Branches for Quantal

Author: Andres Rodriguez
Revision Date: 2013-03-07 14:22:35 UTC

* MAAS Stable Release Update (LP: #1109283):
  This SRU brings a new upstream release of MAAS that removes
  the usage of a cobbler code copy, 'maas-provision' as well as
  several bug fixes. Exception has been granted by the Technical
  Board to proceed. More information can be found in:
  https://lists.ubuntu.com/archives/ubuntu-devel-announce/2013-February/001012.html

[ Andres Rodriguez ]
* debian/control:
  - Change Conflicts/Replaces for Breaks/Replaces.
  - Conflicts on tftpd-hpa and dnsmasq.
  - Do not pre-depends, but Depends on ${misc:Depends} for 'maas'.

[ Steve Langasek ]
* postinst scripts are never called with 'reconfigure' as the script
  argument. Remove references to this (mythical) invocation.
* always call 'set -e' from maintainer scripts instead of passing 'sh -e'
  as the interpreter, so that scripts will behave correctly when run via
  'sh -x'.
* invoke-rc.d is never allowed to not exist - simplify scripts (and make
  them better policy-compliant) by invoking unconditionally. (The only
  possible exception is in the postrm, where it's *theoretically* possible
  for invoke-rc.d to be missing if the user has completely stripped
  down their system; that's a fairly unreasonable corner case, but we
  might as well be correct if it ever happens.)
* db_get+db_set is a no-op; don't call db_set to push back a value we just
  got from db_get.
* Omit superfluous calls to 'exit 0' at the end of each script.
* Remove maas-cluster-controller prerm script, which called debconf for no
  reason.
* Don't invoke debconf in the postrm script either, debhelper already does
  this for us.
* Other miscellaneous maintainer script fixes
* debian/maas-common.postinst: call adduser and addgroup unconditionally;
  the tools are already designed to DTRT, we don't need to check for the
  user/group existence before calling them nor should we worry about
  calling them only once on first install.
* debian/maas-common.postrm: delete the maas group, not just the user,
  as the comment in the code implies we should do.

Author: Seth Arnold
Revision Date: 2014-02-11 12:07:50 UTC

* SECURITY UPDATE: incorrect Content-type header allowed cross-site
  scripting vulnerability if an unknown API was used. (LP: #1251336)
  - debian/patches/CVE-2013-1070.patch: Use Content-type text/plain to force
    browsers to not render error messages as HTML.
  - CVE-2013-1070
* SECURITY UPDATE: /etc/maas/txlongpoll.yaml contained a publicly readable
  password. (LP: #1254034)
  - debian/maas-region-controller.postinst: chown and chmod
    /etc/maas/txlongpoll.yaml with correct permissions
  - CVE-2013-1069

Author: Seth Arnold
Revision Date: 2014-02-11 12:07:50 UTC

* SECURITY UPDATE: incorrect Content-type header allowed cross-site
  scripting vulnerability if an unknown API was used. (LP: #1251336)
  - debian/patches/CVE-2013-1070.patch: Use Content-type text/plain to force
    browsers to not render error messages as HTML.
  - CVE-2013-1070
* SECURITY UPDATE: /etc/maas/txlongpoll.yaml contained a publicly readable
  password. (LP: #1254034)
  - debian/maas-region-controller.postinst: chown and chmod
    /etc/maas/txlongpoll.yaml with correct permissions
  - CVE-2013-1069

Author: Andres Rodriguez
Revision Date: 2012-10-11 17:38:08 UTC

* Fix MAAS not working after CD/preseed install (LP: #1065763)
  - debian/extras/maas-region-celeryd: Add wrapper to run celery from
    the upstart job.
  - debian/extras/maas-region-controller.maas-region-celery.upstart: Create
    rabbitmq user if it does not exists.
* debian/control: Remove unneeded deps on python-txtftp for some binary pkgs.
* debian/maas-region-controller.postinst: Minor fix referencing variable.