libapache2-mod-authn-totp (1.1.0) unstable; urgency=medium

  * Tmp-collision-fix: 8 random bytes per tmp name (was deterministic
    <ts>) in check_n_update_file_helper_pure; lock-acquire failure now
    fail-closed (was lockless). Pre-fix: concurrent same-code requests
    in the same TOTP window collided on <file>.<ts> tmp paths and
    surfaced as spurious 401s.
  * Window-size-doc: FILEFORMAT.md derived-not-vendored header; WINDOW_SIZE
    one-sided 2n+1/default-0 rewrite with a trailing Deviations section
    against the upstream Apache portable runtime reference.
  * Test-relocate: tree moved to test/{integration,unit,packaging}/.
    Apache::Test layout overrides wired through %Apache::TestConfig::Argv;
    parent TEST unshift @INC so forked per-test child perls can locate
    the frozen config when the harness chdirs to dirname(dirname($0)).
  * State-dir-sweep: load-time reap of crash-orphaned <user>.codes.* and
    <user>.logins.* tmps in stateDir. Cold start = reap all; graceful
    restart = reap mtime >30s, warn+keep younger.

 -- Oleksandr Ostrenko <oleksandr@ostrenko.dev>  Fri, 04 Sep 2026 16:50:00 +0200

libapache2-mod-authn-totp (1.0.0) unstable; urgency=medium

  * Initial Debian packaging (dh-apache2, dh --buildsystem=cmake).
    Unit tests gate the build; integration tests are skipped via
    -DTOTP_ENABLE_INTEGRATION_TESTS=OFF.

 -- Oleksandr Ostrenko <oleksandr@ostrenko.dev>  Thu, 27 Aug 2026 17:54:18 +0200
