phoenixdkim (3.0.0~beta13-ng1) trixie; urgency=medium

  * RFC 8301: RSA-SHA1 verification refused unconditionally;
    DKIM_LIBFLAGS_NOSHA1VERIFY set on every startup. New
    On-WeakAlgorithm option controls milter disposition
    (neutral/reject/quarantine/tempfail/discard); "accept" is
    rejected at config load. RSA-SHA1 signing also disabled.
  * Feature: CheckSigningTable config option and -g/-G flags
  * Feature: opendkim-genzone -s flag for subdomain matching;
    output is now reproducible
  * Feature: optional fourth KeyTable field for signing algorithm
  * Feature: systemd Type=notify readiness signalling and watchdog
    keep-alive thread; service hardening directives
  * Feature: opendkim -V prints full build configuration; git commit
    embedded in version string for development builds
  * Feature: DKIM_FEATURE_ED25519 capability flag; multi-signing
    unit tests t-test204 and t-test205
  * Remove: K&R __P() portability wrappers
  * Remove: smfi_insheader() compatibility stub for sendmail < 8.13.0
  * Remove: dead conf_singleauthres config field
  * Fix: dkim_sign() correctly emits l= body-length tag; missing
    final CRLF no longer rejected when l= is in use
  * Fix: sig_signalg set before feature-check continue in
    dkim_siglist_setup()
  * Fix: correct operator precedence in DKIM_SIG_CHECK macro
  * Fix: header field-body character validation tautology — check
    now correctly rejects invalid characters
  * Fix: assert crash in dkim_canon_selecthdrs when all headers
    are skipped
  * Fix: Ed25519 verification reuse path frees ed_pkey before memset
  * Fix: opendkim-testkey now supports ED25519 key verification
  * Fix: NoHeaderB now suppresses A-R header.b extraction
  * Fix: Authentication-Results with no-result entry accepted as
    valid syntax
  * Fix: distinguish "no From/Date field" from "multiple From/Date
    fields" in header diagnostics
  * Fix: A-R key tag separator changed from semicolon to comma
  * Fix: authserv-id and job-id quoted in A-R per RFC 8601
  * Fix: no BADFORMAT A-R header in sign-only mode when sender
    unresolvable
  * Fix: MaximumHeaders rejection includes SMTP reply and field name
  * Fix: DNAME RRs skipped in DKIM key and failure-report DNS lookups
  * Fix: libunbound context loads /etc/resolv.conf by default
  * Fix: NXDOMAIN distinguished from transient errors in stub resolver
  * Fix: dkim_res_nslist() under HAVE_RES_SETSERVERS
  * Fix: first TXT record used when key query returns multiple records
  * Fix: memory leaks and orphaned-list bug in key lookup (issue #272)
  * Fix: endpwent() called on early returns from key safety checks
    (issue #198)
  * Fix: SafeKeys group warnings report path, not username
  * Fix: warn when KeyFile and KeyTable are both set
  * Fix: clearer diagnostics for KeyTable and SafeKeys failures
  * Fix: DNS timeout distinguished from key-not-found in error log
  * Fix: OpenSSL errors propagated to user in opendkim-genkey
  * Fix: ABI-compatible OpenSSL patch releases accepted at startup
  * Fix: primary GID passed to initgroups() when Group is configured
  * Fix: stack overflow in miltertest on oversized REPLBODY
  * Fix: MT_SMTPREPLY usable after any milter callback, not only EOM
  * Fix: odkim.del_header() deletes the indexed instance, not the first
  * Fix: milter capabilities declared for FinalPolicyScript hooks
  * Fix: dkimf_lua_writer guarded against Lua 5.5 end-of-dump
  * Fix: memmove for overlapping copy in SubDomains domain walk
  * Fix: leading '[' treated as bracketed IPv6 address
  * Fix: milter hostname included in SoftwareHeader when distinct
  * Fix: DKIM failure report skipped when recipient address truncated
  * Code: -Wconversion / -Wsign-conversion remediation complete
    across libopendkim, daemon, miltertest, and test suite
  * Build: optional OPENDKIM_ENABLE_STRICT_C, Valgrind CTest targets,
    and MSan support (all off by default)

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 27 May 2026 00:00:00 +0200

phoenixdkim (3.0.0~beta12-ng1) trixie; urgency=medium

  * Rename: project and source package renamed from opendkim-ng to
    phoenixdkim
  * Man pages: updated .TH headers to identify PhoenixDKIM as the
    source package; removed obsolete references to eliminated backends
  * Remove: orphaned libut directory
  * Remove: autobuild/ (superseded by CMake)
  * Packaging: miltertest binary now correctly installed into the
    miltertest package rather than phoenixdkim
  * Packaging: remove empty conffiles
  * Packaging: remove obsolete syslog.target from systemd service unit

 -- Edmund Lodewijks <edmund@proteamail.com>  Fri, 23 May 2026 00:00:00 +0200

phoenixdkim (3.0.0~beta11-ng1) trixie; urgency=medium

  * Security: fix A-R stripping bypass via trailing-dot authserv-id
  * Security: fix TXT chunk-length OOB read in DNS key extraction
  * Security: sandbox Lua policy hooks against dangerous standard libraries
  * Security: zero per-signrequest private key data before free
  * Security: fix mlfi_connect config-refcount race
  * Fix: dkim_ohdrs z= decode overwrote plist storage (bugs #226, #233, #235)
  * Fix: don't skip body when only one canonicalization mode is
    finished (issue #15)
  * Fix: protect ub_ctx_config() with a mutex (issue #14)
  * Fix: widen password file critical section in dkimf_securefile (issue #8)
  * Fix: RequiredHeaders now reports specific error and rejects (issue #28)
  * Fix: standard resolver DNSSEC-awareness; ub_ctx_config() concurrency
  * Add: header.a and header.s to Authentication-Results output
  * Add: SyslogName configuration option
  * Add: odkim.internal_ip() to screen and final Lua policy hooks
  * Feature: reject non-printable domain/selector in dkim_sign() (feature #190)
  * Build: port missing HAVE_* probes to CMake; add HAVE_LIBCURL
  * Build: CMake hardening infrastructure; OpenSSL 4 support
  * Build: OpenSSL version string in build-config.h and -V output
  * Remove: POPAUTH (POP-before-SMTP) support
  * Remove: QUERY_CACHE BerkeleyDB-backed DNS-result cache
  * Code: systematic -Wcast-qual / -Wshadow / -Wsign-compare / -Wpointer-sign
    remediation across libopendkim, daemon, miltertest, and test
    programs (PR #3)

 -- Edmund Lodewijks <edmund@proteamail.com>  Thu, 21 May 2026 00:00:00 +0200

opendkim-ng (3.0.0~beta10-ng1) unstable; urgency=medium

  * CI: Fix YAML syntax in apt dispatch step

 -- Edmund Lodewijks <edmund@proteamail.com>  Thu, 14 May 2026 00:00:00 +0200

opendkim-ng (3.0.0~beta9-ng1) unstable; urgency=medium

  * CI: Batch apt dispatch — one event per codename, all packages in one run

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 23:45:00 +0200

opendkim-ng (3.0.0~beta8-ng1) unstable; urgency=medium

  * CI: Add ~bpo12+ version suffix for bookworm builds to avoid pool conflicts

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 23:15:00 +0200

opendkim-ng (3.0.0~beta7-ng1) unstable; urgency=medium

  * CI: Matrix build for Debian bookworm and trixie
  * CI: Prefix release assets with distro codename
  * CI: Multi-distro apt repository support

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 22:30:00 +0200

opendkim-ng (3.0.0~beta6-ng1) unstable; urgency=medium

  * CI: Fix build dependencies (libbsd-dev, libevent-dev, nettle-dev,
    libhiredis-dev)
  * CI: Enable Redis/hiredis in deb build
  * CI: Publish .deb packages to apt repository on tag push
  * Build: Drop unused VERSION_STRING and -DVERSION cmake defines
  * Build: Fix t-db-redis link (add opendkim-lua.c)

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 21:30:00 +0200

opendkim-ng (3.0.0~beta5-ng1) unstable; urgency=medium

  * Rename and move sample configuration to /usr/share/doc/opendkim-ng/
  * Modernise SystemD management: Run as simple, not forking, and without PID
  * Added patches for Lua 5.5+
  * Removed older or unwanted db backends (BDB, OpenDBX, LDAP, SASL,
    libmemchaced, Erlang)
  * Fixed 2 bugs in the LMDB code
  * Added Redis/Valkey as db backend (PostgreSQL still planned)
  * Fixed all relevant issues from the pre-fork Github Issues tracker
  * Applied patches from Debian, Fedora, and Gentoo, or fixed the issues in
    a slightly different way (distro patch authors credited)

 -- Edmund Lodewijks <edmund@proteamail.com>  Wed, 13 May 2026 20:23:00 +0200

opendkim-ng (3.0.0~beta4-ng1) unstable; urgency=medium

  * CI: Added GitHub Action workflow for building .deb packages

 -- Edmund Lodewijks <edmund@proteamail.com>  Tue, 12 May 2026 12:39:00 +0200

opendkim-ng (3.0.0~beta3-ng1) unstable; urgency=medium

  * Hotfix: Fix SigningTable validation

 -- Edmund Lodewijks <edmund@proteamail.com>  Tue, 12 May 2026 12:02:00 +0200

opendkim-ng (3.0.0~beta2-ng1) unstable; urgency=medium

  * Fix Lua 5.4 C API: correct version guards (== 502 → >= 502) across
  all hook functions (setup, screen, final, db)
  * Fix Lua 5.4 C API: remove unguarded lua_load/lua_dump compat shims
  * Fix Lua 5.4 C API: add missing strip argument to lua_dump call sites
  * Fix Lua 5.4 C API: remove stale lua_pop() after luaL_newlib/lua_setglobal
  * Fix signtable validation walk in dkimf_config_load(): missing KeyTable
  entries were not being caught due to datasplit OPTIONAL flag bug
  * Port integration tests to CMake out-of-source build layout
  * Fix miltertest: connect-failure returns nil instead of throwing
  * Fix miltertest: add expect_exit option to startfilter for conf-check tests
  * Disable integration tests for permanently removed features:
  t-lua-rbl, t-sign-atps, t-verify-ss-atps, t-verify-ss-rep,
  t-sign-ss-replace

 -- Edmund Lodewijks <edmund@proteamail.com>  Sat, 09 May 2026 21:58:00 +0200

opendkim-ng (3.0.0~beta1-ng1) unstable; urgency=medium

  * Initial release of the opendkim-ng modernisation fork.
  * Updated library SOVERSION to 13 to reflect OpenSSL 3 EVP port.
  * Migrated build system to CMake for improved maintainability.
  * Implemented Ed25519-SHA256 signing and verification (RFC 8463).
  * Hardened security: Removed RSA-SHA1 and deprecated GnuTLS code paths.
  * Fixed critical memory safety bugs in dkim_qp_decode (buffer overflow/NUL).
  * LMDB implemented as the primary high-performance backend.
  * Cleaned and modernised test suite: SHA256 as default for all tests.

 -- Edmund Lodewijks <edmund@proteamail.com>  Sun, 03 May 2026 21:00:00 +0200
