Merge chrony from Debian unstable for oracular

[Bryce Harrington]

Upstream: tbd
Debian: 4.5-2
Ubuntu: 4.5-1ubuntu4

Debian does new releases regularly, so it's likely there will be newer versions available before FF that we can pick up if this merge is done later in the cycle.

If it turns out this needs a sync rather than a merge, please change the tag 'needs-merge' to 'needs-sync', and (optionally) update the title as desired.

If this merge pulls in a new upstream version, also consider adding an entry to the Oracular Release Notes: https://discourse.ubuntu.com/c/release/38

### New Debian Changes ###

chrony (4.5-2) unstable; urgency=medium

  * debian/copyright:
    - Update copyright year for debian/*.

  * debian/control:
    - Build depend on pkgconf instead of pkg-config.
    - Bump Standards-Version to 4.7.0 (no changes needed).

  * debian/rules:
    - Disable seccomp on loong64 until libseccomp in Debian supports it.

  * debian/tests/upstream-simulation-test-suite:
    - Build clknetsim with extra CFLAGS on armel and armhf architectures as it
    needs to use the same time_t as the chronyd binary.
    - Update clknetsim version.
    - Prevent connection timeout on slow architectures.
    - Remove unused environment variable.

  [ Bryce Harrington ]
  * debian/usr.sbin.chronyd:
    - Fix failure to start timemaster due to lack of rw permissions on chrony
    socket. (LP: #2032805)
    - Allow the default UNIX domain socket address to be used by the
    reflock_sock service in the AppArmor configuration.

 -- Vincent Blut <email address hidden> Thu, 25 Apr 2024 15:52:18 +0200

chrony (4.5-1) unstable; urgency=medium

  * Import upstream version 4.5:
    - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.

  * Upload to unstable.

  * debian/copyright:
    - Update copyright attribution.

 -- Vincent Blut <email address hidden> Tue, 05 Dec 2023 16:35:17 +0100

chrony (4.5~pre1-1) experimental; urgency=medium

  * Import upstream version 4.5-pre1:
    - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.

  * debian/tests/upstream-simulation-test-suite:
    - Update clknetsim version.
    - Drop unneeded symlink creation.

 -- Vincent Blut <email address hidden> Wed, 22 Nov 2023 22:20:11 +0100

chrony (4.4-3) unstable; urgency=medium

  * Rely solely on dh_installsystemd to install the systemd units in the
    correct location. (Closes: #1054222)

 -- Vincent Blut <email address hidden> Thu, 19 Oct 2023 23:47:52 +0200

chrony (4.4-2) unstable; urgency=medium

  * debian/control:
    - Add version constraint on adduser. (Closes: #1051822)

  * debian/.gitlab-ci.yml:
    - Run CI on unstable.

 -- Vincent Blut <email address hidden> Thu, 14 Sep 2023 20:28:27 +0200

chrony (4.4-1) unstable; urgency=medium

  * Import upstream version 4.4:
    - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.

  * debian/:
    - Update links to point to new chrony location.

  * debian/copyright:
    - Update copyright years.

  * debian/install:
    - Install the chronyd-restricted systemd unit.

  * debian/patches/:
    - Add debianize-chronyd-restricted-unit-file.patch.

  * debian/rules:
    - Do not enable nor start chronyd-restricted.service.

 -- Vincent Blut <email address hidden> Wed, 09 Aug 2023 17:50:42 +0200

chrony (4.4~pre2-1) experimental; urgency=medium

  * Import upstream version 4.4-pre2:
    - Please see /usr/share/doc/chrony/NEWS.gz for the release notes.

  * debian/tests/upstream-simulation-test-suite:
    - Update clknetsim version.
    - Update clknetsim seed. This prevents the '148-replacement' test from
    failing.

### Old Ubuntu Delta ###

chrony (4.5-1ubuntu4) noble; urgency=medium

  * d/usr.sbin.chronyd: Fix failure to start timemaster due to lack
    of rw permissions on chrony socket.
    (LP: #2032805)
  * d/usr.sbin.chronyd: Allow the default UNIX domain socket address
    to be used by the reflock_sock service in the Apport configuration.
    (ref LP #2032805)

 -- Bryce Harrington <email address hidden> Mon, 01 Apr 2024 18:28:32 -0700

chrony (4.5-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <email address hidden> Mon, 01 Apr 2024 16:38:10 +1100

chrony (4.5-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libgnutls30t64

 -- Steve Langasek <email address hidden> Sun, 10 Mar 2024 02:02:48 +0000

chrony (4.5-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040371). Remaining changes:
    - d/chrony.conf: Use ubuntu ntp pool and server.
      (LP #1744664, #1754358)
    - Set -x as default if unable to set time (e.g. in containers) (LP #1589780)
      Chrony is a single service which acts as both NTP client (i.e. syncing the
      local clock) and NTP server (i.e. providing NTP services to the network),
      and that is both desired and expected in the vast majority of cases.
      But in containers syncing the local clock is usually impossible, but this
      shall not break the providing of NTP services to the network.
      To some extent this makes chrony's default config more similar to 'ntpd',
      which complained in syslog but still provided NTP server service in those
      cases.
      + debian/chrony.service: allow the service to run without CAP_SYS_TIME
      + d/control: add new dependency libcap2-bin for capsh (usually
        installed anyway, but make them explicit to be sure).
      + d/chrony.default: new option SYNC_IN_CONTAINER to not fall
        back (Default off)
      + d/chronyd-starter.sh: wrapper to handle special cases in
        containers and if CAP_SYS_TIME is missing. Effectively allows
        running the NTP server in containers on a default installation
        and avoid failing to sync time (or if allowed to sync, avoid
        multiple containers fighting over it by accident).
      + d/install: Make chrony-starter.sh available on install.
      + d/docs, d/README.container: Provide documentation about the
        handling of this case.
  * Dropped:
    - Depend on tzdata-legacy for reading leapsectz from
      /usr/share/zoneinfo/right/UTC
      (LP #2008076)
  * d/rules, d/chrony.examples: Ship restricted service as an example
    not installed to the system for use. (See LP #2051028)

 -- Bryce Harrington <email address hidden> Tue, 02 Jan 2024 00:45:01 -0800