opendkim-ng (3.0.0~beta11-ng1) unstable; urgency=medium

  * Security: fix A-R stripping bypass via trailing-dot authserv-id
  * Security: fix TXT chunk-length OOB read in DNS key extraction
  * Security: sandbox Lua policy hooks against dangerous standard libraries
  * Security: zero per-signrequest private key data before free
  * Security: fix mlfi_connect config-refcount race
  * Fix: dkim_ohdrs z= decode overwrote plist storage (bugs #226, #233, #235)
  * Fix: don't skip body when only one canonicalization mode is finished (issue #15)
  * Fix: protect ub_ctx_config() with a mutex (issue #14)
  * Fix: widen password file critical section in dkimf_securefile (issue #8)
  * Fix: RequiredHeaders now reports specific error and rejects (issue #28)
  * Fix: standard resolver DNSSEC-awareness; ub_ctx_config() concurrency
  * Add: header.a and header.s to Authentication-Results output
  * Add: SyslogName configuration option
  * Add: odkim.internal_ip() to screen and final Lua policy hooks
  * Feature: reject non-printable domain/selector in dkim_sign() (feature #190)
  * Build: port missing HAVE_* probes to CMake; add HAVE_LIBCURL
  * Build: CMake hardening infrastructure; OpenSSL 4 support
  * Build: OpenSSL version string in build-config.h and -V output
  * Remove: POPAUTH (POP-before-SMTP) support
  * Remove: QUERY_CACHE BerkeleyDB-backed DNS-result cache
  * Code: systematic -Wcast-qual / -Wshadow / -Wsign-compare / -Wpointer-sign
    remediation across libopendkim, daemon, miltertest, and test programs (PR #3)

 -- Edmund Lodewijks <edmund@proteamail.com>  Thu, 21 May 2026 00:00:00 +0200

opendkim-ng (3.0.0~beta10-ng1) unstable; urgency=medium

  * CI: Fix YAML syntax in apt dispatch step

 -- Edmund Lodewijks <edmund@proteamail.com>  Thu, 14 May 2026 00:00:00 +0200

opendkim-ng (3.0.0~beta9-ng1) unstable; urgency=medium

  * CI: Batch apt dispatch — one event per codename, all packages in one run

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 23:45:00 +0200

opendkim-ng (3.0.0~beta8-ng1) unstable; urgency=medium

  * CI: Add ~bpo12+ version suffix for bookworm builds to avoid pool conflicts

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 23:15:00 +0200

opendkim-ng (3.0.0~beta7-ng1) unstable; urgency=medium

  * CI: Matrix build for Debian bookworm and trixie
  * CI: Prefix release assets with distro codename
  * CI: Multi-distro apt repository support

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 22:30:00 +0200

opendkim-ng (3.0.0~beta6-ng1) unstable; urgency=medium

  * CI: Fix build dependencies (libbsd-dev, libevent-dev, nettle-dev,
    libhiredis-dev)
  * CI: Enable Redis/hiredis in deb build
  * CI: Publish .deb packages to apt repository on tag push
  * Build: Drop unused VERSION_STRING and -DVERSION cmake defines
  * Build: Fix t-db-redis link (add opendkim-lua.c)

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 21:30:00 +0200

opendkim-ng (3.0.0~beta5-ng1) unstable; urgency=medium

  * Rename and move sample configuration to /usr/share/doc/opendkim-ng/
  * Modernise SystemD management: Run as simple, not forking, and without PID
  * Added patches for Lua 5.5+
  * Removed older or unwanted db backends (BDB, OpenDBX, LDAP, SASL,
    libmemchaced, Erlang)
  * Fixed 2 bugs in the LMDB code
  * Added Redis/Valkey as db backend (PostgreSQL still planned)
  * Fixed all relevant issues from the pre-fork Github Issues tracker
  * Applied patches from Debian, Fedora, and Gentoo, or fixed the issues in
    a slightly different way (distro patch authors credited)

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 20:23:00 +0200

opendkim-ng (3.0.0~beta4-ng1) unstable; urgency=medium

  * CI: Added GitHub Action workflow for building .deb packages

 -- Edmund Lodewijks <edmund@proteamail.com>  Tue, 12 May 2026 12:39:00 +0200

opendkim-ng (3.0.0~beta3-ng1) unstable; urgency=medium

  * Hotfix: Fix SigningTable validation

 -- Edmund Lodewijks <edmund@proteamail.com>  Tue, 12 May 2026 12:02:00 +0200

opendkim-ng (3.0.0~beta2-ng1) unstable; urgency=medium

  * Fix Lua 5.4 C API: correct version guards (== 502 → >= 502) across
  all hook functions (setup, screen, final, db)
  * Fix Lua 5.4 C API: remove unguarded lua_load/lua_dump compat shims
  * Fix Lua 5.4 C API: add missing strip argument to lua_dump call sites
  * Fix Lua 5.4 C API: remove stale lua_pop() after luaL_newlib/lua_setglobal
  * Fix signtable validation walk in dkimf_config_load(): missing KeyTable
  entries were not being caught due to datasplit OPTIONAL flag bug
  * Port integration tests to CMake out-of-source build layout
  * Fix miltertest: connect-failure returns nil instead of throwing
  * Fix miltertest: add expect_exit option to startfilter for conf-check tests
  * Disable integration tests for permanently removed features:
  t-lua-rbl, t-sign-atps, t-verify-ss-atps, t-verify-ss-rep,
  t-sign-ss-replace

 -- Edmund Lodewijks <edmund@proteamail.com>  Sat, 09 May 2026 21:58:00 +0200

opendkim-ng (3.0.0~beta1-ng1) unstable; urgency=medium

  * Initial release of the opendkim-ng modernisation fork.
  * Updated library SOVERSION to 13 to reflect OpenSSL 3 EVP port.
  * Migrated build system to CMake for improved maintainability.
  * Implemented Ed25519-SHA256 signing and verification (RFC 8463).
  * Hardened security: Removed RSA-SHA1 and deprecated GnuTLS code paths.
  * Fixed critical memory safety bugs in dkim_qp_decode (buffer overflow/NUL).
  * LMDB implemented as the primary high-performance backend.
  * Cleaned and modernised test suite: SHA256 as default for all tests.

 -- Edmund Lodewijks <edmund@proteamail.com>  Sun, 03 May 2026 21:00:00 +0200
