chrony (4.3-2+deb12u1) unstable; urgency=medium
* debian/usr.sbin.chronyd:
- Modify the AppArmor profile to allow more gpsd socket names. This will
avoid the need for users to override the profile to let chronyd consume PPS
samples or serial time supplied by gpsd over a Unix-domain socket.
Thanks to Ryan Govostes for the report. (Closes: #1034519)
-- Vincent Blut <vincent.debian@free.fr> Mon, 08 May 2023 22:05:00 +0200
chrony (4.3-2) unstable; urgency=medium
* debian/control:
- Bump Standards-Version to 4.6.2 (no changes needed).
* debian/copyright:
- Update copyright year for debian/*.
* debian/.gitlab-ci.yml:
- Use the recommended syntax to skip a job.
* debian/install:
- Install the chrony-wait.service systemd unit.
* debian/postinst:
- Ensure that chronyd can read the /etc/chrony/chrony.keys file after
dropping root privileges.
* debian/postrm:
- Remove the override for /etc/chrony/chrony.keys when purging chrony.
* debian/rules:
- Do not enable nor start chrony-wait.service for the time being.
* debian/tests/upstream-simulation-test-suite:
- Run each test only once. Running several iterations is no longer
relevant since we use a hard coded seed.
[ Taylor Stearns ]
* debian/chrony.conf:
- Replace U+2019 with ASCII quote. (MR: !10)
-- Vincent Blut <vincent.debian@free.fr> Fri, 27 Jan 2023 22:51:17 +0100
chrony (4.3-1) unstable; urgency=medium
* Import upstream version 4.3:
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
* debian/copyright:
- Update copyright years.
[ Bastian Blank ]
* debian/chrony.service:
- Let systemd handle directories. (MR: !9)
-- Vincent Blut <vincent.debian@free.fr> Wed, 31 Aug 2022 13:32:14 +0200
chrony (4.3~pre1-1) experimental; urgency=medium
* Import upstream version 4.3-pre1:
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
* debian/chrony.lintian-overrides:
- Update lintian override syntax.
* debian/control:
- Bump Standards-Version to 4.6.1 (no changes needed).
* debian/patches/*:
- Drop ensure_awk_commands_in_008-ntpera_test_return_an_integer.patch,
applied upstream.
- Refresh nm-dispatcher-dhcp_Move-server_dir-to-run.patch.
* debian/tests/upstream-simulation-test-suite:
- Update clknetsim version.
-- Vincent Blut <vincent.debian@free.fr> Thu, 11 Aug 2022 14:12:25 +0200
chrony (4.2-2) unstable; urgency=medium
* debian/usr.sbin.chronyd:
- Allow reading the chronyd configuration file that timemaster(8)
generates. Thanks to Michael Lestinsky for the report! (Closes: #1004745)
-- Vincent Blut <vincent.debian@free.fr> Tue, 01 Feb 2022 20:42:35 +0100
chrony (4.2-1) unstable; urgency=medium
* Import upstream version 4.2:
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
* debian/chrony.service:
- Adopt upstream service unit hardening options.
* debian/copyright:
- Update copyright years.
* debian/patches/*:
- Drop patches applied upstream.
- Add ensure_awk_commands_in_008-ntpera_test_return_an_integer.patch
* debian/test/upstream-simulation-test-suite:
- Update clknetsim version.
-- Vincent Blut <vincent.debian@free.fr> Thu, 13 Jan 2022 14:01:35 +0100
chrony (4.1-4) unstable; urgency=medium
* debian/:
- Remove empty preinst maintainer script.
* debian/chrony.lintian-overrides:
- Remove unused overrides.
* debian/control:
- Bump Standards-Version to 4.6.0 (no changes needed).
* debian/patches/*:
- Add fix-seccomp-filter-for-BINDTODEVICE-socket-option.patch.
(Closes: #995207)
* debian/usr.sbin.chronyd:
- Add 'vim:syntax=apparmor' modline.
- Add feature ABI rule. Starting with AppArmor 3.0, policy needs to contain
an abi rule to indicate which feature abi the policy was developed under.
-- Vincent Blut <vincent.debian@free.fr> Thu, 07 Oct 2021 15:23:28 +0200
chrony (4.1-3) unstable; urgency=medium
* Upload to unstable.
* debian/patches/:
- Add allow-clone3-and-pread64-in-seccomp-filter.patch.
* debian/tests/upstream-simulation-test-suite:
- Update clknetsim version.
-- Vincent Blut <vincent.debian@free.fr> Sun, 15 Aug 2021 15:08:56 +0200
chrony (4.1-2) experimental; urgency=medium
* Merge branch 'debian/unstable' into 'debian/latest'.
* debian/rules:
- Remove needless dh_auto_test override.
[ Christian Ehrhardt ]
* debian/tests/helper-functions:
- Improve chronyd restart logic. While rendering the tests more readable,
this also fixes ntp-server-and-nts-auth test on Ubuntu.
[ Debian Janitor ]
* debian/{control,chrony.maintscript}:
- Remove constraints unnecessary since stretch.
-- Vincent Blut <vincent.debian@free.fr> Sat, 26 Jun 2021 17:16:45 +0200
chrony (4.1-1) experimental; urgency=medium
* Import upstream version 4.1:
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
* debian/copyright:
- Update copyright years.
* debian/upstream/signing-key.asc:
- Update Miroslav Lichvar's key.
* debian/watch:
- Add upstream version mangle to transform -pre to ~pre.
-- Vincent Blut <vincent.debian@free.fr> Fri, 14 May 2021 00:25:34 +0200
chrony (4.1~pre1-1) experimental; urgency=medium
* Import upstream version 4.1-pre1:
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
* debian/control:
- Now that the upstream system tests support 'ss', replace the net-tools
build-dependency by iproute2.
* debian/NEWS:
- Mention that lines in *.sources files must be terminated by a trailing
newline.
* debian/patches/:
- Drop allow-IP_TOS-socket-option-in-seccomp-filter.patch. Applied
upstream.
* debian/postinst:
- Do not redirect 'chronyd -p' stderr to /dev/null. Not needed anymore.
* debian/sources.d/README:
- Mention that lines in *.sources files must be terminated by a trailing
newline.
* debian/tests/dynamically-add-source:
- Terminate the line in dummy-server.sources with the newline control
character.
* debian/tests/fragmented-configuration:
- Do not redirect 'chronyd -p' stderr to /dev/null. Not needed anymore.
* debian/tests/upstream-simulation-test-suite:
- Update clknetsim version.
-- Vincent Blut <vincent.debian@free.fr> Mon, 10 May 2021 18:56:53 +0200
chrony (4.0-8) unstable; urgency=medium
* debian/patches/:
- Add allow-BINDTODEVICE-option-in-seccomp-filter.patch to enable support
for binding sockets to a device without having to disable the seccomp
filter.
- Add allow-getuid32-in-seccomp-filter.patch. Upstream found out that
getuid32() needed to be allowed in the seccomp filter to enable some NTS
operations on i686. This may affect other 32-bits architectures.
-- Vincent Blut <vincent.debian@free.fr> Thu, 13 May 2021 16:51:41 +0200
chrony (4.0-7) unstable; urgency=medium
* debian/patches/:
- Add allow-IP_TOS-socket-option-in-seccomp-filter.patch to enable the use
of the 'dscp' directive.
-- Vincent Blut <vincent.debian@free.fr> Thu, 08 Apr 2021 16:21:16 +0200
chrony (4.0-6) unstable; urgency=medium
* debian/tests/helper-functions:
- Instead of running 'systemctl restart chrony.service', use
__restart_chronyd() in the __no_system_clock_control() function.
- Run 'sleep 3' only if chronyd has successfully restarted.
[ Christian Ehrhardt ]
* debian/tests/{dynamically-add-source,ntp-server-and-nts-auth}:
- Reduce default Ubuntu config to make space for testcase config.
* debian/tests/helper-functions:
- Add more common functions and update some tests to use them.
- Wait after restarting chronyd. Without this, some tests break on Ubuntu by
checking state too early.
-- Vincent Blut <vincent.debian@free.fr> Sun, 21 Feb 2021 21:59:22 +0100
chrony (4.0-5) unstable; urgency=medium
* Follow DEP-14 branch naming conventions:
master -> debian/latest
upstream -> upstream/latest
* debian/chrony.service:
- Enable some hardening settings.
* debian/control:
- Remove Joachim Wiedorn from the Uploaders field. This decision was taken
in agreement with him. Thanks a lot, Joachim, for your work on chrony and
for your benevolence when you handed me its maintenance.
- Point Vcs-Git to the debian/latest branch.
* debian/dirs:
- Do not create the /etc/apparmor.d/force-complain directory. Not needed
anymore.
* debian/postrm:
- Remove /run/chrony-dhcp on purge.
* debian/preinst:
- Drop old migration code snippet. It was used to put the newly provided
AppArmor profile in complain mode when upgrading chrony to prevent
regressions this profile could have caused. (Closes: #905485)
-- Vincent Blut <vincent.debian@free.fr> Thu, 04 Feb 2021 19:49:22 +0100
chrony (4.0-4) unstable; urgency=medium
* debian/chrony.examples:
- Provide example configuration files.
* debian/postinst:
- Run adduser unconditionally.
- Use 'chronyd -p' to check the whole configuration.
* debian/tests/:
- Prevent dynamically-add-source and ntp-server-and-nts-auth tests from
failing on chronyd's preparation step.
- Don't pass 'set -u' to dynamically-add-source and
ntp-server-and-nts-auth scripts.
* debian/tests/control:
- Mark dynamically-add-source as skippable.
-- Vincent Blut <vincent.debian@free.fr> Thu, 21 Jan 2021 20:02:39 +0100
chrony (4.0-3) unstable; urgency=medium
* debian/:
- chronyd's configuration can now be fragmented. Please see
/etc/chrony/conf.d/README for more information.
- NTP sources can be specified in /etc/chrony/sources.d. Please see
/etc/chrony/sources.d/README for more information.
* debian/chrony.conf:
- Include configuration files found in /etc/chrony/conf.d.
- Use NTP sources found in /etc/chrony/sources.d.
- Get TAI-UTC offset and leap seconds from the system tz database by using
the "leapsectz right/UTC" directive. This directive must be commented out
when using time sources serving leap-smeared time. (Closes: #974845)
- Add missing comment.
* debian/chrony.default:
- Switch the seccomp filter to level 1.
* debian/chrony.lintian-overrides:
- Override breakout-link.
* debian/control:
- Add tzdata to the dependencies.
- Bump Standards-Version to 4.5.1 (no changes required).
* debian/copyright:
- Update copyright year for debian/*.
* debian/postinst:
- Use dpkg-statoverride to manage mode bits and ownership of
/var/l{ib,og}/chrony.
* debian/postrm:
- Remove overrides for /var/l{ib,og}/chrony on purge.
* debian/rules:
- Drop '--without-readline' option. GNU readline support has been dropped
upstream due to license incompatibility.
- Replace -F -1 by -F 1 in the sed invocation.
* debian/tests/:
- Add fragmented-configuration autopkgtest.
- Add dynamically-add-source autopkgtest.
- Add ntp-server-and-nts-auth autopkgtest.
* debian/tests/control:
- Mark ntp-server-and-nts-auth as skippable.
* debian/tests/fragmented-configuration:
- Use another directive for the test since "leapsectz right/UTC" is now
used by default.
* debian/tests/helper-functions:
- Add __no_system_clock_control() function.
* debian/tests/upstream-simulation-test-suite:
- Always use the same seed to get deterministic results.
* debian/upstream/metadata:
- Remove obsolete field Name. Thanks to Debian Janitor <janitor@jelmer.uk>.
* debian/usr.sbin.chronyd:
- Make use of the @{run} variable.
-- Vincent Blut <vincent.debian@free.fr> Mon, 18 Jan 2021 21:58:52 +0100
chrony (4.0-2) unstable; urgency=medium
* Merge branch 'experimental' into 'master'.
* Upload to unstable.
-- Vincent Blut <vincent.debian@free.fr> Tue, 13 Oct 2020 15:59:33 +0200
chrony (4.0-1) experimental; urgency=medium
* Import upstream version 4.0:
- This release adds support for the Network Time Security (NTS)
authentication mechanism (RFC 8915).
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
-- Vincent Blut <vincent.debian@free.fr> Wed, 07 Oct 2020 19:14:51 +0200
chrony (4.0~pre4-2) experimental; urgency=medium
* debian/postinst:
- Fix user and group ownership of "/var/lib/chrony" to allow chronyd
to write in it. This will also fix a regression in the 104-systemdirs
test.
-- Vincent Blut <vincent.debian@free.fr> Sat, 03 Oct 2020 11:20:02 +0200
chrony (4.0~pre4-1) experimental; urgency=medium
* Import upstream version 4.0-pre4:
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
* Merge branch 'master' into experimental. (Closes: #970421)
* debian/chrony.conf:
- Use NTP sources from /run/chrony-dhcp.
- Save NTS keys and cookies in /var/lib/chrony/.
* debian/chrony-dnssrv@.service:
- Update "chrony-helper" path.
* debian/chrony.dhcp:
- Save NTP servers from DHCP to /run/chrony-dhcp/$interface.sources.
* debian/chrony.lintian-overrides:
- Override executable-in-usr-lib for NetworkManager dispatcher scripts.
- Update NetworkManager dispatcher script name.
* debian/chrony.ppp.ip-{down,up}:
- Update PID file path.
* debian/chrony.service:
- Update PID file path.
- Do not run 'chrony-helper update-daemon' after starting chronyd. Not
needed anymore.
* debian/control:
- Build-depend on libgnutls28-dev to support NTS.
- Build-depend on gnutls-bin for the test suite.
- Bump debhelper-compat to 13.
* debian/copyright:
- Update copyright years.
* debian/dirs:
- Remove var/log/chrony as it will be created automatically if it doesn’t
exist.
* debian/if-{post-down,up}:
- Update PID file path.
* debian/init:
- Update PID file path.
- Drop the unnecessary '--remove pidfile' option from the stop target.
- Do not run 'chrony-helper update-daemon' after starting chronyd. Not
needed anymore.
* debian/install:
- Move "chrony-helper" to "/usr/libexec/chrony".
* debian/links:
- Update source and destination filenames.
* debian/patches/:
- Drop patches applied upstream.
- Add nm-dispatcher-dhcp_Move-server_dir-to-run.patch.
* debian/postinst:
- Drop migration code from pre-Stretch.
- Migrate NTP sources obtained from DHCP to /run/chrony-dhcp on upgrade
from chrony < 4.0~pre4-1.
- Remove staled PID file when upgrading from chrony < 4.0~pre4-1.
* debian/rules:
- Change the default PID file location from /run to /run/chrony.
- Drop dh_missing --fail-missing. This is the default in debhelper 13.
- Enable seccomp support by default on riscv64.
- Update NetworkManager dispatcher script name from 20-chrony to
20-chrony-onoffline.
- Add DHCP NetworkManager dispatcher script to allow chronyd to use
NTP sources obtained from NM's internal DHCP client.
* debian/tests/:
- Add some helper functions. Some tests will be updated thereafter
to use them.
* debian/tests/time-sources-from-dhcp-servers:
- Adapt to the new way of using time sources from DHCP.
- Improve sed invocation.
* debian/tests/upstream-simulation-test-suite:
- Update clknetsim version.
- Cosmetic changes.
* debian/tests/upstream-system-tests:
- No need to stop systemd-timesyncd anymore since it is no more
co-installable with chrony anymore.
* debian/usr.sbin.chronyd:
- Update PID file path.
- Add dac_override and dac_read_search capabilities to give "root" the
ability to write the PID file in /run/chrony/.
- Prefix flag definition by "flags=".
- Sort the capabilities.
- Grant CAP_NET_RAW capability to allow an NTP socket to be bound to a
device using the SO_BINDTODEVICE socket option on kernels before 5.7.
- Add comments regarding capabilities.
- Let chronyd create /var/l{ib,og}/chrony.
- Remove a superfluous rule.
- Allow reading of NTP sources in /run/chrony-dhcp/.
* debian/watch:
- Make use of special strings.
-- Vincent Blut <vincent.debian@free.fr> Fri, 02 Oct 2020 21:21:08 +0200
chrony (3.5.1-1) unstable; urgency=medium
* Import upstream version 3.5.1:
- Please see /usr/share/doc/chrony/NEWS.gz for the release notes.
- CVE-2020-14367: create new file when writing pidfile.
* debian/chrony.lintian-overrides:
- Remove unused override.
[ Ville Skyttä ]
* debian/chrony.conf:
- Comment spelling fix. (MR: !5)
-- Vincent Blut <vincent.debian@free.fr> Thu, 20 Aug 2020 14:07:22 +0200
chrony (3.5-9) unstable; urgency=medium
* debian/patches/:
- Add allow-some-*time64-syscalls-in-seccomp-filter.patch. Needed for
32-bit architectures with new system calls using 64-bit time_t.
(LP: #1878005)
* debian/tests/control:
- Add needs-internet restriction to the upstream-simulation-test-suite
test.
[ Christian Ehrhardt ]
* debian/tests/upstream-simulation-test-suite:
- Skip if preparation steps fail.
- Make preparation steps more verbose.
-- Vincent Blut <vincent.debian@free.fr> Tue, 19 May 2020 16:42:18 +0200
chrony (3.5-8) unstable; urgency=medium
* debian/postrm:
- Stop starting systemd-timesyncd in postrm. This is no longer relevant
since systemd-timesyncd is a standalone package declaring
Conflicts/Replaces/Provides: time-daemon. (Closes: #955773)
[ Christian Ehrhardt ]
* debian/tests/upstream-system-tests:
- Stop chrony/systemd-timesynd before running these tests. (LP: #1870144)
-- Vincent Blut <vincent.debian@free.fr> Sun, 05 Apr 2020 17:44:31 +0200
chrony (3.5-7) unstable; urgency=medium
* debian/chrony.maintscript:
- Remove the /etc/NetworkManager/dispatcher.d/20-chrony conffile.
* debian/control:
- Support seccomp facility on riscv64. It should be noted that the system
call filter will stay disabled by default on this architecture until
Linux >= 5.5 hits unstable.
- Bump libseccomp-dev build-dep to 2.4.3-1~ to provide seccomp facility on
riscv64.
- Break network-manager (<< 1.20.0-1~). Prior to this version,
NetworkManager would not look for dispatcher scripts into
/usr/lib/NetworkManager/dispatcher.d/.
* debian/dirs:
- Create the usr/lib/NetworkManager/dispatcher.d subdirectories.
* debian/links:
- Change the location of the NetworkManager dispatcher script.
* debian/patches/:
- Add allow-renameat2-in-seccomp-filter.patch. Required as the riscv64
architecture does not support the rename() and renameat() system calls.
* debian/rules:
- Move the NetworkManager dispatcher script in
/usr/lib/NetworkManager/dispatcher.d/.
-- Vincent Blut <vincent.debian@free.fr> Tue, 17 Mar 2020 15:21:53 +0100
chrony (3.5-6) unstable; urgency=medium
* debian/chrony.service:
- Don’t conflict with systemd-timesyncd.service.
A few users complain that chronyd does not start at boot. The way the
Conflict= directive works internally might cause both systemd-timesyncd
and chronyd to be inactive at boot. So by relying solely on the
disable-with-time-daemon.conf drop-in file provided by systemd, we should
get rid of this malfunction while still preventing these two time daemons
from being active at the same time. Kudos notably go to Santiago Vila for
the report and providing SSH access to a GCE instance where the issue was
reproducible and Michael Biebl for debugging. (Closes: #947936)
* debian/control:
- Bump Standards-Version to 4.5.0 (no changes required).
- No need to explicitly conflict with ntp as it now provides time-daemon.
* debian/copyright:
- Update copyright year for debian/*.
* debian/patches/:
- Add allow-clock_adjtime-in-seccomp-filter.patch.
glibc 2.31 switched the adjtimex() function to the clock_adjtime
system call.
* debian/tests/upstream-simulation-test-suite:
- Update clknetsim version. This new version supports glibc >= 2.31 headers.
(LP: #1866753)
* debian/tests/control:
- Run the upstream-simulation-test-suite as root.
-- Vincent Blut <vincent.debian@free.fr> Tue, 10 Mar 2020 19:17:16 +0100
chrony (3.5-5) unstable; urgency=medium
* debian/control:
- Bump standard-version to 4.4.1 (no change required).
* debian/install:
- Install 50-chrony.list in /usr/lib/systemd/ntp-units.d.
* debian/ntp-units.d/50-chrony.list:
- Allow timedated to interact with chronyd.
* debian/patches/*:
- Cherry-pick upstream commits to better manage RTCs that don't support
interrupts. This fixes an issue exhibited when a specific upstream system
test is run on the Ubuntu CI. Thank to Christian Ehrhardt for working
with Miroslav Lichvar to address this problem.
* debian/tests/control:
- Use @builddeps@ as a test dependency for upstream_system_tests.
[ Christian Ehrhardt ]
* debian/tests/upstream-simulation-test-suite:
- Redirect stderr on make call to stdout. On some architectures (e.g. armhf)
the clksim tests compile but throw some warnings. (MR: !2)
-- Vincent Blut <vincent.debian@free.fr> Sun, 22 Dec 2019 17:30:40 +0100
chrony (3.5-4) unstable; urgency=medium
* debian/tests/control:
- Add @builddeps@ to the list of dependencies needed by the
upstream-simulation-test-suite test.
-- Vincent Blut <vincent.debian@free.fr> Fri, 30 Aug 2019 00:49:20 +0200
chrony (3.5-3) unstable; urgency=medium
* debian/chrony.lintian-overrides:
- Override package-supports-alternative-init-but-no-init.d-script. This
is a false positive. chrony-dnssrv@.service isn’t a daemon but a oneshot
service, not started at boot, whose role is to lookup for _ntp._udp DNS SRV
records.
* debian/chrony.service:
- Pull in time-sync.target and order chrony before it as recommended in
systemd.special(7).
* debian/control:
- Bump standard-version to 4.4.0 (no changes required).
* debian/.gitlab-ci.yml:
- Switch to standard Salsa Pipeline.
- Skip the reprotest job for as long as it is run as root due to problems
with chrony system tests.
* debian/tests/*:
- Revamp the upstream-simulation-test-suite test.
- Adjust dpkg dependencies for upstream-simulation-test-suite.
- Adjust restrictions for upstream-simulation-test-suite.
- Introduce upstream-system-tests. Add a new set of tests for testing
basic chronyd functionality. Destructive tests are run in a virtual
machine.
- Add ethtool to the list of dependencies needed by
run_destructive_system_tests.
- exit 77 if upstream-simulation-test-suite is run on non-Linux and mark
the test as skippable. Thanks to Paul Gevers <elbrus@debian.org> for the
suggestion.
- Make artifacts() exit 1. Again, thanks to Paul Gevers.
-- Vincent Blut <vincent.debian@free.fr> Tue, 13 Aug 2019 17:57:47 +0200
chrony (3.5-2) unstable; urgency=medium
* Merge branch “experimental” into “master”.
* debian/chrony.dhcp:
- Fix shellcheck warnings. Patch imported from Fedora.
* debian/chrony-helper:
- Fix shellcheck warnings. Patch imported from Fedora.
* debian/clean:
- Drop obsolete entries.
* debian/copyright:
- Update copyright years.
- Update copyright holder for the configure script.
* debian/patches/*:
- Add update_processing_of_packet_log.patch. This fixes a regression in
the simulation tests exhibited by the recent clknetsim changes.
(Closes: #931181)
* debian/rules:
- Use dh_missing --fail-missing.
* debian/tests/upstream-simulation-test-suite:
- Use a known good clknetsim commit. This should prevent regressions from
on-going “clknetsim” development.
* debian/usr.sbin.chronyd:
- Grant access rights only to the ntp_signd socket. (Closes: #928170)
[ Christian Ehrhardt ]
* debian/postrm:
- Re-establish systemd-timesyncd on removal. (MR: !1)
-- Vincent Blut <vincent.debian@free.fr> Sat, 06 Jul 2019 20:33:41 +0200
# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog chrony`.
Generated by dwww version 1.15 on Sat Aug 30 03:31:00 CEST 2025.