep 2018 14:12:03 +0200
+
+chrony (3.4~pre1-2) experimental; urgency=medium
+
+ * debian/patches/*:
+ - Cherry-pick upstream patch to fix samplefilt unit test to work with
+ low-precision clocks. This should prevent chrony from failing to build
+ from source on HPPA and Alpha.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 10 Sep 2018 18:39:58 +0200
+
+chrony (3.4~pre1-1) experimental; urgency=medium
+
+ * Import upstream version 3.4-pre1:
+ - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
+
+ * debian/:
+ - Add “.gitlab-ci.yml” file to use GitLab Continuous Integration.
+
+ * debian/chrony.if-{post-down,up}:
+ - Use the new “onoffline” command to tell chronyd to switch all sources to
+ the online or offline status according to the current network configuration.
+
+ * debian/chrony.ppp.ip-{down,up}:
+ - As for ifupdown scripts, use the “onoffline” command.
+
+ * debian/control:
+ - Bump standard-version to 4.2.1 (no changes required).
+
+ * debian/patches/*:
+ - Remove fall-back-to-urandom.patch. Applied in this prerelease.
+
+ * debian/post{inst,rm}:
+ - Use “command -v” instead of “which” to enhance portability.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 02 Sep 2018 19:14:08 +0200
+
+chrony (3.3-3) unstable; urgency=medium
+
+ * debian/:
+ - Normalize packaging with “wrap-and-sort -ab”.
+
+ * debian/control:
+ - Bump standard-version to 4.2.0:
+ ↳ Install upstream release notes as “/usr/share/doc/chrony/NEWS.gz”.
+ Installing these as “/usr/share/doc/package/changelog.gz” is now
+ deprecated.
+
+ * debian/patches/:
+ - Cherry-pick upstream patch to avoid hangs when starting
+ chronyd on newer kernels by falling back to urandom.
+ Thanks to Gustavo Scalet <gustavo.scalet@collabora.com> for the report and
+ the initial patch. (LP: #1787366, Closes: #906276)
+
+ * debian/upstream/metadata:
+ - Add DEP12 upstream metadata file.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sat, 18 Aug 2018 16:23:19 +0200
+
+chrony (3.3-2) unstable; urgency=medium
+
+ * debian/chrony.service:
+ - Conflict with ntp.service.
+
+ * debian/control:
+ - Bump standard-version to 4.1.4 (no changes required).
+ - Switch to the Nettle cryptographic library for hash functions.
+
+ [ Helmut Grohne ]
+ * debian/rules:
+ - Pass CC to make and set “--host-system” to fix FTCBFS. (Closes: #895852)
+
+ [ Christian Ehrhardt ]
+ * debian/usr.sbin.chronyd:
+ - Support all paths suggested in the man page.
+ (LP: #1771028, Closes: #898614)
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 14 May 2018 21:37:30 +0200
+
+chrony (3.3-1) unstable; urgency=medium
+
+ * Import upstream version 3.3:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * Merge branch “experimental” into “master”.
+
+ * debian/copyright:
+ - Update copyright year.
+
+ * debian/usr.sbin.chronyd:
+ - Allow CAP_NET_ADMIN to support HW timestamping. (LP: #1761327)
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 05 Apr 2018 02:08:31 +0200
+
+chrony (3.3~pre1-1) experimental; urgency=medium
+
+ * Import upstream version 3.3-pre1:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/copyright:
+ - Add “hash_nettle.c” copyright information and update copyright year of
+ test/unit/*
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 15 Mar 2018 13:58:21 +0100
+
+chrony (3.2-5) unstable; urgency=medium
+
+ [ Christian Ehrhardt ]
+ * debian/usr.sbin.chronyd:
+ - Allow write access to RTC, PPS and PTP devices.
+ (Closes: #891201, LP: #1751241)
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 28 Feb 2018 17:31:08 +0100
+
+chrony (3.2-4) unstable; urgency=medium
+
+ * debian/changelog:
+ - Remove trailing spaces.
+
+ * debian/chrony-dnssrv@.service:
+ - Use NTP servers obtained from DNS SRV records.
+
+ * debian/chrony-dnssrv@.timer:
+ - Periodic lookup of DNS SRV records.
+
+ * debian/chrony-helper:
+ - New helper script to make use of NTP servers obtained from DHCP and
+ _ntp._udp DNS SRV records.
+
+ * debian/chrony.dhcp:
+ - Add a dhclient-exit-hook script to add/remove NTP servers depending
+ on the operations invoked by the DHCP client. (Closes: #889656)
+
+ * debian/chrony.service:
+ - Run “/usr/lib/chrony/chrony-helper update-daemon” after starting chronyd.
+
+ * debian/control:
+ - Suggest dnsutils. The dig utility is used to update files with NTP
+ servers from DNS SRV records.
+
+ * debian/init:
+ - Run “/usr/lib/chrony/chrony-helper update-daemon” after starting chronyd.
+
+ * debian/install:
+ - Install the chrony-helper script in /usr/lib/chrony.
+ - Install chrony-dnssrv@.* files in /lib/systemd/system.
+
+ * debian/postinst:
+ - Don’t use recursive chown as this is vulnerable to hardlink attacks on
+ mainline, non-Debian kernels that do not have fs.protected_hardlinks=1.
+ Thanks Lintian!
+
+ * debian/postrm:
+ - Remove “/run/chrony” on purge.
+
+ * debian/rules:
+ - Install the dhclient-exit-hook script in /etc/dhcp/dhclient-enter-hooks.
+
+ * debian/tests/:
+ - Use autopkgtest to ensure that chronyd can use NTP servers obtained from
+ DHCP servers.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 20 Feb 2018 18:27:10 +0100
+
+chrony (3.2-3) unstable; urgency=medium
+
+ [ Christian Ehrhardt ]
+ * debian/chrony.default:
+ - Mention systemd service file in the comment.
+
+ * debian/chrony.service:
+ - Support the DAEMON_OPTS variable from “/etc/default/chrony” in systemd
+ environment. (LP: #1746081, Closes: #889012)
+
+ * debian/usr.sbin.chronyd:
+ - Allow the creation of /run/chrony on demand.
+ (LP: #1746444, Closes: #889011)
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 07 Feb 2018 21:27:09 +0100
+
+chrony (3.2-2) unstable; urgency=medium
+
+ * Initial AppArmor profile for chronyd. Thanks to Jamie
+ Strandboge <jamie@ubuntu.com>. (Closes: #888038)
+
+ * debian/compat:
+ - Bump to debhelper compat 11.
+
+ * debian/control:
+ - Bump standard-version to 4.1.3 (no changes required).
+ - Build depend on debhelper ≥ 11.
+ - Set “Rules-Requires-Root: no”.
+ - Move Vcs-* to salsa.debian.org.
+
+ * debian/copyright:
+ - Add myself as a copyright holder for 2018.
+
+ * debian/postinst:
+ - Don’t force removal of cron file since it doesn’t exist anymore.
+
+ * debian/preinst:
+ - Update the chrony version on which to act.
+ - Add the debhelper token.
+
+ * debian/usr.sbin.chronyd:
+ - Improve AppArmor profile to support more chronyd features and ease
+ portability with other distros.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 28 Jan 2018 19:33:46 +0100
+
+chrony (3.2-1) unstable; urgency=medium
+
+ * Import upstream version 3.2:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 15 Sep 2017 11:37:10 +0200
+
+chrony (3.2~pre2-1) experimental; urgency=medium
+
+ * Import upstream version 3.2-pre2:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/control:
+ - Bump standard-version to 4.1.0 (no changes required).
+
+ * debian/copyright:
+ - Update copyright years.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 30 Aug 2017 15:48:37 +0200
+
+chrony (3.2~pre1-1) experimental; urgency=medium
+
+ * Import upstream version 3.2-pre1:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/patches/*:
+ - Remove allow_getpid_in_seccomp_filter.patch and update the series file
+ accordingly.
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Run tests in multiple iterations.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 25 Jul 2017 21:13:22 +0200
+
+chrony (3.1-5) unstable; urgency=medium
+
+ * debian/chrony.if-up:
+ - Do not pass the “burst” command to chronyc as the script could return an
+ error in certain situations. As a consequence, that would prevent ifupdown
+ from writing the current state of the interfaces in /run/network/ifstate.
+ Thanks to John Eikenberry <jae@zhar.net> for reporting that issue.
+ (Closes: #868491)
+
+ * debian/chrony.ppp.ip-up:
+ - Take the same action as for the “chrony.if-up” script as a precautionary
+ measure.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 17 Jul 2017 16:47:56 +0200
+
+chrony (3.1-4) unstable; urgency=medium
+
+ * Now that Stretch has been released (\o/), let’s upload chrony 3.1 to
+ unstable.
+
+ * debian/:
+ - Remove the menu file used to launch “chronyc”. It is a CLI only tool,
+ thus it probably does not make a lot of sense to keep it in the Debian
+ menu.
+
+ * debian/control:
+ - Drop dependency on pre-jessie util-linux version.
+ - Bump standard-version to 4.0.0 (no changes required).
+
+ * debian/tests/upstream-simulation-test-suite:
+ - Fix the leading comment which mentioned “vm” despite the fact that the
+ test runs in a container.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 19 Jun 2017 02:30:10 +0200
+
+chrony (3.1-3) experimental; urgency=medium
+
+ * debian/chrony.if-{post-down,up}:
+ - Remove unnecessary “else” statements.
+
+ * debian/chrony.ppp.ip-down:
+ - Don’t check and delete “/var/run/chrony-ppp-up”, that file doesn’t exist
+ anymore.
+ - Check for pid file existence instead of calling “pidof”.
+
+ * debian/chrony.ppp.ip-up:
+ - Don’t create “/var/run/chrony-ppp-up” file after the ppp link came up.
+ - Check for pid file existence instead of calling “pidof”.
+ - Don’t call “chronyc” using its absolute path.
+ - Check for the presence of a default route before advising “chronyd” that
+ the network connectivity to the sources is ready.
+
+ * debian/init:
+ - Check if “$PIDFILE” exists before taking action.
+ - Do not print informational messages.
+ - Remove the “chronyd” pid file when stopping as it doesn’t do it on
+ its own.
+ - Rework the “restart|force-reload” pattern.
+ - Make use of some init-functions.
+ - Print a message if “chronyd” is already running while attempting to start
+ it.
+ - Do not delete “/var/run/chrony-ppp-up”, that file doesn’t exist anymore.
+
+ * d/rules:
+ - Move the default pid file from “/var/run” to “/run”.
+
+ * d/tests/*:
+ - Use autopkgtest facility to run the upstream simulation test suite.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 14 May 2017 17:26:15 +0200
+
+chrony (3.1-2) experimental; urgency=medium
+
+ * Merge branch 'master' into experimental. (Closes: #861258)
+
+ * debian/patches/*:
+ - Remove the “fix_time_smoothing_in_interleaved_mode.patch” patch. Not
+ needed anymore.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 26 Apr 2017 21:17:43 +0200
+
+chrony (3.1-1) experimental; urgency=medium
+
+ * Import upstream version 3.1:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/chrony.conf:
+ - Remove the “hwclockfile” directive. Unneeded now that the configure
+ script allows us to set the default path to the adjtime file via the
+ “--with-hwclockfile” option.
+
+ * debian/copyright:
+ - Update copyright years.
+
+ * debian/rules:
+ - Specify default path to hwclock adjtime file.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 02 Feb 2017 19:24:30 +0100
+
+chrony (3.0-4) unstable; urgency=medium
+
+ * debian/patches/*:
+ - Backport commit 768bce799bfe to make chrony operable with the syscall
+ filtering feature enabled in level 1. (Closes: #861258)
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 26 Apr 2017 17:39:44 +0200
+
+chrony (3.0-3) unstable; urgency=medium
+
+ * debian/patches/*:
+ - Backport an upstream patch to fix time smoothing in interleaved mode.
+ (Closes: #854424)
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 07 Feb 2017 00:37:24 +0100
+
+chrony (3.0-2) unstable; urgency=medium
+
+ * debian/chrony.conf:
+ - Disable logging by default, it waste some disk space and users are
+ probably better served by “chronyc sources” and “chronyc sourcestats”
+ commands anyway.
+
+ * debian/chrony.service:
+ - Remove the “Restart=on-failure” option. There are possible security
+ implications for NTP clients.
+
+ * debian/dirs:
+ - Add etc/logrotate.d to avoid build failure.
+
+ * Remove our logrotate configuration file in favour of the upstream’s one.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 18 Jan 2017 15:26:31 +0100
+
+chrony (3.0-1) unstable; urgency=medium
+
+ * Import upstream version 3.0:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * Merge branch “experimental”:
+ - Enable support for MS-SNTP authentication in Samba.
+ - Rename --chronysockdir to --chronyrundir.
+ - Enable seccomp facility on powerpcspe.
+
+ * debian/chrony.conf:
+ - Make use of the “makestep” directive to step the system clock instead of
+ slewing it when necessary.
+ - Drop the “offline” option as per upstream’s advice to render chrony’s
+ start-up sequence safer.
+
+ * debian/chrony.service:
+ - Reflect init-helper script deletion.
+
+ * debian/copyright:
+ - Add myself as a copyright holder for 2017.
+ - Adjust copyright holders and update some copyright years. Kudos to Paul
+ Gevers <elbrus@debian.org> for spotting the necessary updates.
+
+ * debian/init:
+ - Reflect init-helper script deletion.
+
+ * debian/install:
+ - Don’t install the init-helper script, it has been deleted.
+
+ * debian/README.Debian:
+ - Remove obsolete information.
+
+ * Remove the init-helper script as it no longer needed.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 17 Jan 2017 22:05:31 +0100
+
+chrony (3.0~pre3-1) experimental; urgency=low
+
+ * Import upstream version 3.0-pre3:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 06 Jan 2017 14:20:13 +0100
+
+chrony (3.0~pre2-2) experimental; urgency=low
+
+ * Merge branch “master”.
+
+ * Enable seccomp facility on powerpcspe.
+
+ -- Vincent Blut <vincent.debian@free.fr> Tue, 03 Jan 2017 18:17:13 +0100
+
+chrony (3.0~pre2-1) experimental; urgency=low
+
+ * Import upstream version 3.0-pre2:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 15 Dec 2016 15:23:44 +0100
+
+chrony (3.0~pre1-1) experimental; urgency=low
+
+ * Import upstream version 3.0-pre1:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/copyright:
+ - Mention new files.
+
+ * debian/rules:
+ - Enable support for MS-SNTP authentication in Samba.
+ - Rename --chronysockdir to --chronyrundir.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sat, 10 Dec 2016 16:30:19 +0100
+
+chrony (2.4.1-3) unstable; urgency=medium
+
+ * debian/apm:
+ - Removing that script as APM as been replaced by ACPI long time ago, thus
+ it’s highly probable that it isn’t useful anymore.
+
+ * debian/chrony.maintscript:
+ - Remove the apm script’s conffile.
+
+ * debian/chrony.service:
+ - Supply a systemd service file.
+ - Update unit section’s description. Add chronyc and chrony.conf man pages
+ information and remove reference to “/usr/share/doc/chrony.txt.gz” which
+ is not generated anymore.
+ - Update unit section’s documentation.
+
+ * debian/dirs:
+ - Don’t create etc/apm/event.d as the apm script isn’t provided anymore.
+
+ * debian/init:
+ - Convert to use the init-helper script.
+
+ * debian/init-helper:
+ - Add a helper script that will be used to maintain feature parity between
+ the SysV script and the systemd service file.
+
+ * debian/install:
+ - Install the init-helper script in “/usr/lib/chrony”.
+
+ * debian/rules:
+ - Don’t install the now removed apm script.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 22 Dec 2016 02:16:54 +0100
+
+chrony (2.4.1-2) unstable; urgency=medium
+
+ * debian/chrony.conf:
+ - Don’t create sample histories by default. Using that feature does not
+ make a lot of sense when using a pool of rapidely rotating time servers.
+ - Remove unused directives.
+ - Improve (well, I hope! ;-) ) the configuration file readability.
+ - Reword the driftfile directive commentary.
+ - Shorten the lead-in comment.
+
+ * debian/control:
+ - Build-depend on pps-tools only on linux.
+ - Remove libnss3-dev from Build-Depends until #846012 is fixed.
+
+ * debian/init:
+ - Don’t pass the “-r” option when restarting chronyd as we have disabled
+ the creation of sample histories by default.
+
+ * debian/rules:
+ - Drop dh_auto_build override. Nowadays, the documentation is built by
+ default.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 9 Dec 2016 16:58:32 +0100
+
+chrony (2.4.1-1) unstable; urgency=medium
+
+ * Import upstream version 2.4.1:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/chrony.default:
+ - New file used to pass options to chronyd. Thanks to nutzteil
+ <nutzteil@web.de> for the suggestion and the initial patch.
+ (Closes: #834240)
+
+ * debian/compat:
+ - Bump to debhelper compat 10.
+
+ * debian/control:
+ - Build depend on debhelper ≥ 10.
+
+ * debian/copyright:
+ - Use HTTPS for all URI.
+
+ * debian/init:
+ - Read and execute options assigned to the “DAEMON_OPTS” variable.
+
+ * debian/rules:
+ - Drop dh “--parallel” option. Enabled by default in debhelper 10.
+
+ -- Vincent Blut <vincent.debian@free.fr> Mon, 21 Nov 2016 12:58:05 +0100
+
+chrony (2.4-1) unstable; urgency=medium
+
+ The “Fix decade-old bug reports” release.
+
+ * Import upstream version 2.4:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/chrony.if-{up,post-down}:
+ - New scripts used to put chronyd online/offline depending on the
+ state of the connection. (Closes: #240528,#312092,#389961)
+
+ * debian/chrony.keys:
+ - Highlight “chronyc keygen” command to generate keys.
+
+ * debian/chrony.ppp.ip-down:
+ - Be sure that there is no default route before going offline.
+ (Closes: #252131)
+
+ * debian/control:
+ - Remove install-info dependency.
+ - Remove texinfo build dependency since documentation in Texinfo format
+ has been dropped upstream.
+ - Build depend on asciidoctor ≥ 1.5.3-1~. The version constraint is
+ important since chrony’s man pages are generated from “adoc” files, a
+ functionality that has been added in asciidoctor 1.5.3.
+
+ * debian/dirs:
+ - Add “etc/NetworkManager/dispatcher.d”.
+
+ * debian/doc-base:
+ - Remove the file since we do not generate chrony.{html,txt} anymore.
+
+ * debian/docs:
+ - Remove references to chrony.{html,txt}.
+
+ * debian/patches/*:
+ - Drop fix-ftbfs-on-powerpc-ppc64-ppc64el.diff; applied upstream.
+ - Update the “series” file accordingly.
+
+ * debian/postinst:
+ - Use ucfr to associate chrony with its configuration files. Suggested by
+ Paul Gevers <elbrus@debian.org>
+
+ * debian/postrm:
+ - Remove all vestiges of the association between chrony and its
+ configuration files. Also suggested by Paul Gevers <elbrus@debian.org>
+
+ * debian/rules:
+ - Provide upstream NetworkManager dispatcher script.
+
+ * debian/watch:
+ - Use HTTPS to fetch new upstream releases.
+ - Switch to version 4 format.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 17 Jun 2016 17:20:08 +0200
+
+chrony (2.3-2) unstable; urgency=low
+
+ * Cherry pick upstream patch to fix FTBFS on PowerPC, ppc64 and ppc64el
+ architectures.
+
+ -- Vincent Blut <vincent.debian@free.fr> Fri, 20 May 2016 14:21:14 +0200
+
+chrony (2.3-1) unstable; urgency=low
+
+ * Import upstream version 2.3:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+ (Closes: #818235)
+
+ * debian/chrony.conf:
+ - Drop the “logchange” directive. Upstream has enabled “logchange” by
+ default with a threshold of 1 second. We now use that instead of our custom
+ threshold of 0,5 second which tended to spam syslog.
+ - Remove obsolete comment.
+
+ * debian/chrony.lintian-overrides:
+ - Update “chrony.keys” path
+
+ * debian/control:
+ - Bump standard-version to 3.9.8 (no changes required).
+ - Use HTTPS transport protocol for the homepage URL.
+
+ * debian/copyright:
+ - Add some entries about new or untracked files.
+
+ * debian/postinst:
+ - Move /usr/share/chrony/chrony.keys template to /etc/chrony using ucf.
+ - Avoid displaying needless prompt when upgrading to chrony ≥ 2.2.1-1.
+ (Closes: #820087)
+
+ * debian/postrm:
+ - Remove chrony.keys on purge.
+ - Remove all vestiges of chrony.keys from the state hashfile.
+
+ * debian/rules:
+ - Re-enable test suite.
+ - Remove dh_installinit override. The init script is LSB-compliant so
+ passing the “default” option or the two-digit sequence number is unneeded.
+ - Explicitly set the NTP era. With this change, the NTP time will be
+ mapped from 1970-01-01T00:00:00Z to 2106-02-07T06:28:16Z. Thanks to this
+ fixed value, chrony build should be reproducible.
+ - Move the key file template (chrony.keys) in /usr/share/chrony.
+ - Force /usr/share/chrony/chrony.keys to use 0640 modes.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 18 May 2016 23:13:05 +0200
+
+chrony (2.2.1-1) unstable; urgency=medium
+
+ * Import upstream versions 2.2 and 2.2.1:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+ - The 2.2.1 release version fixes CVE-2016-1567. (Closes: #812923)
+
+ * debian/chrony.conf:
+ - Drop the commandkey directive. It is obsolete since the introduction of a
+ Unix domain command socket in chrony 2.2.
+ - Fix keyfile directive commentary.
+
+ * debian/chrony.keys:
+ - New file template.
+
+ * debian/chrony.lintian-overrides:
+ - New file used to force lintian to stop complaining about the “chrony.keys”
+ file modes (0640).
+
+ * debian/chrony.ppp.ip-down:
+ - Drop obsolete authentication method to the chronyd daemon. This is now
+ handled by the usage of a Unix domain command socket.
+
+ * debian/chrony.ppp.ip-up:
+ - Drop obsolete authentication method to the chronyd daemon. This is now
+ handled by the usage of a Unix domain command socket.
+ - Reinstate the “burst” chronyc command.
+
+ * debian/control:
+ - Build depend on libseccomp-dev ≥ 2.2.3-3~. We need it to provide syscall
+ filtering.
+ - Fix a typo relative to the name of an architecture.
+ - Build depend on pkg-config.
+ - Restrict libcap-dev build dependency on Linux only.
+ - Depend on iproute2 instead of net-tools.
+ - Drop timelimit dependency.
+ - Update Vcs-Git to use HTTPS.
+ - Bump standard-version to 3.9.7 (no changes required).
+
+ * debian/copyright:
+ - Update copyright year for debian/*.
+
+ * debian/init:
+ - Make use of “ip r” instead of “netstat -rn”. (Closes: #818234)
+ - Delete unused “FLAGS” variable.
+ - Do not execute ip and chronyc through timelimit.
+ - Don’t call chronyc using its absolute path.
+ - Check if the value of the DAEMON variable is executable.
+ - Drop the two seconds delay as it should be unnecessary.
+ - Drop obsolete authentication method from the putonline() function.
+ - Fix indentation issue in the putonline() function.
+
+ * debian/logrotate:
+ - Do not pass the “-a” option to chronyc, it’s no longer necessary.
+
+ * debian/NEWS:
+ - Add a comment about the command key suppression from the “chrony.keys”
+ file.
+
+ * debian/patches/:
+ - Drop 01_do-not-install-copying-file.patch, not needed anymore.
+ ↳ Remove reference to that patch from the series file.
+
+ * debian/postinst:
+ - Do not create an ID/key pair for command authentication. Configuration
+ and monitoring via chronyc is now done using Unix domain socket accessible
+ by root or by the system user to which chronyd will drop root privileges,
+ i.e. _chrony.
+
+ * debian/postrm:
+ - Remove /var/lib/chrony content only on purge. (Closes: #568492)
+
+ * debian/README.Debian:
+ - Drop obsolete statement.
+
+ * debian/rules:
+ - Build with --enable-scfilter.
+ - Install the “chrony.keys” file in /etc/chrony/ with 0640 modes.
+ - Override dh_fixperms to prevent it from modifying modes of the
+ “chrony.keys” file. By default, dh_fixperms tries to set the default modes
+ (0644).
+ - Move the “chronyd.sock” file from /var/run/chrony to /run/chrony.
+
+ -- Vincent Blut <vincent.debian@free.fr> Sat, 19 Mar 2016 14:42:23 +0100
+
+chrony (2.1.1-1) unstable; urgency=medium
+
+ * Import upstream version 2.0 and 2.1.1:
+ - Please see /usr/share/doc/chrony/changelog.gz for the release notes.
+
+ * debian/:
+ - Rename ppp scripts from ip-{up,down} to chrony.ppp.ip-{up,down}.
+ Necessary to let dh_installppp do its magic.
+
+ * debian/chrony.conf:
+ - Use the new 'pool' directive to specify the pool of NTP servers.
+ - Use the iburst option to speed up the initial synchronization.
+ - Drop the minpoll option. There is no point to deviate from upstream here.
+ Consequently, the default minimum polling interval is now 64 seconds
+ instead of 256 seconds.
+ - Enable kernel synchronization of the RTC via the 'rtcsync' directive.
+ - Drop the commented out 'rtcfile' directive in the configuration file.
+ - Stricly act as an NTP client by default. Serving time to other systems
+ should be the decision of the administrator(s). (Closes: #778770)
+ - Clarify some comments.
+ - Improve comment about the 'commandkey' directive.
+
+ * debian/control:
+ - Drop 'Recommends: udev (>= 0.124-1)' since it predates Debian squeeze.
+
+ * debian/copyright:
+ - Update copyright years.
+ - Various cleanups.
+ - Update relative to sys_macosx.{c,h} files.
+ - The test/simulation/test.common file is under the GPL-2+ license.
+ Thanks to Paul Gevers <elbrus@debian.org> for catching it.
+
+ * debian/NEWS:
+ - Comment the deactivation of the NTP server capability by default.
+
+ * debian/patches/:
+ - Refresh 01_do-not-install-copying-file.patch.
+
+ * debian/README.Debian:
+ - Fix misleading information.
+
+ * debian/rules:
+ - No need to install ppp scripts from the 'rules' script. Let dh_installppp
+ handle that.
+
+ -- Vincent Blut <vincent.debian@free.fr> Wed, 18 Nov 2015 00:11:23 +0100
+
+chrony (1.31.1-2) unstable; urgency=medium
+
+ * Rename the NEWS.Debian file to NEWS. dh_installchangelogs doesn’t seems
+ to be able to deal with the former name.
+
+ -- Vincent Blut <vincent.debian@free.fr> Thu, 17 Sep 2015 21:50:30 +0200
+
+chrony (1.31.1-1) unstable; urgency=medium
+
+ * Import upstream version 1.31 and 1.31.1:
+ - Please see /usr/share/doc/chrony/changelog.gz for release notes.
+
+ * debian/chrony.conf:
+ - Use the 'hwclockfile' directive. Avoid using text processing methods in
+ the post install script to find out if the RTC keeps local time or UTC.
+ (Closes: #778710)
+
+ * debian/clean:
+ - Add getdate.c
+
+ * debian/control:
+ - Move chrony from admin to net section.
+ - Change priority from extra to optional.
+ - Build depends on libcap-dev. (Closes: #768803)
+ - Bump standards-version to 3.9.6 (no changes required).
+ - Set myself as maintainer and Joachim as uploader.
+ - Update Vcs-Browser URL to use cgit and https.
+ - Build depends on pps-tools. Provides PPSAPI (RFC-2783) support.
+ - Improve the synopsis.
+ - Depend on util-linux (>= 2.20.1-5). Ensure that the 'UTC=' setting
+ from the '/etc/default/rcS' file have been migrated to UTC/LOCAL in
+ '/etc/adjtime'.
+ - Depends on adduser. Needed to create "_chrony" system user/group.
+
+ * debian/copyright:
+ - Add myself to copyright holders.
+ - Remove spaces from short name license (fix Lintian warning)
+ - Filled short license field (RSA-MD) (fix Lintian warning)
+ - Move comment to the "Comment:" field
+
+ * debian/logrotate:
+ - Simplify postrotate script. Thanks to Frédéric Brière
+ <fbriere@fbriere.net> for reporting and diagnosing the issue.
+ (Closes: #763542)
+
+ * debian/patches:
+ - Drop patches for issues fixed upstream.
+ - Rename and update patch. Update the series file accordingly.
+
+ * debian/postinst:
+ - Pass the '--three-way' option to ucf.
+ - Remove useless text processing methods as we now use the 'hwclockfile'
+ directive. (Closes: #778711)
+ - Create "_chrony" system user/group.
+ - Update the "new_file" path in the ucf invocation.
+ - Remove the MAILPASSWORD shell variable as we don’t use it.
+
+ * debian/postrm:
+ - Drop removal instruction of /etc/cron.weekly/chrony.
+ - Remove "_chrony" system user/group on purge.
+ - Don’t pass the --group option to deluser.
+
+ * debian/NEWS.Debian:
+ - New file incorporating worthwhile changes in this release.
+
+ * debian/README.Debian:
+ - Fix typo, thanks to Paul Gevers <elbrus@debian.org> for catching it.
+ - Missing word added.
+
+ * debian/rules:
+ - Build with all hardening flags.
+ - Ease the reading of configure options.
+ - Specify "_chrony" as default chronyd user. This is the system user to
+ which chronyd will drop root privileges. You'll find further information
+ in /usr/share/doc/chrony/README.Debian.
+ (Closes: #688971)
+
+ -- Vincent Blut <vincent.debian@free.fr> Sun, 6 Sep 2015 22:39:22 +0200
+
+chrony (1.30-2) unstable; urgency=medium
+
+ * With the following security bugfixes (Closes: #782160):
+ - Fix CVE-2015-1853: Protect authenticated symmetric NTP
+ associations against DoS attacks.
+ - Fix CVE-2015-1821: Fix access configuration with subnet
+ size indivisible by 4.
+ - Fix CVE-2015-1822: Fix initialization of reply slots for
+ authenticated commands.
+ * debian/control:
+ - Update e-mail address of myself.
+ - Add Vincent Blut as co-maintainer.
+
+ -- Joachim Wiedorn <joodebian@joonet.de> Fri, 10 Apr 2015 11:41:31 +0200
+
+chrony (1.30-1) unstable; urgency=medium
+
+ * New upstream release with following bugfixes:
+ - Fix crash when selecting with multiple preferred sources.
+ - Fix frequency calculation with large frequency offsets.
+ - Fix code writing drift and RTC files to compile correctly.
+ - Fix -4/-6 options in chronyc to not reset hostname set by -h.
+ - Fix refclock sample validation with sub-second polling interval.
+ - Set stratum correctly with non-PPS SOCK refclock and local stratum.
+ - Modify dispersion accounting in refclocks to prevent PPS getting
+ stuck with large dispersion and not accepting new samples.
+ - Move faq.txt (PHP style) to a plain text file FAQ. Closes: #415729
+
+ * Add gpg signature of upstream developer for use with uscan.
+ * Update debian/watch, add check of upstream gpg signature.
+ * Update all patches.
+
+ * Bugfix: Use /etc/adjtime in postinst script to recognize
+ UTC hardware clock. Closes: #680498
+ * Use logrotate instead of cron script. Closes: #323966
+ * debian/rules: disable test simulation.
+
+ * debian/control: remove obsolete build dependency to dpkg-dev.
+ * debian/install, debian/dirs, debian/clean: Update.
+ * debian/copyright: Update and add entries.
+
+ -- Joachim Wiedorn <ad_debian@joonet.de> Sun, 10 Aug 2014 19:10:35 +0200
+
+chrony (1.29.1-1) unstable; urgency=high
+
+ * New upstream release with bugfix:
+ - Closes: #737644: Fixing vulnerability:
+ CVE-2014-0021 - traffic amplification in cmdmon protocol
+ (incompatible with previous protocol version, but chronyc
+ supports both).
+
+ -- Joachim Wiedorn <ad_debian@joonet.de> Thu, 06 Feb 2014 15:51:47 +0100
+
+chrony (1.29-1) unstable; urgency=medium
+
+ * New upstream release with some bugfixes:
+ - Closes: #719132: new upstream version, fixes security bugs.
+ - Closes: #719203: Fixing vulnerabilities:
+ CVE-2012-4502 - Buffer overflow,
+ CVE-2012-4503 - Uninitialized data.
+
+ * debian/control:
+ - Set myself as new maintainer. Closes: #705768
+ - Bump to Standards-Version 3.9.5.
+ - Move to debhelper >= 9 and compat level 9.
+ - Update package descriptions.
+ - Add Vcs fields to new git repository.
+ - Add dependency to lsb-base (for init script).
+ - Add build dependency to libtomcrypt-dev.
+ * Move to source format 3.0 (quilt).
+ * Add the following patch files: (Closes: #637514)
+ - 01_fix-small-typo-in-manpages
+ - 03_recreate-always-getdate-c
+ - 04_do-not-look-for-ncurses (Closes: #646732)
+ - 05_disable-installation-of-license
+ * debian/rules:
+ - Move to dh-based rules file.
+ - Enable parallel builds.
+
+ * Add debian/watch file.
+ * Full update of debian/copyright file.
+ * Add debian/doc-base file.
+ * Full update of debian/README.Debian file.
+ * Update debian/postinst, debian/postrm, debian/prerm.
+ * Remove obsolete debian/preinst. Reduce mailing within postinst.
+ * Do not use old md5sum file anymore for ucf in postinst script.
+ * Add status action in init script (debian/init). Closes: #652207
+ * Add debian/install file for installing example of chrony.conf.
+ * Reduce debian/dirs file for use with debhelper 9.
+
+ -- Joachim Wiedorn <ad_debian@joonet.de> Fri, 20 Dec 2013 23:35:25 +0100
+
+chrony (1.26-4) unstable; urgency=low
+
+ * QA upload.
+ * Depend on net-tools, for netstat (closes: #707260).
+
+ -- Colin Watson <cjwatson@debian.org> Mon, 08 Jul 2013 18:00:45 +0100
+
+chrony (1.26-3) unstable; urgency=low
+
+ * Orphaned.
+
+ -- John G. Hasler <jhasler@debian.org> Fri, 19 Apr 2013 13:08:31 -0500
+
+chrony (1.26-2) unstable; urgency=low
+
+ * Fixed Makefile.in so that getdate.c gets made (and removed
+ in "clean"). This will go upstream. Moved faq stuff in rules
+ from binary-indep to binary-arch.
+ * Restored accidently deleted nmu changelog entry.
+
+ * Applied patch from Moritz Muehlenhoff <jmm@debian.org>
+ Closes: #655123 Please enabled hardened build flags
+
+ * Fixed upstream.
+ Closes: #518385 Chrony segfaults on startup (narrowed down to
+ chronyc and "burst")
+
+ * Added DEB_BUILD_OPTIONS=noopt to rules.
+ Added build-arch and build-indep to rules.
+ Prefix is now 'usr'.
+ Changed to dh_installman.
+ Fixed "clean:" target.
+ Closes: #479389 Improvements for debian/rules
+
+ * Fixed upstream.
+ Closes: #195620 Strange "System time : xxx seconds slow of NTP time"
+ output
+
+ * Upstream changes should have fixed this.
+ Closes:#294030 chronyd makes the whole system briefly (< 1 second)
+ freeze
+
+ * Fixed by upstream changes and new LSB headers.
+ Closes: #407466 Chrony won't access hardware clock but prevents
+ hwclock from doing so either
+
+ -- John G. Hasler <jhasler@debian.org> Sun, 01 Jul 2012 22:05:56 -0500
+
+chrony (1.26-1) unstable; urgency=low
+
+ * New upstream release
+ Closes: #348554: chrony and hwclock packages not coordinated.
+ Closes: #572964: RTC support is missing.
+ Closes: #642209: add RTC support for linux 3.0.
+ Closes: #644241: new upstream version 1.26 available.
+
+ * Applied patches from Joachim Wiedorn <ad_debian@joonet.de>:
+ Fixed several typos in man pages and README.
+ Added version.h.
+ Moved default chrony.conf to debian/ .
+ Renamed cron and init files.
+ Removed debian/NEWS.Debian, debian/info.
+ Added debian/clean.
+ Updated debian/copyright. COPYING stays. Upstream requires it.
+ Fixed debian/menu, debian/control, updated debian/compat.
+ Added "--without-readline" to debian/rules: rewrite later.
+ Minor fixes to initscript: rewrite later.
+
+ Closes: #646732 Move from readline support to editline support.
+ Closes: #598253 Fix typo in LSB init headers ($hwclock to $time).
+ Closes: #600403 Fix init check with PPP connection.
+
+ -- John G. Hasler <jhasler@debian.org> Sun, 17 Jun 2012 21:55:47 -0500
+
+chrony (1.24-3.1) unstable; urgency=low
+
+ * Non-maintainer upload.
+ * Add patch (directly over the source...), to work with kernels > 3.0.0,
+ by Paul Martin at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628919#15.
+ (Closes: #628919)
+ * Fix readline build-depends from "libreadline5-dev | libreadline-dev" to
+ libreadline-gplv2-dev because chrony is GPLv2 only. (Closes: #634447)
+ * Update copyright file to say that chrony is GPLv2 only. (Closes: #637526)
+
+ -- Ana Beatriz Guerrero Lopez <ana@debian.org> Fri, 12 Aug 2011 12:32:26 +0200
+
+chrony (1.24-3) unstable; urgency=high
+
+ * Applied (modifed) patch from Gregor Herrmann.
+
+ Closes: #593145: fails to configure on installation
+ Closes: #552162: chrony incorrectly thinks that it has failed to
+ (re)start
+ Closes: #592930: invoke-rc.d: initscript chrony, action "start" failed.
+
+ -- John G. Hasler <jhasler@debian.org> Tue, 14 Sep 2010 10:06:47 -0500
+
+chrony (1.24-2) unstable; urgency=low
+
+ * Fixed regression that caused default CHRONY_IOC_ lines to
+ vanish from io_linux.h thereby breaking hppa and ia64.
+
+ Closes: #588930: FTBFS [ia64,hppa]: "I don't know the values of the
+ _IOC_* constants on your architecture"
+
+ * $remote_fs was added in 1.24-1. Depending on networking is neither
+ necessary nor desireable.
+
+ Closes: #590888: Dependencies on init.d script insuficcient
+
+ * Still need to rewrite scripts.
+
+ -- John G. Hasler <jhasler@newsguy.com> Fri, 30 Jul 2010 20:32:55 -0500
+
+chrony (1.24-1) unstable; urgency=low
+
+ * New upstream release. The scripts will be rewritten and many more bugs
+ taken care of in -2. Right now I want to get 1.24 out there.
+
+ * Applied patch from Petter Reinholdtsen to init.d
+
+ Closes: #541806: misses syslog dependency in LSB headers
+
+ * Chrony cannot be linked to libreadline6 because it is GPLv2 only.
+
+ Closes: #553739 replacing libreadline5-dev build dependency with
+ libreadline-dev
+
+ * "configure" rewritten upstream, eliminating "+=".
+
+ Closes: #573036: RTC support disabled (due to Bashism in configure line 293)
+
+ * Removed "install-info" from scripts.
+
+ Closes: #568703: dpkg warnings
+
+ * client.c has been rewritten upstream.
+
+ Closes: #573032
+
+ * Fixed typos.
+
+ Closes: #434629: 'man chrony', 'cronyc', 'cronyd' typos: "parateters" x 2,
+ "priviliges"
+
+ * Added debian/source/format containing "1.0".
+
+ -- John G. Hasler <jhasler@newsguy.com> Tue, 22 Jun 2010 16:01:29 -0500
+
+chrony (1.23-7) unstable; urgency=high
+
+ * Applied patches from upstream to fix remote DOS:
+
+ CVE-2010-0292 Don't reply to invalid cmdmon packets
+
+ CVE-2010-0293 Limit client log memory size
+
+ CVE-2010-0294 Limit rate of syslog messages
+
+ -- John G. Hasler <jhasler@newsguy.com> Tue, 02 Feb 2010 19:37:50 -0600
+
+chrony (1.23-6) unstable; urgency=low
+
+ * Commented out rtcfile directive in chrony.conf because it can cause
+ lockups with certain combinations of motherboard and kernel (this is
+ a known kernel bug).
+
+ Closes: #508298: chronyd unreachable and does not work (clock drifts)
+
+ * Chrony no longer uses the ppp/ip-up.d and ppp/ip-up.d files and the new
+ init.d file won't hang if chronyc hangs.
+
+ Closes: #448481: /etc/ppp/ip-up.d/chrony doesn't work when bindaddress is set.
+
+ * Cannot reproduce on current version on amd64.
+
+ Closes: #412961: error in tracking report (on amd64?)
+
+ -- John Hasler <jhasler@debian.org> Wed, 10 Dec 2008 14:16:37 -0600
+
+chrony (1.23-5) unstable; urgency=low
+
+ * Replaced background kill with 'timelimit' in initscript.
+
+ Closes: #505094: chrony: kills random netstat processes
+
+ * Added 'Recommends: udev (>= 0.124-1)'
+
+ Closes: #497113: /dev/rtc renamed to /dev/rtc0 with linux-image-2.6-*/2.6.26+15
+
+ * Had previously applied patch from Nathanael Nerode to fix configure
+ bug but forgot to close the bug.
+
+ Closes: #392273: Recursive dependency disease: chrony shouldn't depend on ncurses
+
+ -- John Hasler <jhasler@debian.org> Sun, 09 Nov 2008 20:19:22 -0600
+
+chrony (1.23-4) unstable; urgency=low
+
+ * Fixed dependency of init script on Pppconfig ip-up.d script by moving
+ those lines into the init script.
+
+ * Added checks to try to make sure that Chronyd is really, really running.
+ Changed Netstat call to use -n, added code to kill it if it hangs.
+ Added code to kill Chronyc if it can't contact Chronyd.
+ Discussed the HPET/rtc problem in NEWS.Debian.
+
+ Closes: #504000: init script hangs for a while might break upgrade
+
+ * Added missing initialization to create_instance() in ntp_core.c.
+ This was why UTI_NormaliseTimeval() was being called with huge
+ values at times.
+
+ * See comment on #195620 in 1.21z-6 below. If you know of more LP64
+ bugs reopen #348412 with a patch.
+
+ Closes: #348412: chronyc not LP64 compliant
+
+ * Added comment about sources being discarded to chrony.conf as suggested
+ by Andreas Hübner in #268289.
+
+ * This is normal behavior.
+
+ Closes: #287060: trimrtc takes 40 seconds to take effect
+
+ -- John Hasler <jhasler@debian.org> Thu, 06 Nov 2008 10:38:58 -0600
+
+chrony (1.23-3) unstable; urgency=high
+
+ * Rewrote UTI_NormaliseTimeval()in util.c to use divide/remainder
+ instead of loops at the suggestion of Gabor Gombas. This prevents the
+ problem of the loop running until the sun goes out when the function
+ is called with a very large value for tv_usec on 64-bit architectures.
+ Also fixed some other spots where the same loop was being used.
+
+ Closes: #474294 Goes into endless loop
+ Closes: #447011 chronyd stalls with 100% CPU usage
+
+ I still don't know why the function is being called with such a
+ large value, however.
+
+ * Changed default servers in chrony,conf to Debian servers.
+
+ Closes: #434483: chrony: Should use NTP servers in Debian pool
+
+ -- John Hasler <jhasler@debian.org> Sat, 26 Apr 2008 11:47:44 -0500
+
+chrony (1.23-2) experimental; urgency=low
+
+ * Added default IOC's to io_linux.h.
+ Closes: #477043: chrony_1.23-1(ia64/experimental): FTBFS: IOC
+ constants unknown on ia64
+ Closes: #476963: chrony_1.23-1(hppa/experimental): FTBFS: "I don't
+ know the values of the _IOC_* constants for your architecture"
+
+ -- John Hasler <jhasler@debian.org> Sun, 20 Apr 2008 13:29:29 -0500
+
+chrony (1.23-1) experimental; urgency=low
+
+ * New upstream release
+ This is 1.23 with Debian patches applied (including some for LP64).
+ I'm uploading this to Experimental to get it tested on x86_64 to see
+ if #474294 is fixed.
+
+ -- John Hasler <jhasler@debian.org> Sat, 19 Apr 2008 14:49:15 -0500
+
+chrony (1.21z-6) unstable; urgency=low
+
+ * Applied patches from Eric Lammerts <eric@lammerts.org> and Goswin von
+ Brederlow <brederlo@informatik.uni-tuebingen.de> to cast the value
+ returned by ntohl to int32_t and so cause correct sign-extension near
+ line 1655 in client.c. Also fixed similar bugs in the same area. I'm
+ not sure this entirely fixes the chronyc number display problem,
+ though. I've not closed #348412 here because chrony is still not
+ fully LP64 compliant.
+ Closes: #195620: Strange "System time : xxx seconds slow of
+ NTP time" output
+
+ * Replaced addrfilt.c with addrfilt.c from upstream git repository.
+ This fixes the recursive structure definition problems.
+
+ * Replaced 'route' with 'netstat -r' in the initscript.
+
+ * Applied patch for configure script from Nathanael Nerode
+ <neroden@gcc.gnu.org> to delete the superfluous "lncurses" at line
+ 327.
+ Closes: #392273: Recursive dependency disease: chrony shouldn't depend
+ on ncurses
+
+ * Added test to reject servers claiming stratum less than 1 in
+ ntp_core.c "Test 7". Bill Unruh <unruh@physics.ubc.ca> has run across
+ a server that sometimes claims to be stratum 0, which causes
+ considerable confusion.
+
+ -- John Hasler <jhasler@debian.org> Fri, 16 Feb 2007 17:47:40 -0600
+
+chrony (1.21z-5) unstable; urgency=high
+
+ * Applied postinst patch from Lionel Elie Mamane to test for the
+ existence of old .keys and .conf files before renaming them.
+ Closes: #397759: fails to configure: mv: cannot stat `/etc/chrony/chrony.keys.1.21-2':
+ No such file or directory
+
+ * Added burst command to /etc/ppp/ip-up.d/chrony to give chronyd a kick in the butt.
+ Shouldn't need that, though.
+ Initscript now calls /etc/ppp/ip-up.d/chrony if a default route exists.
+ Closes: #397739: Not connecting to sources after reboot - dialup
+
+ -- John Hasler <jhasler@debian.org> Sun, 26 Nov 2006 08:07:20 -0600
+
+chrony (1.21z-4) unstable; urgency=low
+
+ * Added test for /usr/bin/mail to postinst.
+ Closes: #386651: chrony: Requires /usr/bin/mail but doesn't depend on it
+ Closes: #390280: chrony: missing dependency on mail
+
+ * Added LSB headers to initscript
+
+ * Corrected erroneous use of 'dpkg --compare-version' in preinst and postinst.
+ Closes: #386733: fails to configure (bad upgrade check)
+
+ * Added rm to postinst to remove keyfile possibly left by a failed install.
+ Closes: #390278: usage of tempfile /etc/chrony/chrony.keys is doubtful
+
+ -- John Hasler <jhasler@debian.org> Sat, 7 Oct 2006 13:39:49 -0500
+
+chrony (1.21z-3) unstable; urgency=low
+
+ * Changed upstream version number from 1.21 to 1.21z to satisfy Debian
+ archive software.
+
+ * Replaced impure chrony_1.21.orig.tar.gz.
+ Closes: #340030: chrony: Tarball is impure
+
+ * Now Provides, Conflicts, Replaces time-daemon
+ Closes: #330839: time-daemon pseudopackage
+
+ * Corrected typos.
+ Closes: #321121: chrony: typo in 'Conflicts:' field: s/ntpsimple/ntp-simple/ and s/ntprefclock/ntp-refclock/
+
+ * Rewrote postinst and postrm to use ucf. Wrote preinst to protect chrony.conf from dpkg.
+ Closes: #351332: chrony: conffile change prompt prevents smooth upgrade from sarge to etch
+
+ * Deleted last few lines of chrony.conf as they no longer apply.
+
+ * Deleted .arch-ids from contrib and examples.
+
+ * Fixed typo in chronyc.1
+ Closes: #349871: chrony: typo in chrnoyc.1 results in missing word
+
+ * Corrected references in man pages.
+ Closes: #345034: chrony: man pages refer to wrong sections
+
+ * Added "allow 172.16/12" to chrony.conf.
+ Closes: #252952: chrony: default allow should also have 172.16/12
+
+ * Channged server lines in chrony.conf to follow ntp.org current recommendation.
+ Closes: #243534: chrony: new pool.ntp.org setup doesn't work well
+
+ * Fixed FSF address in debian/copyright.
+
+ -- John Hasler <jhasler@debian.org> Fri, 1 Sep 2006 10:52:52 -0500
+
+chrony (1.21-2) unstable; urgency=high
+
+ * Patched io_linux.h to add missing architectures.
+ Closes: #339764: chrony - FTBFS: #error "I don't know the values of the
+ _IOC_* constants for your architecture"
+
+ * Fixed brown-bag error in rules.
+ Closes: #339853: /usr/sbin/chronyd is missing
+
+ -- John Hasler <jhasler@debian.org> Sat, 19 Nov 2005 10:12:49 -0600
+
+chrony (1.21-1) unstable; urgency=low
+
+ * New upstream release
+ Closes: #328292: New version of chrony avalaible
+ Closes: #301592: Fails to read RTC and floods logfiles
+
+ * Enabled RTC as upstream has installed a work-around for the HPET bug.
+
+ * Switched to libreadline5.
+ Closes: #326379: please rebuild with libreadline5-dev as build dependency
+
+ * Patched addrfilt.c to fix gcc 4.0 build problem.
+ Closes: #298709: chrony: FTBFS (amd64/gcc-4.0): array type has incomplete element type
+
+ * There are lots more minor things to fix but I'm uploading now to close
+ the serious bugs. I'll upload another version with some improvements
+ in a few weeks.
+
+ -- John Hasler <jhasler@debian.org> Tue, 15 Nov 2005 18:39:49 -0600
+
+chrony (1.20-8) unstable; urgency=high
+
+ * Added test for /usr/bin/mail in postinst.
+ Closes: #307061: Install failure: Cannot configure on system without mailx
+ I consider this bug serious because it can cause installation to fail
+ and so I want to get the fix into Sarge.
+
+ * Fixed typo in chrony.conf, replaced '/etc/init.d/chrony restart'
+ with 'invoke-rc.d chrony restart'.
+ Closes: #305090: Typo in chrony.conf, should mention invoke-rc.d
+
+ * Added README.Debian explaining that rtc is off by default.
+
+ -- John Hasler <jhasler@debian.org> Sat, 30 Apr 2005 18:47:30 -0500
+
+chrony (1.20-7) unstable; urgency=low
+
+ * Added info-4 to debian/rules.
+ Closes: #287142: chrony: Can't find chrony.info-4
+
+ * Corrected "See Also" section in chrony man page. Now mentions
+ chronyc(1), chronyd(8), and chrony.conf(5).
+ Closes: #287444: chrony.1.gz: SEE ALSO on man page has wrong section.
+
+ * Edited chrony.conf to disable rtc by default and explain why:
+ on some systems that use genrtc or the HPET real-time clock it
+ fails and causes chronyd to fill up the log. The failure is
+ probably due to a kernel bug, bug the logging should be
+ throttled.
+
+ * Added more explanatory comments at the servers directive in
+ chrony.conf.
+
+ * The postinst script now sends a message to root saying where the
+ password is, whether Chrony is assuming UTC or local time,
+ that rtc updating is disabled, why, and how to change it.
+
+ * Added missing '#' to
+ "Can't tell how your clock is set: assuming local time."
+ in postinst.
+
+ -- John Hasler <jhasler@debian.org> Tue, 12 Apr 2005 17:59:13 -0500
+
+chrony (1.20-6) unstable; urgency=low
+
+ * Fixed error in chrony.conf where the non-existent 'online' directive
+ was mentioned.
+ Closes: #257235 misleading instructions in chrony.conf
+
+ * Patched Makefile.in to generate faq.html.
+ Closes: #265936 /usr/share/doc/chrony/faq.txt.gz: how to read?
+
+ -- John Hasler <jhasler@debian.org> Sat, 4 Dec 2004 17:47:31 -0600
+
+chrony (1.20-5) unstable; urgency=low
+
+ * Put pool.ntp.org servers in chrony.conf as defaults.
+
+ * Fixed erroneous references to chronyd(1) in some man pages.
+ Closes: #241746 SEE ALSO chronyd(1) should be (8)
+
+ * I got a new motherboard and can no longer reproduce this.
+ If you can please reopen the bug.
+ Closes: #223518 Rtc stuff is broken
+
+ * Edited chrony.conf(5).
+ Closes: #241745 many more features have been added
+
+ * Edited chrony.conf to add logchange and mailonchange and to
+ enable rtc by default.
+ Closes: #226644 /etc/chrony/chrony.conf: rtc; not all options are noted in conf file
+
+ * Fixed upstream: see NEWS.
+ Closes: #124089 mistake in the chrony manual
+ Closes: #177366: trailing blank on log lines
+ Closes: #195618 failure to use /dev/misc/rtc floods logfiles
+ Closes: #53066 "acquisitionport" directive and doc fixes [patch]
+ Closes: #100880 RFE: don't use /proc when uname(2) will do
+ Closes: #163470: different bindaddresses for ntp port and control port
+ Closes: #200174: Chrony breaks under Kernel 2.5 (two bugs)
+
+ -- John Hasler <jhasler@debian.org> Sat, 10 Apr 2004 22:00:00 -0500
+
+chrony (1.20-4) unstable; urgency=low
+
+ * Added '#include <asm/types>' to rtc_linux.c to fix Alpha build problem.
+ Also removed spinlock stuff from configure.
+
+ -- John Hasler <jhasler@debian.org> Fri, 26 Dec 2003 21:00:00 -0600
+
+chrony (1.20-3) unstable; urgency=low
+
+ * Removed all inclusions of kernel headers.
+ Hopefully Chrony will now build on m68k.
+
+ -- John Hasler <jhasler@debian.org> Tue, 23 Dec 2003 19:00:00 -0600
+
+chrony (1.20-2) unstable; urgency=low
+
+ * Removed spinlock.h and mc146818.h from rtc_linux.c. linux/rtc.h and
+ RTC_UIE=0x10 provide everything needed now.
+ Closes: #223134 FTBFS: Errors in kernel headers
+
+ * However, rtc is now broken (and appears to have been broken for some time)
+ on 440BX chipsets with 2.4 kernels.
+
+ -- John Hasler <jhasler@debian.org> Fri, 12 Dec 2003 13:00:00 -0600
+
+chrony (1.20-1) unstable; urgency=low
+
+ * New upstream release.
+
+ * Frank Otto's patch to sys_linux.c, function guess_hz_and_shift_hz now
+ incorporated upstream.
+ Closes: #198557 Fatal error: chronyd can't determine hz for kernel with HZ=200
+
+ * Security and 64 bit patches are now incorporated upstream
+ along with most non-i386 architecture patches.
+
+ * Put correct links in /usr/share/doc/chrony/timeservers.
+ Closes: #189686 /usr/share/doc/timeservers links are broken
+
+ * Put correct links in chrony.conf.
+ Closes: #210886 bad link in chrony.conf
+
+ * Put missing newlines in apm and chrony.keys.
+ Closes: #211604 Build-warning: some files misses final newline
+
+ * Removed conflict with ntpdate.
+
+ -- John Hasler <jhasler@debian.org> Tue, 7 Oct 2003 22:00:00 -0500
+
+chrony (1.19-10) unstable; urgency=low
+
+ * Put linux/linkage.h ahead of linux/spinlock.h as I meant to in
+ the first place.
+
+ -- John Hasler <john@dhh.gt.org> Sun, 13 Jul 2003 7:00:00 -0500
+
+chrony (1.19-9) unstable; urgency=low
+
+ * Added "#include <linux/linkage.h>" to rtc_linux.c to fix mips
+ build failure.
+ Closes: #200165 chrony doesn't build on mips and mipsel
+
+ -- John Hasler <john@dhh.gt.org> Sat, 12 Jul 2003 10:00:00 -0500
+
+chrony (1.19-8) unstable; urgency=low
+
+ * Added bison to build-depends because of addition of getdate.y
+
+ -- John Hasler <john@dhh.gt.org> Tue, 3 Jun 2003 10:00:00 -0500
+
+chrony (1.19-7) unstable; urgency=high
+
+ * Closes: #186498 chronyc hangs if no chronyd is running
+ Added test for running daemon to ip-{up|down} scripts.
+ Disabled trimrtc for ALPHA
+ Closes: #195615 GPL violation - generated file without source
+ * Added a copy of getdate.y to source.
+
+ -- John Hasler <john@dhh.gt.org> Sun, 1 Jun 2003 7:00:00 -0500
+
+chrony (1.19-6) unstable; urgency=low
+
+ * Closes: #179842 "CROAK" redefined
+ Added '#undef CROAK' before CROAK redefiniton in pktlength.h,
+ added '-DALPHA' to 'alpha' condition in configure, added
+ 'ifdef ALPHA' around CROAK redefinition.
+ * Replaced many signed and unsigned longs as well as some ints,
+ shorts, and chars with stdint.h types in candm.h, md5.h, ntp.h,
+ clientlog.h, and ntp_io.c. This should fix all 64-bit problems.
+
+ -- John Hasler <john@dhh.gt.org> Fri, 14 Mar 2003 19:00:00 -0600
+
+chrony (1.19-5) unstable; urgency=high
+
+ * Closes: #184065 Assertion `sizeof(NTP_int32) == 4' failed on alpha
+ Fixed several spots where the author assumed that a long is 32 bits.
+ There are many more misuses of long as well as several of short and
+ char but I think I got the only ones likely to cause trouble.
+
+ -- John Hasler <john@dhh.gt.org> Fri, 14 Mar 2003 11:00:00 -0600
+
+chrony (1.19-4) unstable; urgency=low
+
+ * Closes: #179538 FTBFS: missing build-depends on makeinfo
+ Added texinfo to build-depends.
+ * CLoses: #179508: chrony(c|d) show wrong version numbers
+ Removed spurious version.h.
+
+ -- John Hasler <john@dhh.gt.org> Sun, 2 Feb 2003 19:00:00 -0600
+
+chrony (1.19-3) unstable; urgency=low
+
+ * Updated author's address in copyright file.
+ * Closes: #163446 patch, that scripts can handle all commandkeys
+ Applied debugged patch.
+ * Closes: #107863 doesn't know about APM
+ Put apm script in debian/ and added rules to copy it to
+ etc/apm/event.d as instructed by the apmd maintainer.
+
+ -- John Hasler <john@dhh.gt.org> Fri, 31 Jan 2003 18:00:00 -0600
+
+chrony (1.19-2) unstable; urgency=low
+
+ * Closes: #100879 unnecessary dependency on libm
+ Applied patch from Zack Weinberg <zack@codesourcery.com>
+ * Closes: #124091 the force-reload command of /etc/init.d/chrony should
+ use the -r option.
+ Added -r option.
+
+ -- John Hasler <john@dhh.gt.org> Wed, 29 Jan 2003 10:00:00 -0600
+
+chrony (1.19-1) unstable; urgency=low
+
+ * New upstream release.
+ * Closes: #178338 New upstream version fixes crashes caused by adjtimex
+ failure
+ * Closes: #178101 /etc/ppp/ip-{up,down}.d/chrony installed with
+ incorrect permissions
+ This bug was previously reported and fixed in 18-1
+ * Closes: #176130 got an error when I use ppp_on_boot
+ Changed 'update-rc.d chrony defaults 83' to
+ 'update-rc.d chrony defaults 14' in init.d so that chrony
+ will come up before ppp.
+ * Added code to postinst to read /etc/default/rcS and
+ set rtconutc appropriately in chrony.conf.
+ * Rewrote password generator in postinst.
+ * Closes: #100879 unnecessary dependency on libm
+ I don't know why this wasn't closed months ago.
+ * Closes: #103447 typo in "/etc/init.d/chrony"
+ * Closes: #124087 problems with /etc/init.d/chrony
+ Fixed script.
+ * Closes: #161350 /etc/ppp/ip-down.d/chrony cat unnecessary
+ Fixed scripts.
+ * Closes: #113840 ntp has been split - add conflicts?
+ Added ntp-simple and ntp-refclock to conflicts.
+
+ -- John Hasler <john@dhh.gt.org> Sun, 26 Jan 2003 15:00:00 -0600
+
+chrony (1.18-2) unstable; urgency=low
+
+ * Corrects error in changelog which resulted
+ in uploads being erroneously classified as NMUs.
+ * Closes: #138142, #104774, #142670, #105344, #101039
+ * Closes: #162427, #56756, #98951, #99799, #139633
+ * Closes: #163469, #163408, #167416
+
+ -- John Hasler <john@dhh.gt.org> Sun, 3 Nov 2002 20:00:00 -0600
+
+chrony (1.18-1) unstable; urgency=low
+
+ * New upstream release.
+ * Closes: #138142 new upstream release
+ * Added Mark Brown's Alpha and PowerPC patch.
+ * Closes: #104774 hppa build failure
+ Applied patch.
+ * Closes: #142670 compilation errors on sparc
+ Applied patch.
+ * Closes: #105344 ip-{up, down}.d/chrony not executable
+ Fixed debian/rules.
+ * Closes: #101039 does not run on Alpha
+ Fixed by above mentioned Mark Brown patch.
+ * Closes: #162427 description should mention NTP
+ Fixed description.
+ * Closes: #56756 README.debian should caution about hwclock
+ Fixed README.debian.
+ * Closes: #98951 no chrony.keys file installed
+ Not reproducible, probable user error.
+ * Closes: #99799 logs world readable
+ Added umask 022 to log script.
+ * Closes: #139633 documentation error
+ Added rtconutc to chrony.conf.
+ * Closes: #163469 no default case in init.d script
+ Corrected typo.
+ * Closes: #163408 PIDFILE wrongly defined in ip-{up,down}
+ No chrony script uses any such variable.
+ * Closes: #167416 needs Build-Depends: libreadline4-dev
+
+ -- <john@dhh.gt.org> Sun, 3 Nov 2002 10:00:00 -0600
+
+chrony (1.14-7) unstable; urgency=medium
+
+ * Changed rtc_linux.c to not include linux/mc146818rtc.h
+ when building for sparc, because Moshe Zadka says this
+ will allow chrony to build there.
+ * Closes: #142670
+
+ -- <jhasler@debian.org> Wed, 17 Apr 2002 17:00:00 -0500
+
+chrony (1.14-6) unstable; urgency=low
+
+ * Changed architecture back to 'any'.
+ * Applied portability patch from LaMont Jones.
+ * Closes: #104774
+
+ -- <jhasler@debian.org> Mon, 1 Apr 2002 21:00:00 -0600
+
+chrony (1.14-5) unstable; urgency=low
+
+ * Changed architecture from 'any' to 'i386 sparc'.
+ Neither I nor the author can test on anything but i386. If
+ you want chrony on anything else send me a tested patch.
+ * Closes: #101039
+ * Closes: #104774
+
+ -- <john@dhh.gt.org> Fri, 28 Dec 2001 20:10:00 -0600
+
+chrony (1.14-4) unstable; urgency=low
+
+ * Fixed bug in man pages.
+ * Closes: #95134
+
+ -- <john@dhh.gt.org> Tue, 24 Apr 2001 20:10:00 -0500
+
+chrony (1.14-3) unstable; urgency=low
+
+ * Replaced <linux/spinlock.h> in rtc_linux.c with
+ typedef int spinlock_t as suggested by Paul Slootman.
+ * Put #define CROAK(message) assert(0) in pktlength.h
+ to fix Alpha build problem.
+ * Closes: #86991
+
+ -- <john@dhh.gt.org> Sat, 24 Feb 2001 22:45:00 -0600
+
+chrony (1.14-2) unstable; urgency=low
+
+ * Closes: #84597
+
+ -- <john@dhh.gt.org> Sat, 3 Feb 2001 21:25:00 -0600
+
+chrony (1.14-1) unstable; urgency=low
+
+ * New upstream release.
+ * Fixed more sprintfs.
+ * Closes: #50793, #52570, #48216, #65209, #62924, #70377, #61485, #76661
+
+ -- <john@dhh.gt.org> Mon, 20 Nov 2000 20:25:00 -0600
+
+chrony (1.10-3) unstable; urgency=low
+
+ * Patched cron,weekly script with (corrected) patch
+ from Rene H. Larsen <renehl@post1.tele.dk>.
+ * Updated author address in copyright file.
+ * Compiled with egcs.
+ * Closes: #41885, #41551
+
+ -- <john@dhh.gt.org> Sun, 25 July 1999 12:14:00 -0500
+
+chrony (1.10-2) unstable; urgency=low
+
+ * Patched rtc_linux.c with patch for SPARC from
+ bmc@visi.net.
+
+ -- <john@dhh.gt.org> Mon, 17 May 1999 22:30:00 -0500
+
+chrony (1.10-1) unstable; urgency=low
+
+ * New upstream release.
+ * Upstream version number is 1.1. Debian version
+ number is 1.10 because previous upstream number
+ was 1.02.
+
+ -- <john@dhh.gt.org> Wed, 12 May 1999 20:30:00 -0500
+
+chrony (1.02-7) unstable; urgency=low
+
+ * Changed configure to permit building on non-Intel.
+
+ -- <john@dhh.gt.org> Wed, 5 May 1999 18:00:00 -0500
+
+chrony (1.02-6) unstable; urgency=low
+
+ * Fixed postrm bug.
+
+ -- <john@dhh.gt.org> Thur, 29 Apr 1999 18:00:00 -0500
+
+chrony (1.02-5) unstable; urgency=low
+
+ * Fixed bugs 34954 and 36921.
+ * Moved to priority extra.
+ * Added README.debian text about rtc.
+
+ -- <john@dhh.gt.org> Thur, 15 Apr 1999 21:30:00 -0500
+
+chrony (1.02-4) unstable; urgency=low
+
+ * Replaced sprintf's with snprintf's.
+
+ -- <john@dhh.gt.org> Sun, 28 Feb 1999 16:53:00 -0600
+
+chrony (1.02-3) unstable; urgency=low
+
+ * Fixed bugs in cron.weekly, ip-up.d, and ip-down.d.
+ * Bug 29981 is also fixed.
+
+ -- <john@dhh.gt.org> Sun, 6 Dec 1998 9:53:00 -0600
+
+chrony (1.02-2) unstable; urgency=low
+
+ * Added cron.weekly.
+ * Changed ip-up.d, ip-down.d, and cron.weekly to read the
+ password from chrony.keys.
+ * Added code to postinst to generate a random password and
+ put it in chrony.keys.
+
+ -- <john@dhh.gt.org> Thur, 3 Dec 1998 19:00:08 -0600
+
+chrony (1.02-1) unstable; urgency=low
+
+ * Initial Release.
+
+ -- <john@dhh.gt.org> Fri, 6 Nov 1998 23:00:08 -0600
diff --git a/debian/chrony-dnssrv@.service b/debian/chrony-dnssrv@.service
new file mode 100644
index 0000000..86d374f
--- /dev/null
+++ b/debian/chrony-dnssrv@.service
@@ -0,0 +1,17 @@
+[Unit]
+Description=DNS SRV lookup of %I for chrony
+After=chrony.service network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/chrony/chrony-helper update-dnssrv-servers %I
+ProtectSystem=strict
+PrivateDevices=yes
+ProtectHome=yes
+ReadWritePaths=/run
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
diff --git a/debian/chrony-dnssrv@.timer b/debian/chrony-dnssrv@.timer
new file mode 100644
index 0000000..8495e01
--- /dev/null
+++ b/debian/chrony-dnssrv@.timer
@@ -0,0 +1,9 @@
+[Unit]
+Description=Periodic DNS SRV lookup of %I for chrony
+
+[Timer]
+OnActiveSec=0
+OnUnitInactiveSec=1h
+
+[Install]
+WantedBy=timers.target
diff --git a/debian/chrony-helper b/debian/chrony-helper
new file mode 100755
index 0000000..5099161
--- /dev/null
+++ b/debian/chrony-helper
@@ -0,0 +1,264 @@
+#!/bin/bash
+# This script configures running chronyd to use NTP servers obtained from
+# DHCP and _ntp._udp DNS SRV records. Files with servers from DHCP are managed
+# externally (e.g. by a dhclient script). Files with servers from DNS SRV
+# records are updated here using the dig utility. The script can also list
+# and set static sources in the chronyd configuration file.
+#
+# Modified for Debian by Vincent Blut <vincent.debian@free.fr>.
+
+chronyc=/usr/bin/chronyc
+chrony_conf=/etc/chrony/chrony.conf
+chrony_service=chrony.service
+helper_dir=/run/chrony-helper
+added_servers_file=$helper_dir/added_servers
+
+dhclient_servers_files="/var/lib/dhcp/chrony.servers.*"
+dnssrv_servers_files="$helper_dir/dnssrv@*"
+dnssrv_timer_prefix=chrony-dnssrv@
+
+chrony_command() {
+ $chronyc -n -m "$1"
+}
+
+is_running() {
+ chrony_command "tracking" &> /dev/null
+}
+
+get_servers_files() {
+ echo "$dhclient_servers_files"
+ echo "$dnssrv_servers_files"
+}
+
+is_update_needed() {
+ for file in $(get_servers_files) $added_servers_file; do
+ [ -e "$file" ] && return 0
+ done
+ return 1
+}
+
+update_daemon() {
+ local all_servers_with_args all_servers added_servers
+
+ if ! is_running; then
+ rm -f $added_servers_file
+ return 0
+ fi
+
+ all_servers_with_args=$(cat $(get_servers_files) 2> /dev/null)
+
+ all_servers=$(
+ echo "$all_servers_with_args" |
+ while read -r server serverargs; do
+ echo "$server"
+ done | sort -u)
+ added_servers=$( (
+ cat $added_servers_file 2> /dev/null
+ echo "$all_servers_with_args" |
+ while read -r server serverargs; do
+ [ -z "$server" ] && continue
+ chrony_command "add server $server $serverargs" &> /dev/null &&
+ echo "$server"
+ done) | sort -u)
+
+ comm -23 <(echo -n "$added_servers") <(echo -n "$all_servers") |
+ while read -r server; do
+ chrony_command "delete $server" &> /dev/null
+ done
+
+ added_servers=$(comm -12 <(echo -n "$added_servers") <(echo -n "$all_servers"))
+
+ if [ -n "$added_servers" ]; then
+ echo "$added_servers" > $added_servers_file
+ else
+ rm -f $added_servers_file
+ fi
+}
+
+get_dnssrv_servers() {
+ local name=$1 output
+
+ if ! command -v dig &> /dev/null; then
+ echo "Missing dig (DNS lookup utility)" >&2
+ return 1
+ fi
+
+ output=$(dig "$name" srv +short +ndots=2 +search 2> /dev/null) || return 0
+
+ echo "$output" | while read -r _ _ port target; do
+ server=${target%.}
+ [ -z "$server" ] && continue
+ echo "$server port $port iburst"
+ done
+}
+
+check_dnssrv_name() {
+ local name=$1
+
+ if [ -z "$name" ]; then
+ echo "No DNS SRV name specified" >&2
+ return 1
+ fi
+
+ if [ "${name:0:9}" != _ntp._udp ]; then
+ echo "DNS SRV name $name doesn't start with _ntp._udp" >&2
+ return 1
+ fi
+}
+
+update_dnssrv_servers() {
+ local name=$1
+ local srv_file=$helper_dir/dnssrv@$name servers
+
+ check_dnssrv_name "$name" || return 1
+
+ servers=$(get_dnssrv_servers "$name")
+ if [ -n "$servers" ]; then
+ echo "$servers" > "$srv_file"
+ else
+ rm -f "$srv_file"
+ fi
+}
+
+set_dnssrv_timer() {
+ local state=$1 name=$2
+ local srv_file=$helper_dir/dnssrv@$name servers
+ local timer
+
+ timer=$dnssrv_timer_prefix$(systemd-escape "$name").timer || return 1
+
+ check_dnssrv_name "$name" || return 1
+
+ if [ "$state" = enable ]; then
+ systemctl enable "$timer"
+ systemctl start "$timer"
+ elif [ "$state" = disable ]; then
+ systemctl stop "$timer"
+ systemctl disable "$timer"
+ rm -f "$srv_file"
+ fi
+}
+
+list_dnssrv_timers() {
+ systemctl --all --full -t timer list-units | grep "^$dnssrv_timer_prefix" | \
+ sed "s|^$dnssrv_timer_prefix\(.*\)\.timer.*|\1|" |
+ while read -r name; do
+ systemd-escape --unescape "$name"
+ done
+}
+
+prepare_helper_dir() {
+ mkdir -p $helper_dir
+ exec 100> $helper_dir/lock
+ if ! flock -w 20 100; then
+ echo "Failed to lock $helper_dir" >&2
+ return 1
+ fi
+}
+
+is_source_line() {
+ local pattern="^[ \t]*(server|pool|peer|refclock)[ \t]+[^ \t]+"
+ [[ "$1" =~ $pattern ]]
+}
+
+list_static_sources() {
+ while read -r line; do
+ if is_source_line "$line"; then
+ echo "$line"
+ fi
+ done < $chrony_conf
+}
+
+set_static_sources() {
+ local new_config tmp_conf
+
+ new_config=$(
+ sources=$(
+ while read -r line; do
+ is_source_line "$line" && echo "$line"
+ done)
+
+ while read -r line; do
+ if ! is_source_line "$line"; then
+ echo "$line"
+ continue
+ fi
+
+ tmp_sources=$(
+ local removed=0
+
+ echo "$sources" | while read -r line2; do
+ if [ "$removed" -ne 0 ] || [ "$line" != "$line2" ]; then
+ echo "$line2"
+ else
+ removed=1
+ fi
+ done)
+
+ [ "$sources" == "$tmp_sources" ] && continue
+ sources=$tmp_sources
+ echo "$line"
+ done < $chrony_conf
+
+ echo "$sources"
+ )
+
+ tmp_conf=${chrony_conf}.tmp
+
+ cp -a $chrony_conf $tmp_conf &&
+ echo "$new_config" > $tmp_conf &&
+ mv $tmp_conf $chrony_conf || return 1
+
+ systemctl try-restart $chrony_service
+}
+
+print_help() {
+ echo "Usage: $0 COMMAND"
+ echo
+ echo "Commands:"
+ echo " update-daemon"
+ echo " update-dnssrv-servers NAME"
+ echo " enable-dnssrv NAME"
+ echo " disable-dnssrv NAME"
+ echo " list-dnssrv"
+ echo " list-static-sources"
+ echo " set-static-sources < sources.list"
+ echo " is-running"
+ echo " command CHRONYC-COMMAND"
+}
+
+case "$1" in
+ update-daemon|add-dhclient-servers|remove-dhclient-servers)
+ is_update_needed || exit 0
+ prepare_helper_dir && update_daemon
+ ;;
+ update-dnssrv-servers)
+ prepare_helper_dir && update_dnssrv_servers "$2" && update_daemon
+ ;;
+ enable-dnssrv)
+ set_dnssrv_timer enable "$2"
+ ;;
+ disable-dnssrv)
+ set_dnssrv_timer disable "$2" && prepare_helper_dir && update_daemon
+ ;;
+ list-dnssrv)
+ list_dnssrv_timers
+ ;;
+ list-static-sources)
+ list_static_sources
+ ;;
+ set-static-sources)
+ set_static_sources
+ ;;
+ is-running)
+ is_running
+ ;;
+ command|forced-command)
+ chrony_command "$2"
+ ;;
+ *)
+ print_help
+ exit 2
+esac
+
+exit $?
diff --git a/debian/chrony.conf b/debian/chrony.conf
new file mode 100644
index 0000000..bd63609
--- /dev/null
+++ b/debian/chrony.conf
@@ -0,0 +1,47 @@
+# Welcome to the chrony configuration file. See chrony.conf(5) for more
+# information about usable directives.
+
+# Include configuration files found in /etc/chrony/conf.d.
+confdir /etc/chrony/conf.d
+
+# Use Debian vendor zone.
+pool 2.debian.pool.ntp.org iburst
+
+# Use time sources from DHCP.
+sourcedir /run/chrony-dhcp
+
+# Use NTP sources found in /etc/chrony/sources.d.
+sourcedir /etc/chrony/sources.d
+
+# This directive specify the location of the file containing ID/key pairs for
+# NTP authentication.
+keyfile /etc/chrony/chrony.keys
+
+# This directive specify the file into which chronyd will store the rate
+# information.
+driftfile /var/lib/chrony/chrony.drift
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Uncomment the following line to turn logging on.
+#log tracking measurements statistics
+
+# Log files location.
+logdir /var/log/chrony
+
+# Stop bad estimates upsetting machine clock.
+maxupdateskew 100.0
+
+# This directive enables kernel synchronisation (every 11 minutes) of the
+# real-time clock. Note that it can't be used along with the 'rtcfile' directive.
+rtcsync
+
+# Step the system clock instead of slewing it if the adjustment is larger than
+# one second, but only in the first three clock updates.
+makestep 1 3
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+# This directive must be commented out when using time sources serving
+# leap-smeared time.
+leapsectz right/UTC
diff --git a/debian/chrony.default b/debian/chrony.default
new file mode 100644
index 0000000..028f63d
--- /dev/null
+++ b/debian/chrony.default
@@ -0,0 +1,6 @@
+# This is a configuration file for /etc/init.d/chrony and
+# /lib/systemd/system/chrony.service; it allows you to pass various options to
+# the chrony daemon without editing the init script or service file.
+
+# Options to pass to chrony.
+DAEMON_OPTS="-F 1"
diff --git a/debian/chrony.dhcp b/debian/chrony.dhcp
new file mode 100644
index 0000000..f3dacd7
--- /dev/null
+++ b/debian/chrony.dhcp
@@ -0,0 +1,27 @@
+CHRONY_SOURCEDIR=/run/chrony-dhcp
+SERVERFILE=$CHRONY_SOURCEDIR/$interface.sources
+
+chrony_config() {
+ rm -f "$SERVERFILE"
+ mkdir -p "$CHRONY_SOURCEDIR"
+ for server in $new_ntp_servers; do
+ echo "server $server iburst" >> "$SERVERFILE"
+ done
+ /usr/bin/chronyc reload sources > /dev/null 2>&1 || :
+}
+
+chrony_restore() {
+ if [ -f "$SERVERFILE" ]; then
+ rm -f "$SERVERFILE"
+ /usr/bin/chronyc reload sources > /dev/null 2>&1 || :
+ fi
+}
+
+case $reason in
+ BOUND|RENEW|REBIND|REBOOT)
+ chrony_config
+ ;;
+ EXPIRE|FAIL|RELEASE|STOP)
+ chrony_restore
+ ;;
+esac
diff --git a/debian/chrony.examples b/debian/chrony.examples
new file mode 100644
index 0000000..1a0e8e2
--- /dev/null
+++ b/debian/chrony.examples
@@ -0,0 +1 @@
+examples/chrony.conf*
diff --git a/debian/chrony.if-post-down b/debian/chrony.if-post-down
new file mode 100644
index 0000000..4cc0796
--- /dev/null
+++ b/debian/chrony.if-post-down
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+[ -x /usr/sbin/chronyd ] || exit 0
+
+if [ -e /run/chrony/chronyd.pid ]; then
+ chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0
diff --git a/debian/chrony.if-up b/debian/chrony.if-up
new file mode 100644
index 0000000..4cc0796
--- /dev/null
+++ b/debian/chrony.if-up
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+[ -x /usr/sbin/chronyd ] || exit 0
+
+if [ -e /run/chrony/chronyd.pid ]; then
+ chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0
diff --git a/debian/chrony.keys b/debian/chrony.keys
new file mode 100644
index 0000000..a2d655d
--- /dev/null
+++ b/debian/chrony.keys
@@ -0,0 +1,10 @@
+# This file is solely used for NTP authentication with symmetric keys
+# as defined by RFC 1305 and RFC 5905.
+#
+# It can contain ID/key pairs which can be generated using the “keygen” option
+# from “chronyc”; for example:
+# chronyc keygen 1 SHA256 256 >> /etc/chrony/chrony.keys
+# would generate a 256-bit SHA-256 key using ID 1.
+#
+# A list of supported hash functions and output encoding is available by
+# consulting the "keyfile" directive in the chrony.conf(5) man page.
diff --git a/debian/chrony.lintian-overrides b/debian/chrony.lintian-overrides
new file mode 100644
index 0000000..83260a6
--- /dev/null
+++ b/debian/chrony.lintian-overrides
@@ -0,0 +1,7 @@
+# The “chrony.keys” file must not be world readable as it could contain
+# symmetric keys used for NTP authentication.
+chrony: non-standard-file-perm 0640 != 0644 [usr/share/chrony/chrony.keys]
+
+# NetworkManager does not execute dispatcher scripts in /usr/libexec.
+chrony: executable-in-usr-lib [usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp]
+chrony: executable-in-usr-lib [usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline]
diff --git a/debian/chrony.maintscript b/debian/chrony.maintscript
new file mode 100644
index 0000000..740a898
--- /dev/null
+++ b/debian/chrony.maintscript
@@ -0,0 +1 @@
+rm_conffile /etc/NetworkManager/dispatcher.d/20-chrony 3.5-7~ chrony
diff --git a/debian/chrony.ppp.ip-down b/debian/chrony.ppp.ip-down
new file mode 100644
index 0000000..c077551
--- /dev/null
+++ b/debian/chrony.ppp.ip-down
@@ -0,0 +1,13 @@
+#!/bin/sh
+# This script tells chronyd that the connection is down
+# so that it won't try to contact the server.
+# John Hasler <jhasler@debian.org> 1998-2003
+# Any possessor of a copy of this program may treat it as if it
+# were in the public domain. I waive all rights.
+# Modified by Vincent Blut <vincent.debian@free.fr>
+
+if [ -e /run/chrony/chronyd.pid ]; then
+ chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0
diff --git a/debian/chrony.ppp.ip-up b/debian/chrony.ppp.ip-up
new file mode 100644
index 0000000..9c8d089
--- /dev/null
+++ b/debian/chrony.ppp.ip-up
@@ -0,0 +1,12 @@
+#!/bin/sh
+# This script tells chronyd that the connection is up so that it can
+# contact the server. John Hasler <jhasler@debian.org> 1998-2003
+# Any possessor of a copy of this program may treat it as if it
+# were in the public domain. I waive all rights.
+# Modified by Vincent Blut <vincent.debian@free.fr>
+
+if [ -e /run/chrony/chronyd.pid ]; then
+ chronyc onoffline > /dev/null 2>&1
+fi
+
+exit 0
diff --git a/debian/chrony.service b/debian/chrony.service
new file mode 100644
index 0000000..50d08fa
--- /dev/null
+++ b/debian/chrony.service
@@ -0,0 +1,65 @@
+[Unit]
+Description=chrony, an NTP client/server
+Documentation=man:chronyd(8) man:chronyc(1) man:chrony.conf(5)
+Conflicts=openntpd.service ntp.service ntpsec.service
+Wants=time-sync.target
+Before=time-sync.target
+After=network.target
+ConditionCapability=CAP_SYS_TIME
+
+[Service]
+Type=forking
+PIDFile=/run/chrony/chronyd.pid
+EnvironmentFile=-/etc/default/chrony
+User=_chrony
+# Daemon is started as root, but still sandboxed
+ExecStart=!/usr/sbin/chronyd $DAEMON_OPTS
+
+CapabilityBoundingSet=~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE
+CapabilityBoundingSet=~CAP_BLOCK_SUSPEND CAP_KILL CAP_LEASE CAP_LINUX_IMMUTABLE
+CapabilityBoundingSet=~CAP_MAC_ADMIN CAP_MAC_OVERRIDE CAP_MKNOD CAP_SYS_ADMIN
+CapabilityBoundingSet=~CAP_SYS_BOOT CAP_SYS_CHROOT CAP_SYS_MODULE CAP_SYS_PACCT
+CapabilityBoundingSet=~CAP_SYS_PTRACE CAP_SYS_RAWIO CAP_SYS_TTY_CONFIG CAP_WAKE_ALARM
+DeviceAllow=char-pps rw
+DeviceAllow=char-ptp rw
+DeviceAllow=char-rtc rw
+DevicePolicy=closed
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProcSubset=pid
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+# Used for gps refclocks
+ReadWritePaths=/run
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallFilter=~@cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap
+
+ConfigurationDirectory=chrony
+RuntimeDirectory=chrony
+RuntimeDirectoryMode=0700
+# See dumpdir in chrony.conf(5)
+RuntimeDirectoryPreserve=restart
+StateDirectory=chrony
+StateDirectoryMode=0750
+LogsDirectory=chrony
+LogsDirectoryMode=0750
+
+# Adjust restrictions for /usr/sbin/sendmail (mailonchange directive)
+NoNewPrivileges=no
+ReadWritePaths=-/var/spool
+RestrictAddressFamilies=AF_NETLINK
+
+[Install]
+Alias=chronyd.service
+WantedBy=multi-user.target
diff --git a/debian/clean b/debian/clean
new file mode 100644
index 0000000..70f5857
--- /dev/null
+++ b/debian/clean
@@ -0,0 +1 @@
+getdate.c
diff --git a/debian/conf.d/README b/debian/conf.d/README
new file mode 100644
index 0000000..de1fa8e
--- /dev/null
+++ b/debian/conf.d/README
@@ -0,0 +1,7 @@
+Files found under the /etc/chrony/conf.d directory with the .conf suffix are
+parsed in the lexicographical order of the file names when chronyd starts up.
+This enables a fragmented configuration of chronyd.
+
+Although those files can contain any directives listed in chrony.conf(5),
+it would be wiser to add NTP sources in the /etc/chrony/sources.d
+directory. Please read /etc/chrony/sources.d/README for more information.
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..e5ceea2
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,54 @@
+Source: chrony
+Section: net
+Priority: optional
+Maintainer: Vincent Blut <vincent.debian@free.fr>
+Standards-Version: 4.6.2
+Build-Depends: asciidoctor,
+ bison,
+ debhelper-compat (= 13),
+ dh-apparmor,
+ gnutls-bin <!nocheck>,
+ iproute2 [linux-any] <!nocheck>,
+ libcap-dev [linux-any],
+ libedit-dev,
+ libgnutls28-dev,
+ libseccomp-dev (>= 2.4.3-1~) [amd64 arm64 armel armhf hppa i386 mips mipsel mips64el powerpc powerpcspe ppc64 ppc64el riscv64 s390x x32],
+ nettle-dev,
+ pkg-config,
+ pps-tools [linux-any],
+ procps <!nocheck>
+Homepage: https://chrony.tuxfamily.org
+Vcs-Git: https://salsa.debian.org/debian/chrony.git -b debian/latest
+Vcs-Browser: https://salsa.debian.org/debian/chrony
+Rules-Requires-Root: no
+
+Package: chrony
+Architecture: linux-any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: adduser,
+ iproute2 [linux-any],
+ tzdata,
+ ucf,
+ ${misc:Depends},
+ ${shlibs:Depends}
+Suggests: dnsutils,
+ networkd-dispatcher
+Breaks: network-manager (<< 1.20.0-1~)
+Conflicts: time-daemon
+Provides: time-daemon
+Replaces: time-daemon
+Description: Versatile implementation of the Network Time Protocol
+ It consists of a pair of programs:
+ .
+ chronyd: This is a daemon which runs in background on the system.
+ It obtains measurements (e.g. via the network) of the system's offset
+ relative to other systems and adjusts the system time accordingly. For
+ isolated systems, the user can periodically enter the correct time by
+ hand (using 'chronyc'). In either case 'chronyd' determines the rate
+ at which the computer gains or loses time, and compensates for this.
+ Chronyd implements the NTP protocol and can act as either a client or
+ a server.
+ .
+ chronyc: This is a command-line driven control and monitoring program.
+ An administrator can use this to fine-tune various parameters within
+ the daemon, add or delete servers etc whilst the daemon is running.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..f9f65f6
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,187 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: chrony
+Upstream-Contact: Miroslav Lichvar <mlichvar@redhat.com>
+Source: https://download.tuxfamily.org/chrony/
+
+Files: *
+Copyright: 2009-2021, Miroslav Lichvar
+ 1997-2007, Richard P. Curnow
+License: GPL-2
+
+Files: main.c
+ sys_linux.c
+Copyright: 2012-2020, Miroslav Lichvar
+ 2009, John G. Hasler
+ 1997-2003, Richard P. Curnow
+License: GPL-2
+
+Files: ntp_io.c
+Copyright: 2009, 2013-2016, 2018-2021, Miroslav Lichvar
+ 2009, Timo Teras
+ 1997-2003, Richard P. Curnow
+License: GPL-2
+
+Files: sys_macosx.?
+Copyright: 2015, 2017, 2020, Bryan Christianson
+ 2001, J. Hannken-Illjes
+ 1997-2001, Richard P. Curnow
+License: GPL-2
+
+Files: sys_netbsd.?
+Copyright: 2001, J. Hannken-Illjes
+ 1997-2001, Richard P. Curnow
+License: GPL-2
+
+Files: debian/*
+Copyright: 2015-2023, Vincent Blut
+ 2012-2014, Joachim Wiedorn
+ 2000-2012, John Hasler
+License: GPL-2
+
+Files: test/simulation/test.common
+Copyright: 2013-2014, Miroslav Lichvar
+License: GPL-2+
+
+Files: privops.c
+Copyright: 2015, Bryan Christianson
+ 2017, Miroslav Lichvar
+License: GPL-2
+
+Files: privops.h
+Copyright: 2015, Bryan Christianson
+License: GPL-2
+
+Files: contrib/bryan_christianson_1/chronylogrotate.sh
+Copyright: 2015, Bryan Christianson
+License: GPL-2
+
+Files: test/unit/*
+Copyright: 2016-2022, Miroslav Lichvar
+License: GPL-2
+
+Files: hwclock.?
+Copyright: 2016-2018, 2022, Miroslav Lichvar
+License: GPL-2
+
+Files: ntp_io_linux.?
+Copyright: 2016-2019, 2021-2022 Miroslav Lichvar
+License: GPL-2
+
+Files: ntp_signd.?
+Copyright: 2016, Miroslav Lichvar
+License: GPL-2
+
+Files: client.c
+Copyright: 1997-2003, Richard P. Curnow
+ 2016, Lonnie Abelbeck
+ 2009-2022, Miroslav Lichvar
+License: GPL-2
+
+Files: configure
+Copyright: 1997-2003, Richard P. Curnow
+ 2016, Bryan Christianson
+ 2009, 2012-2021, Miroslav Lichvar
+ 2019, Stefan R. Filipek
+License: GPL-2
+
+Files: doc/chrony.conf.adoc
+Copyright: 1997-2003, Richard P. Curnow
+ 2016, Stephen Wadeley
+ 2009-2022, Miroslav Lichvar
+ 2017, Bryan Christianson
+License: GPL-2
+
+Files: doc/chronyc.adoc
+Copyright: 1997-2003, Richard P. Curnow
+ 2016, Stephen Wadeley
+ 2009-2017, 2019-2022, Miroslav Lichvar
+License: GPL-2
+
+Files: refclock.c
+Copyright: 2009-2011, 2013-2014, 2016-2019, 2022 Miroslav Lichvar
+License: GPL-2
+
+Files: refclock_phc.c
+Copyright: 2013, 2017, Miroslav Lichvar
+License: GPL-2
+
+Files: regress.c
+Copyright: 1997-2003, Richard P. Curnow
+ 2011, 2016-2017, Miroslav Lichvar
+License: GPL-2
+
+Files: sched.c
+Copyright: 1997-2003, Richard P. Curnow
+ 2011, 2013-2016, Miroslav Lichvar
+License: GPL-2
+
+Files: sourcestats.c
+Copyright: 1997-2003, Richard P. Curnow
+ 2011-2014, 2016-2018, 2021, Miroslav Lichvar
+License: GPL-2
+
+Files: stubs.c
+Copyright: 2014-2016, Miroslav Lichvar
+License: GPL-2
+
+Files: hash_nettle.c
+Copyright: 2018, Miroslav Lichvar
+License: GPL-2
+
+Files: test/system/*
+Copyright: 2019, Miroslav Lichvar
+License: GPL-2
+
+Files: md5.*
+Copyright: 1990, RSA Data Security, Inc. All rights reserved.
+License: RSA-MD
+ License to copy and use this software is granted provided that
+ it is identified as the "RSA Data Security, Inc. MD5 Message-
+ Digest Algorithm" in all material mentioning or referencing this
+ software or this function.
+ .
+ License is also granted to make and use derivative works
+ provided that such works are identified as "derived from the RSA
+ Data Security, Inc. MD5 Message-Digest Algorithm" in all
+ material mentioning or referencing the derived work.
+ .
+ RSA Data Security, Inc. makes no representations concerning
+ either the merchantability of this software or the suitability
+ of this software for any particular purpose. It is provided "as
+ is" without express or implied warranty of any kind.
+ .
+ These notices must be retained in any copies of any part of this
+ documentation and/or software.
+
+License: GPL-2
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU General Public License version 2 as
+ published by the Free Software Foundation.
+ .
+ This package is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>.
+ .
+ On Debian systems, the complete text of the GNU General Public License
+ version 2 can be found in the file `/usr/share/common-licenses/GPL-2'.
+
+License: GPL-2+
+ This package is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+ .
+ This package is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <https://www.gnu.org/licenses/>
+ .
+ On Debian systems, the complete text of the GNU General Public License
+ version 2 can be found in `/usr/share/common-licenses/GPL-2'.
diff --git a/debian/dirs b/debian/dirs
new file mode 100644
index 0000000..152a039
--- /dev/null
+++ b/debian/dirs
@@ -0,0 +1,6 @@
+etc/chrony
+etc/logrotate.d
+etc/ppp/ip-down.d
+etc/ppp/ip-up.d
+usr/lib/NetworkManager/dispatcher.d
+var/lib/chrony
diff --git a/debian/docs b/debian/docs
new file mode 100644
index 0000000..e12f653
--- /dev/null
+++ b/debian/docs
@@ -0,0 +1,3 @@
+FAQ
+NEWS
+README
diff --git a/debian/init b/debian/init
new file mode 100644
index 0000000..ce121d7
--- /dev/null
+++ b/debian/init
@@ -0,0 +1,69 @@
+#! /bin/sh
+#
+# Written by Miquel van Smoorenburg <miquels@drinkel.ow.org>.
+# Modified for Debian GNU/Linux by Ian Murdock <imurdock@gnu.ai.mit.edu>.
+# Modified for Debian by Christoph Lameter <clameter@debian.org>
+# Modified for chrony by John Hasler <jhasler@debian.org> 1998-2012
+# Modified for Debian by Vincent Blut <vincent.debian@free.fr>
+
+### BEGIN INIT INFO
+# Provides: chrony
+# Required-Start: $remote_fs
+# Required-Stop: $remote_fs
+# Should-Start: $syslog $network $named $time
+# Should-Stop: $syslog $network $named $time
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: Controls chronyd NTP time daemon
+# Description: Chronyd is the NTP time daemon in the Chrony package
+### END INIT INFO
+
+PATH=/bin:/usr/bin:/sbin:/usr/sbin
+DAEMON=/usr/sbin/chronyd
+NAME="chronyd"
+DESC="time daemon"
+PIDFILE=/run/chrony/chronyd.pid
+
+[ -x "$DAEMON" ] || exit 0
+
+. /lib/lsb/init-functions
+
+# Override this variable by editing /etc/default/chrony.
+DAEMON_OPTS=""
+if [ -f /etc/default/chrony ]; then
+ . /etc/default/chrony
+fi
+
+case "$1" in
+ start)
+ if $0 status > /dev/null ; then
+ log_success_msg "$NAME is already running"
+ else
+ log_daemon_msg "Starting $DESC" "$NAME"
+ start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- $DAEMON_OPTS
+ log_end_msg $?
+ fi
+ ;;
+
+ stop)
+ log_daemon_msg "Stopping $DESC" "$NAME"
+ start-stop-daemon --stop --quiet --oknodo --pidfile $PIDFILE --exec $DAEMON
+ log_end_msg $?
+ ;;
+
+ restart|force-reload)
+ $0 stop
+ $0 start
+ ;;
+
+ status)
+ status_of_proc -p $PIDFILE "$DAEMON" "$NAME" && exit 0 || exit $?
+ ;;
+
+ *)
+ log_action_msg "Usage: /etc/init.d/chrony {start|stop|restart|force-reload|status}"
+ exit 1
+ ;;
+esac
+
+exit 0
diff --git a/debian/install b/debian/install
new file mode 100644
index 0000000..5e0f25b
--- /dev/null
+++ b/debian/install
@@ -0,0 +1,8 @@
+debian/chrony-dnssrv@.* lib/systemd/system
+debian/chrony-helper usr/libexec/chrony
+debian/chrony.conf usr/share/chrony
+debian/conf.d etc/chrony
+debian/ntp-units.d/50-chrony.list usr/lib/systemd/ntp-units.d
+debian/sources.d etc/chrony
+debian/usr.sbin.chronyd etc/apparmor.d
+examples/chrony-wait.service lib/systemd/system
diff --git a/debian/links b/debian/links
new file mode 100644
index 0000000..31cfb4a
--- /dev/null
+++ b/debian/links
@@ -0,0 +1,5 @@
+# Update sources in response to systemd-networkd events (LP: #1718227).
+# This is reusing the NetworkManager dispatch script which has no hard
+# dependency to NetworkManager (not using any of its arguments)
+usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline usr/lib/networkd-dispatcher/routable.d/chrony-onoffline
+usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline usr/lib/networkd-dispatcher/off.d/chrony-onoffline
diff --git a/debian/ntp-units.d/50-chrony.list b/debian/ntp-units.d/50-chrony.list
new file mode 100644
index 0000000..6b9cca0
--- /dev/null
+++ b/debian/ntp-units.d/50-chrony.list
@@ -0,0 +1 @@
+chrony.service
diff --git a/debian/patches/nm-dispatcher-dhcp_Move-server_dir-to-run.patch b/debian/patches/nm-dispatcher-dhcp_Move-server_dir-to-run.patch
new file mode 100644
index 0000000..2df6629
--- /dev/null
+++ b/debian/patches/nm-dispatcher-dhcp_Move-server_dir-to-run.patch
@@ -0,0 +1,19 @@
+Description: Move server_dir path to /run
+Author: Vincent Blut <vincent.debian@free.fr>
+Forwarded: no
+Last-Update: 2020-09-16
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+Index: chrony/examples/chrony.nm-dispatcher.dhcp
+===================================================================
+--- chrony.orig/examples/chrony.nm-dispatcher.dhcp
++++ chrony/examples/chrony.nm-dispatcher.dhcp
+@@ -10,7 +10,7 @@ action=$2
+
+ chronyc=/usr/bin/chronyc
+ server_options=iburst
+-server_dir=/var/run/chrony-dhcp
++server_dir=/run/chrony-dhcp
+
+ dhcp_server_file=$server_dir/$interface.sources
+ dhcp_ntp_servers="$DHCP4_NTP_SERVERS $DHCP6_DHCP6_NTP_SERVERS"
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..f5b7c27
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+nm-dispatcher-dhcp_Move-server_dir-to-run.patch
diff --git a/debian/postinst b/debian/postinst
new file mode 100644
index 0000000..8a00a77
--- /dev/null
+++ b/debian/postinst
@@ -0,0 +1,80 @@
+#!/bin/sh
+# postinst script for chrony
+#
+# see: dh_installdeb(1)
+
+set -e
+
+
+# targets: configure|abort-upgrade|abort-remove|abort-deconfigure
+
+case "$1" in
+ configure)
+
+ adduser --force-badname \
+ --system \
+ --group \
+ --quiet \
+ --gecos "Chrony daemon" \
+ --home /var/lib/chrony \
+ --no-create-home _chrony
+
+ if command -v ucf >/dev/null
+ then
+ ucf --three-way /usr/share/chrony/chrony.conf /etc/chrony/chrony.conf
+ ucf --three-way /usr/share/chrony/chrony.keys /etc/chrony/chrony.keys
+ if [ -x "$(command -v ucfr)" ]; then
+ ucfr chrony /etc/chrony/chrony.conf
+ ucfr chrony /etc/chrony/chrony.keys
+ fi
+ fi
+
+ # Change the user and group ownership of "/var/l{ib,og}/chrony" iif
+ # the chronyd's configuration does not contain the "user" directive.
+ # Also, update these directories' mode bits to 0750 to follow upstream.
+ #
+ # We must also ensure that chronyd can read /etc/chrony/chrony.keys
+ # after dropping root privileges.
+ if ! chronyd -p | grep -q "^user"; then
+ for d in /var/lib/chrony /var/log/chrony /etc/chrony/chrony.keys; do
+ if ! dpkg-statoverride --list "$d" >/dev/null; then
+ if [ "$d" = "/etc/chrony/chrony.keys" ]; then
+ dpkg-statoverride --update --add root _chrony 0640 "$d"
+ else
+ dpkg-statoverride --update --add _chrony _chrony 0750 "$d"
+ fi
+ fi
+ done
+ fi
+
+ if [ -n "$2" ] && dpkg --compare-versions "$2" lt 4.0~pre4-1; then
+ # Migrate NTP sources obtained from DHCP to /run/chrony-dhcp
+ mkdir -p /run/chrony-dhcp
+ for file in $(find /var/lib/dhcp/ -type f -name "chrony.servers.*"); do
+ sed 's/.*/server &/' < "$file" > /run/chrony-dhcp/"${file##*servers.}.sources"
+ done
+
+ # Remove the staled PID file resulting from migrating its path from
+ # /run to /run/chrony/. Overriding dh_installinit and
+ # dh_systemd_start to use the --no-restart-after-upgrade option
+ # was a possibility but chronyd would have been down even longer
+ # during the upgrade.
+ rm -f /run/chronyd.pid
+ fi
+ ;;
+
+ abort-upgrade|abort-remove|abort-deconfigure)
+ ;;
+
+ *)
+ echo "postinst called with unknown argument \`$1'" >&2
+ exit 1
+ ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/postrm b/debian/postrm
new file mode 100644
index 0000000..79713e3
--- /dev/null
+++ b/debian/postrm
@@ -0,0 +1,56 @@
+#!/bin/sh
+# postrm script for chrony
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# targets: purge|remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear
+
+case "$1" in
+ purge)
+ rm -f /var/lib/chrony/*
+ rm -f /etc/chrony/chrony.conf
+ rm -f /etc/chrony/chrony.keys
+ if command -v ucf >/dev/null
+ then
+ ucf --purge /etc/chrony/chrony.conf
+ ucf --purge /etc/chrony/chrony.keys
+ if [ -x "$(command -v ucfr)" ]; then
+ ucfr --purge chrony /etc/chrony/chrony.conf
+ ucfr --purge chrony /etc/chrony/chrony.keys
+ fi
+ fi
+ rm -rf /etc/chrony
+ rm -rf /run/chrony || true
+ rm -rf /run/chrony-dhcp || true
+ rm -rf /var/lib/chrony
+ rm -rf /var/log/chrony
+ # Remove "_chrony" system user/group
+ if [ -x "$(command -v deluser)" ]
+ then
+ deluser --quiet --system _chrony > /dev/null 2>&1 || true
+ fi
+
+ for d in /var/lib/chrony /var/log/chrony /etc/chrony/chrony.keys; do
+ if dpkg-statoverride --list "$d" >/dev/null; then
+ dpkg-statoverride --remove "$d"
+ fi
+ done
+ ;;
+
+ remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+ ;;
+
+ *)
+ echo "postrm called with unknown argument \`$1'" >&2
+ exit 1
+ ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/prerm b/debian/prerm
new file mode 100644
index 0000000..ec12057
--- /dev/null
+++ b/debian/prerm
@@ -0,0 +1,28 @@
+#!/bin/sh
+# prerm script for chrony
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# targets: remove|upgrade|deconfigure|failed-upgrade
+
+case "$1" in
+ remove|upgrade|deconfigure)
+ ;;
+
+ failed-upgrade)
+ ;;
+
+ *)
+ echo "prerm called with unknown argument \`$1'" >&2
+ exit 1
+ ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..202e0e8
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,49 @@
+#!/usr/bin/make -f
+
+-include /usr/share/dpkg/buildtools.mk
+export CC
+
+include /usr/share/dpkg/architecture.mk
+
+export DEB_BUILD_MAINT_OPTIONS=hardening=+all
+
+BASE=debian/chrony
+
+%:
+ dh $@
+
+override_dh_auto_configure:
+ dh_auto_configure -- --mandir=/usr/share/man \
+ --sysconfdir=/etc/chrony \
+ --with-user=_chrony \
+ --enable-scfilter \
+ --chronyrundir=/run/chrony \
+ --with-ntp-era=$(shell date -d '1970-01-01 00:00:00+00:00' +'%s') \
+ --enable-ntp-signd \
+ --with-hwclockfile=/etc/adjtime \
+ --with-pidfile=/run/chrony/chronyd.pid \
+ --host-system=Linux
+
+override_dh_install:
+ dh_install
+ install -m 0640 -t $(BASE)/usr/share/chrony/ debian/chrony.keys
+ install -m 0755 -T examples/chrony.nm-dispatcher.dhcp ${BASE}/usr/lib/NetworkManager/dispatcher.d/20-chrony-dhcp
+ install -m 0755 -T examples/chrony.nm-dispatcher.onoffline $(BASE)/usr/lib/NetworkManager/dispatcher.d/20-chrony-onoffline
+ install -m 0644 -T examples/chrony.logrotate $(BASE)/etc/logrotate.d/chrony
+ dh_apparmor --profile-name=usr.sbin.chronyd -pchrony
+ install -D -p -m 0644 debian/chrony.dhcp $(BASE)/etc/dhcp/dhclient-exit-hooks.d/chrony
+
+override_dh_fixperms:
+ dh_fixperms -X usr/share/chrony/chrony.keys
+
+override_dh_installinit:
+ dh_installinit
+# Disable the system call filter on architectures mentioned below
+# due to missing support in libseccomp and/or in the Linux kernel.
+ifneq (,$(filter $(DEB_HOST_ARCH), alpha ia64 m68k sh4 sparc64))
+ sed -i '/DAEMON_OPTS=/s/"-F 1"/""/' $(BASE)/etc/default/chrony
+endif
+
+override_dh_installsystemd:
+ dh_installsystemd chrony.service
+ dh_installsystemd --no-enable --no-start chrony-wait.service
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..163aaf8
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/debian/sources.d/README b/debian/sources.d/README
new file mode 100644
index 0000000..184eaec
--- /dev/null
+++ b/debian/sources.d/README
@@ -0,0 +1,12 @@
+Only NTP sources can be specified in the /etc/chrony/sources.d directory.
+Files in this directory must end with the ".sources" suffix. They can only
+contain the "peer", "pool" and "server" directives and must have all
+lines terminated by a trailing newline.
+
+There is no need to restart chronyd for these time sources to be usable,
+running 'chronyc reload sources' is sufficient.
+
+Example:
+
+# echo 'server 192.0.2.1 iburst' > /etc/chrony/sources.d/local-ntp-server.sources
+# chronyc reload sources
diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..5586711
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,28 @@
+Tests: upstream-simulation-test-suite
+Depends: @builddeps@, build-essential, ca-certificates, wget
+Restrictions: isolation-container, build-needed, skippable, needs-root, needs-internet
+
+Tests: time-sources-from-dhcp-servers
+Depends: @, isc-dhcp-server, isc-dhcp-client, iproute2, kmod
+Restrictions: isolation-machine, needs-root
+
+Features: test-name=run_system_tests
+Test-Command: debian/tests/upstream-system-tests
+Depends: @builddeps@
+Restrictions: build-needed, isolation-container, needs-root
+
+Features: test-name=run_destructive_system_tests
+Test-Command: debian/tests/upstream-system-tests -d 1[0-9][0-9]-*
+Depends: @, @builddeps@, ethtool
+Restrictions: build-needed, isolation-machine, needs-root
+
+Tests: fragmented-configuration
+Restrictions: isolation-container, needs-root
+
+Tests: dynamically-add-source
+Depends: @, dpkg-dev
+Restrictions: isolation-container, needs-root, skippable
+
+Tests: ntp-server-and-nts-auth
+Depends: @, dpkg-dev, gnutls-bin
+Restrictions: isolation-container, needs-root, skippable
diff --git a/debian/tests/dynamically-add-source b/debian/tests/dynamically-add-source
new file mode 100644
index 0000000..1e4c160
--- /dev/null
+++ b/debian/tests/dynamically-add-source
@@ -0,0 +1,27 @@
+#!/bin/sh
+# Make sure that NTP sources from /etc/chrony/sources.d are usable.
+
+set -e
+
+. debian/tests/helper-functions
+
+server_addr="192.0.2.1"
+
+printf "Preparing chronyd configuration: "
+__no_system_clock_control
+__restart_chronyd && __test_ok || __test_skip
+
+printf "Adding a dummy server to the list of NTP sources: "
+printf "server $server_addr\n" > /etc/chrony/sources.d/dummy-server.sources && __test_ok || __test_fail
+
+printf "Reloading NTP sources: "
+__reload_sources
+
+printf "Checking for dummy server availability: "
+__check_sources "$server_addr"
+
+printf "Checking for dummy server availability after restarting chronyd: "
+__restart_chronyd
+__check_sources "$server_addr"
+
+exit 0
diff --git a/debian/tests/fragmented-configuration b/debian/tests/fragmented-configuration
new file mode 100644
index 0000000..2135df3
--- /dev/null
+++ b/debian/tests/fragmented-configuration
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Make sure that fragmented configuration works as expected.
+
+set -e
+
+. debian/tests/helper-functions
+
+printf 'Setting "authselectmode prefer" as authentication policy: '
+echo "authselectmode prefer" > /etc/chrony/conf.d/authentication-policy.conf && __test_ok || __test_fail
+
+printf "Restart chronyd: "
+systemctl --quiet restart chrony.service && __test_ok || __test_fail
+
+printf "Checking that chronyd uses the defined authentication policy: "
+chronyd -p | grep -q "authselectmode prefer" && __test_ok || __test_fail
+
+exit 0
diff --git a/debian/tests/helper-functions b/debian/tests/helper-functions
new file mode 100644
index 0000000..7df6ee9
--- /dev/null
+++ b/debian/tests/helper-functions
@@ -0,0 +1,53 @@
+__no_system_clock_control() {
+ if ! dpkg-vendor --derives-from Ubuntu; then
+ sed -i '/^DAEMON_OPTS=/s/"\(.*\)"/"\1 -x"/' /etc/default/chrony
+ mkdir -p /etc/systemd/system/chrony.service.d
+ cat <<EOF > /etc/systemd/system/chrony.service.d/override.conf
+[Unit]
+ConditionCapability=
+EOF
+ systemctl daemon-reload
+ fi
+}
+
+__test_fail() {
+ printf 'FAIL\n' >&2
+ return 1
+}
+
+__test_ok() {
+ printf 'OK\n'
+ return 0
+}
+
+__test_skip() {
+ [ -n "$1" ] && printf 'SKIP: (%s)\n' "$1" || printf 'SKIP\n'
+ exit 77
+}
+
+__reload_sources() {
+ chronyc reload sources > /dev/null 2>&1 && __test_ok || __test_fail
+}
+
+__restart_chronyd() {
+ systemctl --quiet restart chrony.service
+ rc=$?
+ sleep 3
+ return $rc
+}
+
+__check_sources() {
+ chronyc sources | grep -q "$1" && __test_ok || __test_fail
+}
+
+__check_auth() {
+ chronyc -c authdata | grep -q "$1" && __test_ok || __test_fail
+}
+
+# Ubuntu's default config is fully populated causing issues with the test
+# If any of those tests run on Ubuntu, clear some and restart the daemon
+# to pick this up before entering the tests.
+if grep -q "^pool.*ubuntu.pool.ntp.org" /etc/chrony/chrony.conf; then
+ sudo sed -i -e '/^pool.*ubuntu.pool.ntp.org/d' /etc/chrony/chrony.conf
+ __restart_chronyd
+fi
diff --git a/debian/tests/ntp-server-and-nts-auth b/debian/tests/ntp-server-and-nts-auth
new file mode 100644
index 0000000..b7d8877
--- /dev/null
+++ b/debian/tests/ntp-server-and-nts-auth
@@ -0,0 +1,59 @@
+#!/bin/sh
+# Check that chronyd is able to authenticate NTP packets when NTS is enabled
+# on the server.
+
+set -e
+
+. debian/tests/helper-functions
+
+cert_dir="/var/lib/chrony"
+cert_template="$cert_dir/cert.cfg"
+cert_file="$cert_dir/server.crt"
+priv_key="$cert_dir/server.key"
+server_addr="127.0.1.1"
+server_name="chrony-nts-test"
+
+create_cert_template() {
+ printf "Creating certificate template: "
+ cat <<EOF > "$cert_template"
+cn = "$server_name"
+serial = 001
+activation_date = "$(date -d '1 year ago' +'%Y-%m-%d') 00:00:00 UTC"
+expiration_date = "$(date -d '1 year' +'%Y-%m-%d') 00:00:00 UTC"
+signing_key
+encryption_key
+EOF
+}
+
+generate_cert() {
+ printf "Generating self-signed certificate: "
+ certtool --generate-privkey --key-type=ed25519 --outfile "$priv_key" > /dev/null 2>&1
+ certtool --generate-self-signed --load-privkey "$priv_key" --template "$cert_template" \
+ --outfile "$cert_file" > /dev/null 2>&1
+}
+
+server_config() {
+ printf "Preparing chronyd configuration: "
+ cat <<EOF > /etc/chrony/conf.d/local-server-config.conf
+server $server_name nts minpoll -6 maxpoll -6
+ntsserverkey $priv_key
+ntsservercert $cert_file
+ntstrustedcerts $cert_file
+EOF
+
+ __no_system_clock_control
+ __restart_chronyd
+}
+
+echo "$server_addr $server_name" >> /etc/hosts
+
+create_cert_template && __test_ok || __test_skip "unable to create certificate template"
+
+generate_cert && __test_ok || __test_skip "unable to generate self-signed certificate"
+
+server_config && __test_ok || __test_skip
+
+printf "Checking if server authenticates NTP packets: "
+__check_auth "$server_addr,NTS"
+
+exit 0
diff --git a/debian/tests/time-sources-from-dhcp-servers b/debian/tests/time-sources-from-dhcp-servers
new file mode 100644
index 0000000..f5e7899
--- /dev/null
+++ b/debian/tests/time-sources-from-dhcp-servers
@@ -0,0 +1,44 @@
+#!/bin/sh
+# Ensure that NTP servers obtained from DHCP are made available to chronyd and
+# that they are removed when releasing the DHCP lease.
+
+set -e
+
+prepare_iface() {
+ modprobe dummy
+ ip link add name dummy0 type dummy
+ ip address add 192.168.1.1/24 dev dummy0
+ ip link set dev dummy0 up
+}
+
+dhcpd_config() {
+cat <<EOF > /etc/dhcp/dhcpd.conf
+default-lease-time 600;
+max-lease-time 7200;
+authorative;
+
+subnet 192.168.1.0 netmask 255.255.255.0 {
+ option subnet-mask 255.255.255.0;
+ option broadcast-address 192.168.1.255;
+ option ntp-servers 192.168.1.50;
+ range 192.168.1.42 192.168.1.100;
+}
+EOF
+
+sed -i '/INTERFACESv4=/s/".*"/"dummy0"/' /etc/default/isc-dhcp-server
+}
+
+chk_time_src() {
+ chronyc -n sources | grep -q -F '192.168.1.50'
+}
+
+printf "Preparing the dummy network interface and dhcpd configuration…\n"
+if prepare_iface && dhcpd_config; then
+ systemctl restart isc-dhcp-server && dhclient dummy0 && printf "Done!\n\n"
+fi
+
+printf "Check if the NTP server is made available to chronyd…\n"
+chk_time_src && printf "SUCCESS!\n\n"
+
+printf "Release the current lease and check if the NTP server has been correctly removed…\n"
+dhclient -r dummy0 > /dev/null 2>&1 && ! chk_time_src && printf "SUCCESS!\n\n"
diff --git a/debian/tests/upstream-simulation-test-suite b/debian/tests/upstream-simulation-test-suite
new file mode 100644
index 0000000..a0b8517
--- /dev/null
+++ b/debian/tests/upstream-simulation-test-suite
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Upstream makes use of “clknetsim” to test how well “chronyd” controls the
+# system clocks in various conditions. Due to “clknetsim” not being available
+# in Debian, let’s use autopkgtest facility to build it in a container and
+# test “chronyd” from there.
+
+set -e
+
+testdir="$PWD/test/simulation"
+clknetsim_ver=f00531b
+clknetsim_src=https://github.com/mlichvar/clknetsim/archive/"$clknetsim_ver"/clknetsim-"$clknetsim_ver".tar.gz
+clknetsim_archive=$(basename "$clknetsim_src")
+
+export CLKNETSIM_PATH="$AUTOPKGTEST_TMP"
+
+# Always use the same seed to get deterministic results
+export CLKNETSIM_RANDOM_SEED=24505
+
+DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH)
+
+# The simulation tests are only supported on Linux.
+dpkg-architecture -ilinux-any || exit 77
+
+prepare_clknetsim() {
+ # This symbolic link is necessary to prevent clknetsim from FTBFS.
+ ln -s /usr/include/"$DEB_HOST_MULTIARCH"/sys/time.h /usr/include/sys/
+
+ wget -P "$CLKNETSIM_PATH" "$clknetsim_src" 2>&1 || exit 77
+ tar -xvzf "$CLKNETSIM_PATH"/"$clknetsim_archive" \
+ -C "$CLKNETSIM_PATH" --strip-components=1 2>&1 || exit 77
+
+ if [ ! -x "$CLKNETSIM_PATH/clknetsim" ] && [ ! -e "$CLKNETSIM_PATH/clknetsim.so" ]; then
+ make -C "$CLKNETSIM_PATH" 2>&1
+ fi
+}
+
+run_test() {
+ cd "$testdir" && ./run
+}
+
+prepare_clknetsim && run_test
diff --git a/debian/tests/upstream-system-tests b/debian/tests/upstream-system-tests
new file mode 100755
index 0000000..bd28a0c
--- /dev/null
+++ b/debian/tests/upstream-system-tests
@@ -0,0 +1,24 @@
+#!/bin/sh
+# Run the upstream system tests in a container. Destructive tests will be run in
+# a VM as they may adjust/step the system clock, block the RTC, etc.
+# In case of failure, test’s logs will be put into the directory specified by
+# the $AUTOPKGTEST_ARTIFACTS environment variable.
+
+set -e
+
+testdir=$PWD/test/system
+logdir="$testdir/tmp/*"
+
+# some tests need chrony installed, but make sure to avoid the test daemon is
+# fighting with the systems chrony service over the clock
+systemctl stop chrony.service 2>/dev/null || true
+
+run_test() {
+ cd "$testdir" && ./run "$@"
+}
+
+artifacts() {
+ cp $logdir "$AUTOPKGTEST_ARTIFACTS" && exit 1
+}
+
+run_test "$@" || artifacts
diff --git a/debian/upstream/metadata b/debian/upstream/metadata
new file mode 100644
index 0000000..937fa97
--- /dev/null
+++ b/debian/upstream/metadata
@@ -0,0 +1,8 @@
+Documentation: https://chrony.tuxfamily.org/documentation.html
+Changelog: https://chrony.tuxfamily.org/news.html
+FAQ: https://chrony.tuxfamily.org/faq.html
+Contact: chrony-users@chrony.tuxfamily.org
+Security-Contact: Miroslav Lichvar <mlichvar@redhat.com>
+Bug-Submit: chrony-users@chrony.tuxfamily.org
+Repository: https://git.tuxfamily.org/chrony/chrony.git
+Repository-Browse: https://git.tuxfamily.org/chrony/chrony.git/
diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc
new file mode 100644
index 0000000..e12834f
--- /dev/null
+++ b/debian/upstream/signing-key.asc
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGCc9dwBEADLydyZIqgarshQeCtIlWAgP3coy0mdJwxet1CvXwF1xpq18Qi1
+Tt9RZL64SkbQ8sKryBqnPjKZdOfVT5FwUucjp9L+/j7Bhk0tqv30EIQ57rnDLJ9T
+c4LG1leO+Tc5Ym/0tvv4uMjkxr4KAKHPYrweHk6EAw06bbJ02mfy9xhlITSfyyFl
+QRoRTEjy8N2IDutA4QzbZm0T5kvI7k7s/ILG5vyNo53X5PI/rWrSqmPZ5qs0lvDv
+tA+rxOJp+FvlvOyBuv3ftIX0kAwRU+x/ET2Yd9qQWnXRx9d9D2UpFXm9DHfCDJYR
+F56D0O3hf+rrCa/uSutIqmR33j5Wz4bYjWdmg4wbRQaoVxJl5AUrWuYEFwcCuY2B
+FFgttLPb0qHpeBwuWaWJ9U6HM7qY3WEI2C/OWM0XFM8ERezedNEf7O2GTsoVVcm+
+LRg31R3eJzipKMAGZWScSDSRAXhh6oZhflMRjYKGvwRfgeos/Sl2bdYL80hqyjGV
+jMhEYDC9sfLXRyLU+9FexruIzSLR8Vornma3zjzu9pRkbfTHb8FfBMt9MZEWraF2
+7riRq/zJE9QPWnBL/C8rdaXXxflBmGctn7RDKGOvxZ7SxPzzHbl5tV/Fizhkeph/
+v8YLVuCOk0pIpX65mFun3Xw5IF01x1GMzU1xYezExti9yBNiv9HVqf1DWwARAQAB
+tCZNaXJvc2xhdiBMaWNodmFyIDxtbGljaHZhckByZWRoYXQuY29tPokCVAQTAQgA
+PhYhBI83XH6NDuElo9O9UVN+K3b3aA2sBQJgnPXcAhsDBQkSzAMABQsJCAcCBhUK
+CQgLAgQWAgMBAh4BAheAAAoJEFN+K3b3aA2sl8IQAJ9AMppV6cdxzt8g2Ypz0hw1
+6+9T5DjbYE/s0lozFQhCoYfo+SZyc3+yyKzlxI3ryHwFk9NjXGZZ8QjzT7FLj7/s
+nKDjv5hUCOAi9Q+k217xwlBueeMyheeVaGGGa+Hv5CF1fZx/MtxiShUqu8oSqUyP
+nW8lPGz73MfGAPT7kijVnz73pbht0vrZ9I+r8dnQGiweGBohexfCvmncrTyhjM8r
+nvecycYBNnXhupzpmSMZgIA1s2v7oVmTnV0bntxE/gr7+SPk7KozhD12K8OU8deJ
+cDD8F7NKa9Oe5NtuGVN4IPqp5cgj7GAyIj0sYss9Jknu4jX0imR5kwH6GbgFa7c/
+kU+fKTz57Rs1OGr3glYpMnNftXSWbC2V/OJxHVEcMk8HwKLgnQjtmKLVGeCo5iS6
+LFQuWaxpfjvxVjGSpnNu19cHVUhDM9cTP1DhUd4LdnltHQ+/xjwgzTgE4GJ1ZB0W
+vhvxcdb69Sf50bGd4/WuURRoYSE7M6UKRwfXmMpyTiNhZz+3XjAoScA9AS7q9xfS
+y3OddQEle/+qNFdABB12WmCgRhWemHzTZDXydIJuw+ucLO7U5RrDdqdaHkRVXJ9G
+4mdk+3FgUlYgB9GY4pHQdqGdE60838R2zY9x0gK8cHU+FaRPAiTU8SJL0wb/Rko7
+qbZUY/6bgrDoXp4otAP2uQINBGCc9dwBEADKy14JeburwGpEhfZ/sQj9ljojB886
+0TsR51s7F+j016SbdeC0mTmecI3ckd4CyVhi3ZHx6MR6UGKezy4DUtvUrgHOB0Pg
+azuReIPRJsAydLnlGMVNRXMkkV310foC2m6UAnNrPW1ukWjMC7kDcWcJH1wpZD0J
+rCJkxQNCp7VqR3PrhK9Sdoui0Euw/wSupu9pfcfM/ZPYKgGm18PsR7IrPn3zzBuS
+Zhzqnh2LbKvtiVtVbwZwOEIdwyh/TkGg/YWWxIlAt5zJpS5Dxf69vbVkz2u5bgRw
+Z1+eeiU11Zvrw1A8GdrKy32iskAsWzS8L0Nj5+Ujssgp7iFkdsWbP/ijwzIbSlAQ
+FR3G6Fbuojwk1ONglTD2ib2A9olBJ3GTXlBiTkrhtuNC0izRhBRbA+2IF29Vx40A
++XItyouz/4R4twBudyLEE4mhOVYAXQ43t82An+VmmenNw0EAfZWm9kTM/uRXa+2e
+mJhUVG5sUp7DHtJsMHKlXt6H1dHyrxOxKdE/GwYOd3QqslPISGw+cFHvfSZoTBZ8
+7OXpcJL/x29xIPdnYLtc1m+ZDM7rxhB7QiLpCMtQfqc0Dn0/ojgvpW5kR4T7JSfU
+tNbxDSRPpxBLBsT8vaUR65lkiiOGYfsrI2/71v7zsAHdUbL8U34AXjjmsJpc/p9K
+SU9NfGZ1IJnN+QARAQABiQI8BBgBCAAmFiEEjzdcfo0O4SWj071RU34rdvdoDawF
+AmCc9dwCGwwFCRLMAwAACgkQU34rdvdoDaz7kQ/+N5DND+9YMXyUI+jwaT7YyFVX
+5uEyD1iplfheP/XgsADwv6OOGMPp8Rq++0ZNg7Gkp9FedY9noEQlyrmQWcf7+iVz
++6qQ5N1HnJpeyH8U3fjfoJCN74lLK7eMpFIMlB/8Mv3nTBt4faoQUD9EcYg4HtfD
++mFKUEp6t7j+9snEzywSZaqf2Pfhl1Gqb3Mg6gRZ77Peong5km40n+ra4rNXLi7+
+n3pXeBzVGPy5iOTJWG8sG4FhqUjsilJU7chd9y6j51ne1Lkze0DbGMoxp5SW5JBo
+vysLjWyKORrOGr2lEk3O0gS3QmJ3hCLe5re4YNErSh0AurP2pP8PMpdchcuYEbrD
+uEAhU9mTEOo2VALmkBsdK4VkK/WpDTSRA7B0wUEfKcaRady3A13FF0knskkUhWS7
+foRMbw0MV7oXW2R2Bi9ROoOYLSUCp6GzbtozDs4gXA4r4QLKjcNj6KunyVS2r4wS
+OQSNcQKpspiBMSRUpR3S7matPXFc2NxDo98dt2E8zyjTiP6ruI01E+AcovDstzzd
+QQdJ+UqjkVidCnwMlRHsLIUgKie862ebCV1pynlUKgToORMJDgfK8/zN5qoK5wUY
+qoS4oohubShEwNWCEBlyGz/Ldb6qEK6b2GiX5JN5EJZLcXxZA0bfHSiMaRZPLj4j
+W23ALtrl30a0MaWqnDo=
+=kLnA
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/debian/usr.sbin.chronyd b/debian/usr.sbin.chronyd
new file mode 100644
index 0000000..bc52d4f
--- /dev/null
+++ b/debian/usr.sbin.chronyd
@@ -0,0 +1,85 @@
+# vim:syntax=apparmor
+# Last Modified: Sun Sep 05 16:48:05 2021
+
+abi <abi/3.0>,
+
+#include <tunables/global>
+
+/usr/sbin/chronyd flags=(attach_disconnected) {
+ #include <abstractions/base>
+ #include <abstractions/nameservice>
+
+ # For /run/chrony to be created
+ capability chown,
+
+ # Give “root” the ability to read and write the PID file
+ capability dac_override,
+ capability dac_read_search,
+
+ # Needed to support HW timestamping
+ capability net_admin,
+
+ # Needed to allow NTP server sockets to be bound to a privileged port
+ capability net_bind_service,
+
+ # Needed to allow an NTP socket to be bound to a device using the
+ # SO_BINDTODEVICE socket option on kernels before 5.7
+ capability net_raw,
+
+ # Needed to drop privileges
+ capability setgid,
+ capability setuid,
+
+ # Needed to set the SCHED_FIFO real-time scheduler at the specified priority
+ # using the '-P' option
+ capability sys_nice,
+
+ # Needed to lock chronyd into RAM
+ capability sys_resource,
+
+ # Needed to set the system/real-time clock
+ capability sys_time,
+
+ /usr/sbin/chronyd mr,
+
+ /etc/chrony/{,**} r,
+ /var/lib/chrony/{,*} rw,
+ /var/log/chrony/{,*} rw,
+ @{run}/chrony/{,*} rw,
+ @{run}/chrony-dhcp/{,*} r,
+
+ # Using the “tempcomp” directive gives chronyd the ability to improve
+ # the stability and accuracy of the clock by compensating the temperature
+ # changes measured by a sensor close to the oscillator.
+ @{sys}/class/hwmon/hwmon[0-9]*/temp[0-9]*_input r,
+ @{sys}/devices/virtual/thermal/thermal_zone[0-9]*/hwmon[0-9]*/temp[0-9]*_input r,
+
+ # Support all paths suggested in the man page (LP: #1771028). Assume these
+ # are common use cases; others should be set as local include (see below).
+ # Configs using a 'chrony.' prefix like the tempcomp config file example
+ /etc/chrony.* r,
+ # Example gpsd socket is outside @{run}/chrony/
+ @{run}/chrony.*.sock rw,
+ # To sign replies to MS-SNTP clients by the smbd daemon
+ /var/lib/samba/ntp_signd/socket rw,
+
+ # rtc
+ /etc/adjtime r,
+ /dev/rtc{,[0-9]*} rw,
+
+ # gps devices
+ /dev/pps[0-9]* rw,
+ /dev/ptp[0-9]* rw,
+
+ # Allow reading the chronyd configuration file that timemaster(8) generates
+ @{run}/timemaster/chrony.conf r,
+
+ # For use with clocks that report via shared memory (e.g. gpsd),
+ # you may need to give ntpd access to all of shared memory, though
+ # this can be considered dangerous. See https://launchpad.net/bugs/722815
+ # for details. To enable, add this to local/usr.sbin.chronyd:
+ # capability ipc_owner,
+
+ # Site-specific additions and overrides. See local/README for details.
+ #include <local/usr.sbin.chronyd>
+}
diff --git a/debian/watch b/debian/watch
new file mode 100644
index 0000000..7fc35e4
--- /dev/null
+++ b/debian/watch
@@ -0,0 +1,3 @@
+version=4
+opts="pgpsigurlmangle=s/\.tar\.gz$/-tar-gz-asc.txt/,uversionmangle=s/-pre/~pre/" \
+https://download.tuxfamily.org/@PACKAGE@/@PACKAGE@@ANY_VERSION@@ARCHIVE_EXT@