Merge postgresql-14 from Debian unstable for kinetic

[Bryce Harrington]

Upstream: 14.3
Debian: 14.3-1
Ubuntu: 14.2-1ubuntu2

Debian typically updates postgresql-14 every 1 months on average, but it was last updated 22.02 and looks overdue. Check back in on this monthly.

### New Debian Changes ###

postgresql-14 (14.2-1) unstable; urgency=medium

  * New upstream release.

 -- Christoph Berg <email address hidden> Wed, 09 Feb 2022 10:39:43 +0100

postgresql-14 (14.1-5) unstable; urgency=medium

  * Provide postgresql-14-jit-llvm (= ${llvm:Version}) so extensions can
    depend on a matching llvm version.

 -- Christoph Berg <email address hidden> Mon, 03 Jan 2022 16:08:18 +0100

postgresql-14 (14.1-4) unstable; urgency=medium

  [ Christoph Berg ]
  * Disable LLVM JIT on s390x for now. (See #1002029)

  [ Christian Ehrhardt ]
  * postgresql-common/server/postgresql.mk: avoid gcc 11 ICE on armhf and
    armel.

 -- Christoph Berg <email address hidden> Mon, 20 Dec 2021 18:21:21 +0100

postgresql-14 (14.1-3) unstable; urgency=medium

  * Use system default clang/llvm version. (Closes: #1000915)
  * Use centralized debian/rules logic in postgresql-common.

 -- Christoph Berg <email address hidden> Fri, 03 Dec 2021 09:56:49 +0100

postgresql-14 (14.1-2) unstable; urgency=medium

  * Enable outline-atomics on arm64 (affects Ubuntu focal only).

 -- Christoph Berg <email address hidden> Tue, 16 Nov 2021 11:56:37 +0100

postgresql-14 (14.1-1) unstable; urgency=medium

  * New upstream release.

    + Make the server and libpq reject extraneous data after an SSL or GSS
      encryption handshake (Tom Lane)

      A man-in-the-middle with the ability to inject data into the TCP
      connection could stuff some cleartext data into the start of a
      supposedly encryption-protected database session.

      This could be abused to send faked SQL commands to the server, although
      that would only work if the server did not demand any authentication
      data. (However, a server relying on SSL certificate authentication
      might well not do so.) (CVE-2021-23214)

      This could probably be abused to inject faked responses to the client's
      first few queries, although other details of libpq's behavior make that
      harder than it sounds. A different line of attack is to exfiltrate the
      client's password, or other sensitive data that might be sent early in
      the session. That has been shown to be possible with a server
      vulnerable to CVE-2021-23214. (CVE-2021-23222)

      The PostgreSQL Project thanks Jacob Champion for reporting these
      problems.

  * libpq-dev: Depend on libssl-dev, `pkg-config --exists libpq` requires it.

 -- Christoph Berg <email address hidden> Fri, 05 Nov 2021 12:05:46 +0100

postgresql-14 (14.0-1) unstable; urgency=medium

  * First PG14 release.
  * Depend on postgresql-common 229 for scram-sha-256 authentication by
    default.

 -- Christoph Berg <email address hidden> Tue, 28 Sep 2021 13:56:00 +0200

postgresql-14 (14~rc1-1) experimental; urgency=medium

  * First PG14 release candidate.
  * Enable spinlocks on riscv64.
  * Fix awk to be mawk, spotted by Yangfl. (Closes: #987786)
  * configure.ac: Remove check for autoconf 2.69.
  * Spanish debconf translation by Jonathan Bustillos, thanks!
    (Closes: #986775)
  * Flatten debian/*.lintian-overrides symlinks.

 -- Christoph Berg <email address hidden> Thu, 23 Sep 2021 12:39:42 +0200

postgresql-14 (14~beta3-1) experimental; urgency=medium

  * New beta version.
  * libpq5.symbols: Add PQsendFlushRequest.

 -- Christoph Berg <email address hidden> Tue, 10 Aug 2021 13:11:12 +0200

postgresql-14 (14~beta2-1) experimental; urgency=medium

  * New beta version.
  * libpq5.symbols: Add PQmblenBounded, PQsetTraceFlags, remove PQtraceSetFlags.
  * debian/tests/installcheck: Use --make-testtablespace-dir.

### Old Ubuntu Delta ###

postgresql-14 (14.2-1ubuntu1) jammy; urgency=medium

  * d/p/llvm14-support.patch: fix FTBFS with llvm-14 (LP: #1966319)

 -- Andreas Hasenack <email address hidden> Fri, 25 Mar 2022 11:34:41 -0300

[Athos Ribeiro (athos-ribeiro)]

The only change in the current delta is
debian/patches/llvm14-support.patch,
which is included in the new release (14.3) and is available in the new Debian package
(https://github.com/postgres/postgres/commit/d9f7ad54e552262ee0090e88d5abd3e04fcdeac8)

Therefore, this can be a sync.

[Athos Ribeiro (athos-ribeiro)]

This bug was fixed in the package postgresql-14 - 14.3-1

---------------
postgresql-14 (14.3-1) unstable; urgency=medium

  * New upstream release.

    * Confine additional operations within security restricted operation
      sandboxes (Sergey Shinderuk, Noah Misch)

      Autovacuum, CLUSTER, CREATE INDEX, REINDEX, REFRESH MATERIALIZED VIEW,
      and pg_amcheck activated the security restricted operation protection
      mechanism too late, or even not at all in some code paths. A user having
      permission to create non-temporary objects within a database could
      define an object that would execute arbitrary SQL code with superuser
      permissions the next time that autovacuum processed the object, or that
      some superuser ran one of the affected commands against it.

      The PostgreSQL Project thanks Alexander Lakhin for reporting this
      problem. (CVE-2022-1552)

    * Fix default signature length for gist_ltree_ops indexes
      (Tomas Vondra, Alexander Korotkov)

      The default signature length (hash size) for GiST indexes on ltree
      columns was accidentally changed while upgrading that operator class to
      support operator class parameters. If any operations had been done on
      such an index without first upgrading the ltree extension to version
      1.2, they were done assuming that the signature length was 28 bytes
      rather than the intended 8. This means it is very likely that such
      indexes are now corrupt. For safety we recommend re-indexing all GiST
      indexes on ltree columns after installing this update. (Note that GiST
      indexes on ltree[] columns, that is arrays of ltree, are not affected.)

 -- Christoph Berg <email address hidden> Tue, 10 May 2022 10:34:28 +0200

[Athos Ribeiro (athos-ribeiro)]

Sync'd. Setting to fix committed since this will hang in proposed until
LP: #1973382 is fixed for postgresql-common.

Do note that we may want to sync/merge again in august (14.4), as per https://www.postgresql.org/developer/roadmap/. We should also keep an eye for the new postgresql 15 release, which may be out in the 3rd quarter.