watcher (16.0.0-5) unstable; urgency=high

  * CVE-2026-XXXXX / OSSA-2026-036: Watcher webhook trigger endpoint does not
    enforce oslo.policy authorization. Any authenticated user who learns a
    Watcher audit webhook URL can POST to the webhook to trigger an
    administrator-owned EVENT audit and its associated action plan, regardless
    of the caller's project or role. The webhook endpoint has lacked policy
    enforcement since its introduction in the Ussuri release. Applied upstream
    patch: "Add policy enforcement to webhook trigger endpoint".
    (Closes: #1144880)

 -- Thomas Goirand <zigo@debian.org>  Wed, 12 Aug 2026 10:12:23 +0200

watcher (16.0.0-4) unstable; urgency=medium

  * Another reproducible issue fixed in make-watcher-reproducible.patch
    (Closes: #1142000).

 -- Thomas Goirand <zigo@debian.org>  Tue, 28 Jul 2026 12:19:46 +0200

watcher (16.0.0-3) unstable; urgency=medium

  * Add make-watcher-reproducible.patch.

 -- Thomas Goirand <zigo@debian.org>  Wed, 08 Jul 2026 14:14:05 +0200

watcher (16.0.0-2) unstable; urgency=medium

  * Install watcher-api-uwsgi.ini in watcher-api package.

 -- Thomas Goirand <zigo@debian.org>  Wed, 27 May 2026 17:08:45 +0200

watcher (16.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 01 Apr 2026 16:03:45 +0200

watcher (16.0.0~rc1-4) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 27 Mar 2026 14:54:28 +0100

watcher (16.0.0~rc1-3) experimental; urgency=medium

  * Fixed watcher to use uwsgi correctly.

 -- Thomas Goirand <zigo@debian.org>  Wed, 18 Mar 2026 11:11:33 +0100

watcher (16.0.0~rc1-2) experimental; urgency=medium

  * Removed --format when building the policy yaml file.

 -- Thomas Goirand <zigo@debian.org>  Fri, 13 Mar 2026 14:13:23 +0100

watcher (16.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.
  * Reviewed namespace list when building watcher.conf.
  * Reworked install-all-files.patch.
  * Removed fix-term.py-for-latest-docutils.patch applied upstream.
  * Just run all tests but for MaaS.

 -- Thomas Goirand <zigo@debian.org>  Fri, 13 Mar 2026 13:51:08 +0100

watcher (15.0.0-3) unstable; urgency=medium

  * Cleans better (Closes: #1048142).

 -- Thomas Goirand <zigo@debian.org>  Wed, 11 Feb 2026 10:17:09 +0100

watcher (15.0.0-2) unstable; urgency=medium

  * Display cat /tmp/sphinx-err-*.log if sphinx doc build fails.
  * Add fix-term.py-for-latest-docutils.patch (Closes: #1118332).

 -- Thomas Goirand <zigo@debian.org>  Fri, 24 Oct 2025 11:15:25 +0200

watcher (15.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 01 Oct 2025 22:45:37 +0200

watcher (15.0.0~rc1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Mon, 29 Sep 2025 11:15:39 +0200

watcher (15.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.
  * Removed OSSN-0094_use_cinder_migrate_for_swap_volume.patch applied
    upstream.

 -- Thomas Goirand <zigo@debian.org>  Tue, 16 Sep 2025 12:41:31 +0200

watcher (14.0.0-3) unstable; urgency=high

  * A vulnerability has been identified in OpenStack Nova and OpenStack Watcher
    in conjunction with volume swap operations performed by the Watcher
    service. Under specific circumstances, this can lead to a situation where
    two Nova libvirt instances could reference the same block device, allowing
    accidental information disclosure to the unauthorized instance. Added
    upstream patch: OSSN-0094_use_cinder_migrate_for_swap_volume.patch.
    (Closes: #1111692).

 -- Thomas Goirand <zigo@debian.org>  Thu, 21 Aug 2025 10:27:37 +0200

watcher (14.0.0-2) unstable; urgency=medium

  * Add export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME for all daemons.

 -- Thomas Goirand <zigo@debian.org>  Fri, 11 Jul 2025 14:45:24 +0200

watcher (14.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 02 Apr 2025 14:02:07 +0200

watcher (14.0.0~rc1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 28 Mar 2025 21:10:31 +0100

watcher (14.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.

 -- Thomas Goirand <zigo@debian.org>  Fri, 14 Mar 2025 10:50:32 +0100

watcher (13.0.0-2) unstable; urgency=medium

  * Switch to pybuild (Closes: #1090709).

 -- Thomas Goirand <zigo@debian.org>  Wed, 18 Dec 2024 13:51:43 +0100

watcher (13.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 02 Oct 2024 16:28:58 +0200

watcher (13.0.0~rc1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 20 Sep 2024 17:32:29 +0200

watcher (13.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Tue, 17 Sep 2024 11:31:06 +0200

watcher (12.0.0+git.2024.06.01.a9dc3794a69c-1) unstable; urgency=medium

  * New upstream release based on latest commit fixing FTBFS (Closes: #1073462)

 -- Thomas Goirand <zigo@debian.org>  Tue, 23 Jul 2024 03:51:20 +0200

watcher (12.0.0-1) unstable; urgency=medium

  * New upstream release.
  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Thu, 04 Apr 2024 12:36:53 +0200

watcher (12.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Do not run MaaS tests, as we don't have the python3-libmaas package in
    Debian.

 -- Thomas Goirand <zigo@debian.org>  Sun, 17 Mar 2024 14:23:37 +0100

watcher (11.0.0-1) unstable; urgency=medium

  * New upstream release.
  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Thu, 05 Oct 2023 11:26:40 +0200

watcher (11.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Fix (build-)depends for this release.

 -- Thomas Goirand <zigo@debian.org>  Thu, 14 Sep 2023 10:42:48 +0200

watcher (10.0.0-4) unstable; urgency=medium

  * Cleans better (Closes: #1048142).

 -- Thomas Goirand <zigo@debian.org>  Mon, 21 Aug 2023 16:32:21 +0200

watcher (10.0.0-3) unstable; urgency=medium

  * Removed obsolete lsb-base depends.

 -- Thomas Goirand <zigo@debian.org>  Mon, 19 Jun 2023 14:59:59 +0200

watcher (10.0.0-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Mon, 19 Jun 2023 14:53:33 +0200

watcher (10.0.0-1) experimental; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 22 Mar 2023 14:53:36 +0100

watcher (10.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Removed versions of (build-)depends when satisfied in Bookworm.

 -- Thomas Goirand <zigo@debian.org>  Wed, 01 Mar 2023 16:37:59 +0100

watcher (9.0.0-1) unstable; urgency=medium

  * New upstream release.
  * Removed Fix-compatibility-with-oslo.db-12.1.0.patch applied upstream.

 -- Thomas Goirand <zigo@debian.org>  Thu, 06 Oct 2022 11:07:38 +0200

watcher (9.0.0~rc1-3) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Sat, 24 Sep 2022 17:00:00 +0200

watcher (9.0.0~rc1-2) experimental; urgency=medium

  * Add Fix-compatibility-with-oslo.db-12.1.0.patch.

 -- Thomas Goirand <zigo@debian.org>  Wed, 21 Sep 2022 10:03:59 +0200

watcher (9.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Add python3-webtest to build-depends.
  * Fixed version of oslo.concurrency to >= 5.0.1.

 -- Thomas Goirand <zigo@debian.org>  Wed, 14 Sep 2022 13:57:49 +0200

watcher (8.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 30 Mar 2022 22:48:20 +0200

watcher (8.0.0~rc1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Sun, 27 Mar 2022 16:02:29 +0200

watcher (8.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Removed Remove_ceilometerclient_dependecy.patch applied upstream.

 -- Thomas Goirand <zigo@debian.org>  Sat, 12 Mar 2022 17:15:29 +0100

watcher (7.0.0-2) unstable; urgency=medium

  * Removed python3-ceilometerclient from (build-)depends.

 -- Thomas Goirand <zigo@debian.org>  Fri, 11 Feb 2022 14:15:03 +0100

watcher (7.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 06 Oct 2021 21:54:25 +0200

watcher (7.0.0~rc1-2) unstable; urgency=medium

  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Fri, 01 Oct 2021 11:27:10 +0200

watcher (7.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Removed python3-os-testr from build-depends.
  * Blacklist test_create_continuous_audit_with_wrong_interval().

 -- Thomas Goirand <zigo@debian.org>  Fri, 17 Sep 2021 11:45:28 +0200

watcher (6.0.0-2) unstable; urgency=medium

  * Upload to unstable.

 -- Thomas Goirand <zigo@debian.org>  Mon, 16 Aug 2021 14:38:52 +0200

watcher (6.0.0-1) experimental; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Thu, 15 Apr 2021 17:38:56 +0200

watcher (6.0.0~rc1-1) experimental; urgency=medium

  * Tune watcher-api-uwsgi.ini for performance.
  * New upstream release.
  * Removed (build-)depends versions when satisfied in Bullseye.
  * Fixed (build-)depends for this release.
  * debhelper-compat 11.
  * d/rules: removed --with systemd.
  * Added removed-sphinxcontrib.httpdomain-from-sphinx-ext.patch.

 -- Thomas Goirand <zigo@debian.org>  Tue, 23 Mar 2021 14:37:58 +0100

watcher (5.0.0-1) unstable; urgency=medium

  * New upstream release.
  * Uploading to unstable.
  * Fixed debian/watch.
  * Add a debian/salsa-ci.yml.

 -- Thomas Goirand <zigo@debian.org>  Sat, 17 Oct 2020 21:20:10 +0200

watcher (5.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.

 -- Thomas Goirand <zigo@debian.org>  Thu, 01 Oct 2020 10:03:47 +0200

watcher (4.0.0-2) unstable; urgency=medium

  * Added --serial when running tests (Closes: #918648).

 -- Thomas Goirand <zigo@debian.org>  Wed, 13 May 2020 22:57:19 +0200

watcher (4.0.0-1) unstable; urgency=medium

  * New upstream release.

 -- Thomas Goirand <zigo@debian.org>  Wed, 13 May 2020 19:12:11 +0200

watcher (4.0.0~rc2-1) unstable; urgency=medium

  * New upstream release.
  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Sat, 09 May 2020 21:52:06 +0200

watcher (4.0.0~rc1-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.
  * Removed patch applied upstream: fix-taskflow-2.2.patch.

 -- Thomas Goirand <zigo@debian.org>  Thu, 23 Apr 2020 12:26:49 +0200

watcher (3.0.0-3) unstable; urgency=medium

  * d/patches: Add fix-taskflow-2.2.patch (Closes: #951942)
  * d/control: Fix python3-taskflow version

 -- Michal Arbet <michal.arbet@ultimum.io>  Wed, 04 Mar 2020 17:48:15 +0000

watcher (3.0.0-2) unstable; urgency=medium

  [ Ondřej Nový ]
  * Bump Standards-Version to 4.4.1.

  [ Thomas Goirand ]
  * Uploading to unstable.

 -- Thomas Goirand <zigo@debian.org>  Tue, 22 Oct 2019 22:59:17 +0200

watcher (3.0.0-1) experimental; urgency=medium

  * New upstream release.
  * Remove /usr/etc from python3-watcher.

 -- Thomas Goirand <zigo@debian.org>  Wed, 16 Oct 2019 19:33:22 +0200

watcher (3.0.0~rc1-1) experimental; urgency=medium

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.
  * Bump Standards-Version to 4.4.0.

  [ Thomas Goirand ]
  * New upstream release.
  * Fixed (build-)depends for this release.
  * Removed switch-to-GreenThreadPoolExecutor.patch applied upstream.
  * Fix running unit tests.
  * Add remove-sphinxcontrib.rsvgconverter.patch.

 -- Thomas Goirand <zigo@debian.org>  Tue, 01 Oct 2019 10:33:58 +0200

watcher (2.0.0-5) unstable; urgency=medium

  * Uploading to unstable.

 -- Michal Arbet <michal.arbet@ultimum.io>  Wed, 17 Jul 2019 20:10:41 +0200

watcher (2.0.0-4) experimental; urgency=medium

  * d/control:
      - Bump openstack-pkg-tools to version 99
      - Add me to uploaders field
  * d/copyright: Add me to copyright file

 -- Michal Arbet <michal.arbet@ultimum.io>  Thu, 02 May 2019 18:01:53 +0200

watcher (2.0.0-3) experimental; urgency=medium

  * Add export TZ=UTC in debian/rules (Closes: #918712).

 -- Thomas Goirand <zigo@debian.org>  Wed, 17 Apr 2019 23:58:55 +0200

watcher (2.0.0-2) experimental; urgency=medium

  * Removed python3- prefix when calling conf generators.

 -- Thomas Goirand <zigo@debian.org>  Wed, 17 Apr 2019 13:27:48 +0200

watcher (2.0.0-1) experimental; urgency=medium

  [ Thomas Goirand ]
  * New upstream release.
  * Fixed startup script description.
  * New upstream release.
  * Fixed (build-)depends for this release. Freezegun upstream b-requirement
    downgraded to 0.3.9.
  * Removed fix-import-sphinx-Directive.patch applied upstream.
  * Add switch-to-GreenThreadPoolExecutor.patch.
  * Standards-Version: 4.3.0.
  * Removed versions of packages when satisfied in Buster.
  * Run different types of unit tests separately to avoid hangs.

  [ Ondřej Nový ]
  * d/control: Use team+openstack@tracker.debian.org as maintainer
  * Running wrap-and-sort -bast

 -- Thomas Goirand <zigo@debian.org>  Wed, 20 Jun 2018 13:59:53 +0200

watcher (1.8.0-5) unstable; urgency=medium

  * Also package watcher/api/app.wsgi.

 -- Thomas Goirand <zigo@debian.org>  Mon, 07 May 2018 13:34:40 +0200

watcher (1.8.0-4) unstable; urgency=medium

  * Use pkgos-dh_auto_{test,install} (Closes: #892783).
  * Fix sphinx import of the Directive module.

 -- Thomas Goirand <zigo@debian.org>  Fri, 27 Apr 2018 08:59:55 +0200

watcher (1.8.0-3) unstable; urgency=medium

  * Fixed dbc postrm.

 -- Thomas Goirand <zigo@debian.org>  Mon, 26 Mar 2018 18:02:52 +0000

watcher (1.8.0-2) unstable; urgency=medium

  * Switched to openstack-pkg-tools >= 70~ shared debconf templates.

 -- Thomas Goirand <zigo@debian.org>  Wed, 07 Mar 2018 10:35:43 +0000

watcher (1.8.0-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/control: Set Vcs-* to salsa.debian.org

  [ Thomas Goirand ]
  * New upstream release.
  * Fixed (build-)depends for this release.
  * Switched to Python 3.
  * Standards-Version is now 4.1.3.

 -- Thomas Goirand <zigo@debian.org>  Tue, 20 Feb 2018 23:35:48 +0100

watcher (1.4.1-3) unstable; urgency=medium

  * Fixed encoding of pt.po (Closes: #881578).

 -- Thomas Goirand <zigo@debian.org>  Fri, 26 Jan 2018 11:50:09 +0100

watcher (1.4.1-2) unstable; urgency=medium

  * Uploading to unstable.
  * Remove /var/cache/watcher on purge (Closes: #852120).
  * Updated it.po (Closes: #860380).
  * Updated fr.po (Closes: #873686).
  * Updated pt.po (Closes: #876177).
  * (build-)depends on 2.9.0 version of ceilometerclient (Closes: #880091).
  * Removed dh-systemd build-depends.

 -- Thomas Goirand <zigo@debian.org>  Sat, 28 Oct 2017 09:58:37 +0000

watcher (1.4.1-1) experimental; urgency=medium

  [ Daniel Baumann ]
  * Updating vcs fields.
  * Updating copyright format url.
  * Updating maintainer field.
  * Running wrap-and-sort -bast.
  * Updating standards version to 4.0.0.
  * Removing gbp.conf, not used anymore or should be specified in the
    developers dotfiles.
  * Correcting permissions in debian packaging files.
  * Updating standards version to 4.0.1.
  * Deprecating priority extra as per policy 4.0.1.
  * Updating standards version to 4.1.0.

  [ Thomas Goirand ]
  * New upstream release.
  * Fixed (build-)depends for this release.
  * d/rules: remove OSLO_PACKAGE_VERSION set by openstack-pkg-tools.
  * Rebase MANIFEST.in patch, remove SQLA version patch.

 -- Thomas Goirand <zigo@debian.org>  Thu, 19 Oct 2017 16:11:45 +0200

watcher (0.30.0-5) unstable; urgency=medium

  * Team upload.
  * Delete wrong net-tools dependency.
  * Bump build dependency on openstack-pkg-tools (Closes: #858713).

 -- David Rabel <david.rabel@noresoft.com>  Sat, 01 Apr 2017 12:39:26 +0200

watcher (0.30.0-4) unstable; urgency=medium

  * Team upload.
  * Create /var/cache/watcher with no error if existing. (Closes: #851260)

 -- Ondřej Kobližek <koblizeko@gmail.com>  Mon, 16 Jan 2017 13:20:05 +0100

watcher (0.30.0-3) unstable; urgency=medium

  [ Ondřej Nový ]
  * Bumped debhelper compat version to 10

  [ Thomas Goirand ]
  * Allow using SQLA >= 1.1 (patching requirements.txt).
  * Create /var/cache/watcher in postinst.

 -- Thomas Goirand <zigo@debian.org>  Fri, 09 Dec 2016 18:12:45 +0100

watcher (0.30.0-2) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/s/options: extend-diff-ignore of .gitreview
  * d/control: Use correct branch in Vcs-* fields

  [ Thomas Goirand ]
  * Uploading to unstable.
  * Build-Depends on openstack-pkg-tools >= 53~.
  * Fixed oslotest EPOCH.
  * Fixed oslo-config-generator namespaces.

 -- Thomas Goirand <zigo@debian.org>  Wed, 28 Sep 2016 10:21:56 +0200

watcher (0.30.0-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.
  * Using OpenStack's Gerrit as VCS URLs.
  * Fix missing EPOC in many (build-)depends.

 -- Thomas Goirand <zigo@debian.org>  Mon, 19 Sep 2016 12:01:59 +0200

watcher (0.28.0-2) experimental; urgency=medium

  * Now requires python-apscheduler >= 3.0.5 (FTBFS otherwise).

 -- Thomas Goirand <zigo@debian.org>  Sat, 16 Jul 2016 15:37:25 +0000

watcher (0.28.0-1) experimental; urgency=medium

  * New upstream release.
  * Fixed (build-)depends for this release.

 -- Thomas Goirand <zigo@debian.org>  Sat, 16 Jul 2016 17:22:03 +0200

watcher (0.27.0-3) experimental; urgency=medium

  * Added runtime depends on net-tools for watcher-api, as the config is using
    /sbin/route.

 -- Thomas Goirand <zigo@debian.org>  Fri, 01 Jul 2016 10:38:53 +0200

watcher (0.27.0-2) experimental; urgency=medium

  * Fixed debian/copyright missing copyright holders.

 -- Thomas Goirand <zigo@debian.org>  Mon, 13 Jun 2016 08:40:12 +0000

watcher (0.27.0-1) experimental; urgency=medium

  * Initial release. (Closes: #826853)

 -- Thomas Goirand <zigo@debian.org>  Thu, 09 Jun 2016 16:03:10 +0200
