vyatta-rest (1.9) unstable; urgency=medium

  * Depend on lighttpd-mod-openssl and load the module explicitly.
    lighttpd had OpenSSL support built in until 1.4.56; it is a module now,
    and Debian ships it as a separate package. The generated 10-ssl.conf is
    full of ssl.* directives but never pulled the module in, so on trixie
    lighttpd failed its own config check:

      dlopen() failed for: /usr/lib/lighttpd/mod_openssl.so
      loading plugins finally failed

    ExecStartPre runs that check, so lighttpd.service never started and
    "set service https" left the REST API with nothing listening on 443.
    Current lighttpd still auto-loads the module when it sees ssl.* keys but
    warns that it will stop doing so, hence the explicit server.modules line
    rather than relying on the fallback.

  * Drop ssl.use-sslv2 and ssl.use-sslv3 from the generated configuration.
    Both keys were removed; lighttpd refuses SSLv2 and SSLv3 unconditionally
    and now reports the keys as unknown.

  * Replace ssl.cipher-list with ssl.openssl.ssl-conf-cmd "CipherString",
    which is what lighttpd's deprecation notice points at. The cipher
    selection itself is unchanged.

  * Stop handing execve a dangling argv in the operational-mode path.
    chunker2 built the argument vector for /opt/vyatta/bin/opc out of
    temporary std::strings:

        cmdarr[0] = (char *)(string("/opt/vyatta/bin/opc").c_str());
        cmdarr[1] = (char *)(string("-op").c_str());
        cmdarr[2] = (char *)(string("run-from-env").c_str());

    Each temporary dies at the end of its own statement, so every pointer
    was dangling before execve saw it. The path argument is passed
    separately and is a literal, so exec still succeeded -- with garbage in
    argv. opc never saw "-op run-from-env", so it did not read OPC_ARGS and
    treated the garbage as a command, answering

        Invalid command: [$]

    for every operational REST call, while configuration calls -- which do
    not go through this path -- worked fine. The literals now go straight
    into the array, where they have static storage. Undefined behaviour
    that happened to work on the old toolchain; it does not on trixie.

  * Move the REST FastCGI socket from /tmp to /run/vyatta-rest.
    Debian's lighttpd.service sets PrivateTmp=yes, so systemd hands lighttpd
    its own /tmp namespace. The socket is created by the chunker service,
    a sysvinit script with no such isolation, so it landed in the real /tmp
    where lighttpd could not see it:

      establishing connection failed: socket: unix:/tmp/fcgi.socket:
        No such file or directory
      all handlers for /rest/op? on are down.

    Every REST call answered 503 while both processes looked healthy --
    lighttpd listening on 443, the REST daemon running, and the socket
    present in /tmp for anyone who went looking. /run is shared between the
    two, so both ends now agree on where the socket is.

 -- DANOS Package Maintainers <DANOS@att.com>  Thu, 20 Aug 2026 04:00:00 +0000

vyatta-rest (1.8) unstable; urgency=medium

  * Remove potentially offensive language

 -- Charles (Chas) Williams <ciwillia@vyatta.att-mail.com>  Mon, 21 Sep 2020 12:30:31 -0400

vyatta-rest (1.7) unstable; urgency=medium

  [ Duncan Eastoe ]
  * Transform lighttpd cron with dh_configpackage
  * Update lighttpd daily cron script to use runuser
  * Remove vyatta-service-https-yang pkg and module
  * control: Add missing ${perl:Depends} substvars
  * rules: invoke dh_yang helper

  [ Charles (Chas) Williams ]

 -- Charles (Chas) Williams <ciwillia@vyatta.att-mail.com>  Mon, 23 Mar 2020 16:06:09 -0400

vyatta-rest (1.6) unstable; urgency=medium

  [ Paul Carson ]
  * Disable ARIA and CAMELLIA ciphers (Fixes: VRVDR-50278)

  [ Charles (Chas) Williams ]

 -- Charles (Chas) Williams <ciwillia@vyatta.att-mail.com>  Fri, 06 Mar 2020 11:16:11 -0500

vyatta-rest (1.5) unstable; urgency=medium

  [ William Ivory ]
  * Remove explicit config.boot reference in confmode.cc process()

  [ Charles (Chas) Williams ]

 -- Charles (Chas) Williams <ciwillia@vyatta.att-mail.com>  Mon, 23 Dec 2019 16:30:20 -0500

vyatta-rest (1.4) unstable; urgency=medium

  * DANOS Import master

 -- Vyatta Package Maintainers <DL-vyatta-help@att.com>  Thu, 31 Oct 2019 20:36:22 -0400

