* Bump epoch to supersede the vendor package in the ELS channel
(matches the ubuntu16/ubuntu18 ELS branches).
* Add gpg to Build-Depends: the build-time test suite
(uaclient/tests/test_gpg.py) invokes the gpg binary, which is not
present in the minimal ELS build chroot.
* Add debian/mark_skip_pytests.sh and invoke it from debian/rules:
on FIPS-capable build hosts running in a disabled state, some
status/FIPS pytests fail at build time; skip only those, only in
that environment (matches the ubuntu16/ubuntu18 ELS branches).
* Skip tools/check-versions-are-consistent.py in override_dh_auto_build:
its regex does not handle a package epoch and misparses our
1:34~20.04+tuxcare.elsN version, aborting the build; version.py
already matches the shipped upstream version (34).
* SECURITY UPDATE: Pro bearer token exposed via apt-helper command line
- Write APT credentials to a temporary 0600 auth file and pass a
credential-free URL to apt-helper, instead of embedding the token in
the download-file URL argument where it leaked to local users via
/proc/
/cmdline. Source tarball re-packed with the fix (3.0 native).
- cve-2026-9494
* SECURITY UPDATE: APT source injection via crafted contract-server response
- validate contract directives (aptURL, suites, additionalPackages) to
reject newline/CR/NUL/space characters, preventing injection of
attacker-controlled lines into root-owned apt sources and the apt-get
install invocation. Source tarball re-packed with the fix (3.0 native).
- cve-2026-11386
* SECURITY UPDATE: symlink file disclosure in "pro collect-logs"
- Skip symlinked user log files and create the diagnostic archive
exclusively (x:gz) with a root-only umask so an existing output file or
symlink is not followed or overwritten. Source tarball re-packed with
the fix (3.0 native).
- cve-2026-12391