watcher (16.0.0-5) unstable; urgency=high * CVE-2026-XXXXX / OSSA-2026-036: Watcher webhook trigger endpoint does not enforce oslo.policy authorization. Any authenticated user who learns a Watcher audit webhook URL can POST to the webhook to trigger an administrator-owned EVENT audit and its associated action plan, regardless of the caller's project or role. The webhook endpoint has lacked policy enforcement since its introduction in the Ussuri release. Applied upstream patch: "Add policy enforcement to webhook trigger endpoint". (Closes: #1144880) -- Thomas Goirand Wed, 12 Aug 2026 10:12:23 +0200 watcher (16.0.0-4) unstable; urgency=medium * Another reproducible issue fixed in make-watcher-reproducible.patch (Closes: #1142000). -- Thomas Goirand Tue, 28 Jul 2026 12:19:46 +0200 watcher (16.0.0-3) unstable; urgency=medium * Add make-watcher-reproducible.patch. -- Thomas Goirand Wed, 08 Jul 2026 14:14:05 +0200 watcher (16.0.0-2) unstable; urgency=medium * Install watcher-api-uwsgi.ini in watcher-api package. -- Thomas Goirand Wed, 27 May 2026 17:08:45 +0200 watcher (16.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 01 Apr 2026 16:03:45 +0200 watcher (16.0.0~rc1-4) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Fri, 27 Mar 2026 14:54:28 +0100 watcher (16.0.0~rc1-3) experimental; urgency=medium * Fixed watcher to use uwsgi correctly. -- Thomas Goirand Wed, 18 Mar 2026 11:11:33 +0100 watcher (16.0.0~rc1-2) experimental; urgency=medium * Removed --format when building the policy yaml file. -- Thomas Goirand Fri, 13 Mar 2026 14:13:23 +0100 watcher (16.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. * Reviewed namespace list when building watcher.conf. * Reworked install-all-files.patch. * Removed fix-term.py-for-latest-docutils.patch applied upstream. * Just run all tests but for MaaS. -- Thomas Goirand Fri, 13 Mar 2026 13:51:08 +0100 watcher (15.0.0-3) unstable; urgency=medium * Cleans better (Closes: #1048142). -- Thomas Goirand Wed, 11 Feb 2026 10:17:09 +0100 watcher (15.0.0-2) unstable; urgency=medium * Display cat /tmp/sphinx-err-*.log if sphinx doc build fails. * Add fix-term.py-for-latest-docutils.patch (Closes: #1118332). -- Thomas Goirand Fri, 24 Oct 2025 11:15:25 +0200 watcher (15.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 01 Oct 2025 22:45:37 +0200 watcher (15.0.0~rc1-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Mon, 29 Sep 2025 11:15:39 +0200 watcher (15.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. * Removed OSSN-0094_use_cinder_migrate_for_swap_volume.patch applied upstream. -- Thomas Goirand Tue, 16 Sep 2025 12:41:31 +0200 watcher (14.0.0-3) unstable; urgency=high * A vulnerability has been identified in OpenStack Nova and OpenStack Watcher in conjunction with volume swap operations performed by the Watcher service. Under specific circumstances, this can lead to a situation where two Nova libvirt instances could reference the same block device, allowing accidental information disclosure to the unauthorized instance. Added upstream patch: OSSN-0094_use_cinder_migrate_for_swap_volume.patch. (Closes: #1111692). -- Thomas Goirand Thu, 21 Aug 2025 10:27:37 +0200 watcher (14.0.0-2) unstable; urgency=medium * Add export OS_OSLO_MESSAGING_RABBIT__PROCESSNAME for all daemons. -- Thomas Goirand Fri, 11 Jul 2025 14:45:24 +0200 watcher (14.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 02 Apr 2025 14:02:07 +0200 watcher (14.0.0~rc1-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Fri, 28 Mar 2025 21:10:31 +0100 watcher (14.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. -- Thomas Goirand Fri, 14 Mar 2025 10:50:32 +0100 watcher (13.0.0-2) unstable; urgency=medium * Switch to pybuild (Closes: #1090709). -- Thomas Goirand Wed, 18 Dec 2024 13:51:43 +0100 watcher (13.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 02 Oct 2024 16:28:58 +0200 watcher (13.0.0~rc1-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Fri, 20 Sep 2024 17:32:29 +0200 watcher (13.0.0~rc1-1) experimental; urgency=medium * New upstream release. -- Thomas Goirand Tue, 17 Sep 2024 11:31:06 +0200 watcher (12.0.0+git.2024.06.01.a9dc3794a69c-1) unstable; urgency=medium * New upstream release based on latest commit fixing FTBFS (Closes: #1073462) -- Thomas Goirand Tue, 23 Jul 2024 03:51:20 +0200 watcher (12.0.0-1) unstable; urgency=medium * New upstream release. * Uploading to unstable. -- Thomas Goirand Thu, 04 Apr 2024 12:36:53 +0200 watcher (12.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Do not run MaaS tests, as we don't have the python3-libmaas package in Debian. -- Thomas Goirand Sun, 17 Mar 2024 14:23:37 +0100 watcher (11.0.0-1) unstable; urgency=medium * New upstream release. * Uploading to unstable. -- Thomas Goirand Thu, 05 Oct 2023 11:26:40 +0200 watcher (11.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Fix (build-)depends for this release. -- Thomas Goirand Thu, 14 Sep 2023 10:42:48 +0200 watcher (10.0.0-4) unstable; urgency=medium * Cleans better (Closes: #1048142). -- Thomas Goirand Mon, 21 Aug 2023 16:32:21 +0200 watcher (10.0.0-3) unstable; urgency=medium * Removed obsolete lsb-base depends. -- Thomas Goirand Mon, 19 Jun 2023 14:59:59 +0200 watcher (10.0.0-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Mon, 19 Jun 2023 14:53:33 +0200 watcher (10.0.0-1) experimental; urgency=medium * New upstream release. -- Thomas Goirand Wed, 22 Mar 2023 14:53:36 +0100 watcher (10.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Removed versions of (build-)depends when satisfied in Bookworm. -- Thomas Goirand Wed, 01 Mar 2023 16:37:59 +0100 watcher (9.0.0-1) unstable; urgency=medium * New upstream release. * Removed Fix-compatibility-with-oslo.db-12.1.0.patch applied upstream. -- Thomas Goirand Thu, 06 Oct 2022 11:07:38 +0200 watcher (9.0.0~rc1-3) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Sat, 24 Sep 2022 17:00:00 +0200 watcher (9.0.0~rc1-2) experimental; urgency=medium * Add Fix-compatibility-with-oslo.db-12.1.0.patch. -- Thomas Goirand Wed, 21 Sep 2022 10:03:59 +0200 watcher (9.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Add python3-webtest to build-depends. * Fixed version of oslo.concurrency to >= 5.0.1. -- Thomas Goirand Wed, 14 Sep 2022 13:57:49 +0200 watcher (8.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 30 Mar 2022 22:48:20 +0200 watcher (8.0.0~rc1-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Sun, 27 Mar 2022 16:02:29 +0200 watcher (8.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Removed Remove_ceilometerclient_dependecy.patch applied upstream. -- Thomas Goirand Sat, 12 Mar 2022 17:15:29 +0100 watcher (7.0.0-2) unstable; urgency=medium * Removed python3-ceilometerclient from (build-)depends. -- Thomas Goirand Fri, 11 Feb 2022 14:15:03 +0100 watcher (7.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 06 Oct 2021 21:54:25 +0200 watcher (7.0.0~rc1-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Fri, 01 Oct 2021 11:27:10 +0200 watcher (7.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Removed python3-os-testr from build-depends. * Blacklist test_create_continuous_audit_with_wrong_interval(). -- Thomas Goirand Fri, 17 Sep 2021 11:45:28 +0200 watcher (6.0.0-2) unstable; urgency=medium * Upload to unstable. -- Thomas Goirand Mon, 16 Aug 2021 14:38:52 +0200 watcher (6.0.0-1) experimental; urgency=medium * New upstream release. -- Thomas Goirand Thu, 15 Apr 2021 17:38:56 +0200 watcher (6.0.0~rc1-1) experimental; urgency=medium * Tune watcher-api-uwsgi.ini for performance. * New upstream release. * Removed (build-)depends versions when satisfied in Bullseye. * Fixed (build-)depends for this release. * debhelper-compat 11. * d/rules: removed --with systemd. * Added removed-sphinxcontrib.httpdomain-from-sphinx-ext.patch. -- Thomas Goirand Tue, 23 Mar 2021 14:37:58 +0100 watcher (5.0.0-1) unstable; urgency=medium * New upstream release. * Uploading to unstable. * Fixed debian/watch. * Add a debian/salsa-ci.yml. -- Thomas Goirand Sat, 17 Oct 2020 21:20:10 +0200 watcher (5.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. -- Thomas Goirand Thu, 01 Oct 2020 10:03:47 +0200 watcher (4.0.0-2) unstable; urgency=medium * Added --serial when running tests (Closes: #918648). -- Thomas Goirand Wed, 13 May 2020 22:57:19 +0200 watcher (4.0.0-1) unstable; urgency=medium * New upstream release. -- Thomas Goirand Wed, 13 May 2020 19:12:11 +0200 watcher (4.0.0~rc2-1) unstable; urgency=medium * New upstream release. * Uploading to unstable. -- Thomas Goirand Sat, 09 May 2020 21:52:06 +0200 watcher (4.0.0~rc1-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. * Removed patch applied upstream: fix-taskflow-2.2.patch. -- Thomas Goirand Thu, 23 Apr 2020 12:26:49 +0200 watcher (3.0.0-3) unstable; urgency=medium * d/patches: Add fix-taskflow-2.2.patch (Closes: #951942) * d/control: Fix python3-taskflow version -- Michal Arbet Wed, 04 Mar 2020 17:48:15 +0000 watcher (3.0.0-2) unstable; urgency=medium [ Ondřej Nový ] * Bump Standards-Version to 4.4.1. [ Thomas Goirand ] * Uploading to unstable. -- Thomas Goirand Tue, 22 Oct 2019 22:59:17 +0200 watcher (3.0.0-1) experimental; urgency=medium * New upstream release. * Remove /usr/etc from python3-watcher. -- Thomas Goirand Wed, 16 Oct 2019 19:33:22 +0200 watcher (3.0.0~rc1-1) experimental; urgency=medium [ Ondřej Nový ] * Use debhelper-compat instead of debian/compat. * Bump Standards-Version to 4.4.0. [ Thomas Goirand ] * New upstream release. * Fixed (build-)depends for this release. * Removed switch-to-GreenThreadPoolExecutor.patch applied upstream. * Fix running unit tests. * Add remove-sphinxcontrib.rsvgconverter.patch. -- Thomas Goirand Tue, 01 Oct 2019 10:33:58 +0200 watcher (2.0.0-5) unstable; urgency=medium * Uploading to unstable. -- Michal Arbet Wed, 17 Jul 2019 20:10:41 +0200 watcher (2.0.0-4) experimental; urgency=medium * d/control: - Bump openstack-pkg-tools to version 99 - Add me to uploaders field * d/copyright: Add me to copyright file -- Michal Arbet Thu, 02 May 2019 18:01:53 +0200 watcher (2.0.0-3) experimental; urgency=medium * Add export TZ=UTC in debian/rules (Closes: #918712). -- Thomas Goirand Wed, 17 Apr 2019 23:58:55 +0200 watcher (2.0.0-2) experimental; urgency=medium * Removed python3- prefix when calling conf generators. -- Thomas Goirand Wed, 17 Apr 2019 13:27:48 +0200 watcher (2.0.0-1) experimental; urgency=medium [ Thomas Goirand ] * New upstream release. * Fixed startup script description. * New upstream release. * Fixed (build-)depends for this release. Freezegun upstream b-requirement downgraded to 0.3.9. * Removed fix-import-sphinx-Directive.patch applied upstream. * Add switch-to-GreenThreadPoolExecutor.patch. * Standards-Version: 4.3.0. * Removed versions of packages when satisfied in Buster. * Run different types of unit tests separately to avoid hangs. [ Ondřej Nový ] * d/control: Use team+openstack@tracker.debian.org as maintainer * Running wrap-and-sort -bast -- Thomas Goirand Wed, 20 Jun 2018 13:59:53 +0200 watcher (1.8.0-5) unstable; urgency=medium * Also package watcher/api/app.wsgi. -- Thomas Goirand Mon, 07 May 2018 13:34:40 +0200 watcher (1.8.0-4) unstable; urgency=medium * Use pkgos-dh_auto_{test,install} (Closes: #892783). * Fix sphinx import of the Directive module. -- Thomas Goirand Fri, 27 Apr 2018 08:59:55 +0200 watcher (1.8.0-3) unstable; urgency=medium * Fixed dbc postrm. -- Thomas Goirand Mon, 26 Mar 2018 18:02:52 +0000 watcher (1.8.0-2) unstable; urgency=medium * Switched to openstack-pkg-tools >= 70~ shared debconf templates. -- Thomas Goirand Wed, 07 Mar 2018 10:35:43 +0000 watcher (1.8.0-1) unstable; urgency=medium [ Ondřej Nový ] * d/control: Set Vcs-* to salsa.debian.org [ Thomas Goirand ] * New upstream release. * Fixed (build-)depends for this release. * Switched to Python 3. * Standards-Version is now 4.1.3. -- Thomas Goirand Tue, 20 Feb 2018 23:35:48 +0100 watcher (1.4.1-3) unstable; urgency=medium * Fixed encoding of pt.po (Closes: #881578). -- Thomas Goirand Fri, 26 Jan 2018 11:50:09 +0100 watcher (1.4.1-2) unstable; urgency=medium * Uploading to unstable. * Remove /var/cache/watcher on purge (Closes: #852120). * Updated it.po (Closes: #860380). * Updated fr.po (Closes: #873686). * Updated pt.po (Closes: #876177). * (build-)depends on 2.9.0 version of ceilometerclient (Closes: #880091). * Removed dh-systemd build-depends. -- Thomas Goirand Sat, 28 Oct 2017 09:58:37 +0000 watcher (1.4.1-1) experimental; urgency=medium [ Daniel Baumann ] * Updating vcs fields. * Updating copyright format url. * Updating maintainer field. * Running wrap-and-sort -bast. * Updating standards version to 4.0.0. * Removing gbp.conf, not used anymore or should be specified in the developers dotfiles. * Correcting permissions in debian packaging files. * Updating standards version to 4.0.1. * Deprecating priority extra as per policy 4.0.1. * Updating standards version to 4.1.0. [ Thomas Goirand ] * New upstream release. * Fixed (build-)depends for this release. * d/rules: remove OSLO_PACKAGE_VERSION set by openstack-pkg-tools. * Rebase MANIFEST.in patch, remove SQLA version patch. -- Thomas Goirand Thu, 19 Oct 2017 16:11:45 +0200 watcher (0.30.0-5) unstable; urgency=medium * Team upload. * Delete wrong net-tools dependency. * Bump build dependency on openstack-pkg-tools (Closes: #858713). -- David Rabel Sat, 01 Apr 2017 12:39:26 +0200 watcher (0.30.0-4) unstable; urgency=medium * Team upload. * Create /var/cache/watcher with no error if existing. (Closes: #851260) -- Ondřej Kobližek Mon, 16 Jan 2017 13:20:05 +0100 watcher (0.30.0-3) unstable; urgency=medium [ Ondřej Nový ] * Bumped debhelper compat version to 10 [ Thomas Goirand ] * Allow using SQLA >= 1.1 (patching requirements.txt). * Create /var/cache/watcher in postinst. -- Thomas Goirand Fri, 09 Dec 2016 18:12:45 +0100 watcher (0.30.0-2) unstable; urgency=medium [ Ondřej Nový ] * d/s/options: extend-diff-ignore of .gitreview * d/control: Use correct branch in Vcs-* fields [ Thomas Goirand ] * Uploading to unstable. * Build-Depends on openstack-pkg-tools >= 53~. * Fixed oslotest EPOCH. * Fixed oslo-config-generator namespaces. -- Thomas Goirand Wed, 28 Sep 2016 10:21:56 +0200 watcher (0.30.0-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. * Using OpenStack's Gerrit as VCS URLs. * Fix missing EPOC in many (build-)depends. -- Thomas Goirand Mon, 19 Sep 2016 12:01:59 +0200 watcher (0.28.0-2) experimental; urgency=medium * Now requires python-apscheduler >= 3.0.5 (FTBFS otherwise). -- Thomas Goirand Sat, 16 Jul 2016 15:37:25 +0000 watcher (0.28.0-1) experimental; urgency=medium * New upstream release. * Fixed (build-)depends for this release. -- Thomas Goirand Sat, 16 Jul 2016 17:22:03 +0200 watcher (0.27.0-3) experimental; urgency=medium * Added runtime depends on net-tools for watcher-api, as the config is using /sbin/route. -- Thomas Goirand Fri, 01 Jul 2016 10:38:53 +0200 watcher (0.27.0-2) experimental; urgency=medium * Fixed debian/copyright missing copyright holders. -- Thomas Goirand Mon, 13 Jun 2016 08:40:12 +0000 watcher (0.27.0-1) experimental; urgency=medium * Initial release. (Closes: #826853) -- Thomas Goirand Thu, 09 Jun 2016 16:03:10 +0200