19 files changed, 535 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..8d0d527
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,196 @@
+wallet (1.0-1) unstable; urgency=low
+
+  * New upstream release.
+    - New wallet-admin upgrade command to upgrade the schema to the latest
+      version.  This should be run manually after upgrading the server.
+    - Owners of wallet objects are now allowed to destroy them by default.
+    - New ACL type ldap-attr to check whether the caller has an attribute
+      in an LDAP directory (needs libauthen-sasl-perl and libnet-ldap-perl
+      and only works with GSS-API binds).
+    - New object type wa-keyring to store WebAuth keyrings (needs
+      libwebauth-perl).
+    - New acl check command that returns whether the named ACL exists.
+    - New comments field for objects and wallet commands to set and
+      retrieve it.
+  * Switch to xz compression for the upstream and Debian tarballs and
+    binary packages.
+  * Update debhelper compatibility level to V9.
+    - Enable all hardening build flags.
+    - Enable parallel builds.
+  * Check for any files left uninstalled by dh_install.
+  * Tag all packages as Multi-Arch: foreign.
+  * Move single-debian-patch to local-options and patch-header to
+    local-patch-header so that they only apply to the packages I build and
+    NMUs get regular version-numbered patches.
+  * Convert debian/copyright to copyright-format 1.0.
+  * Update standards version to 3.9.4.
+    - Indicate the Debian packaging branch in the Vcs-Git header.
+
+ -- Russ Allbery <rra@debian.org>  Wed, 27 Mar 2013 19:07:36 -0700
+
+wallet (0.12-1) unstable; urgency=low
+
+  * New upstream release.
+    - New wallet-rekey client program to rekey a keytab.
+    - New ACL type krb5-regex for the server.
+    - New objects unused wallet-report report.
+    - New acls duplicate wallet-report report.
+    - Add a help command to wallet-report.
+  * Don't install wallet-summary in /usr/sbin in the wallet-server package
+    and instead install it in /usr/share/doc/wallet-server/examples.  This
+    program is Stanford-specific and would require extensive changes for
+    other sites.
+  * Install the other contrib scripts except convert-srvtab-db to the
+    examples directory for wallet-server.
+  * Switch to 3.0 (quilt) source format.  Force a single Debian patch and
+    include a custom patch header explaining that it is a rollup of any
+    fixes cherry-picked from upstream and breaking those patches out
+    separately would be work for no gain.
+  * Update standards version to 3.9.1 (no changes required).
+
+ -- Russ Allbery <rra@debian.org>  Wed, 25 Aug 2010 18:49:48 -0700
+
+wallet (0.11-1) unstable; urgency=low
+
+  * New upstream release.
+    - Verify that deleted ACLs are not referenced.
+    - Add Wallet::Config verify_acl_name function to check ACL names.
+    - Add audit command to wallet-report to check for naming violations.
+    - Add acl unused report to wallet-report.
+
+ -- Russ Allbery <rra@debian.org>  Mon, 08 Mar 2010 10:59:00 -0800
+
+wallet (0.10-1) unstable; urgency=low
+
+  * New upstream release.
+    - Add support for Heimdal KDCs as well as MIT Kerberos KDCs.  New
+      mandatory configuration setting KEYTAB_KRBTYPE which must be set to
+      either MIT or Heimdal.
+    - Remove kaserver synchronization support and kasetkey.
+    - wallet -S now generates a srvtab based on the DES key of the keytab
+      and does not enable synchronization.  No synchronization targets are
+      supported now.
+    - The wallet client and wallet-backend server can now handle store of
+      files containing nuls provided that the server uses remctl 2.14 and
+      the remctl configuration is updated to use stdin=last.
+    - Correctly store data that begins with a dash.
+    - Do not log the data passed to store.
+    - New wallet-report script and multiple additional database reports.
+    - Report ACL names as well as numbers in object history.
+  * Update debhelper compatibility level to V7.
+    - Use debhelper rule minimization with overrides.
+    - Add ${misc:Depends} to dependencies.
+  * Clarify in long description that keytab-backend is only needed for MIT
+    Kerberos.
+  * Move wallet-server's dependency on krb5-user to Recommends, since it's
+    only needed for keytab support, and allow libheimdal-kadm5-perl as an
+    alternative.
+  * Recommend remctl-server 2.14 or later for improved store support.
+  * Add Homepage, Vcs-Git, and Vcs-Browser control fields.
+  * Add a watch file.
+  * Update standards version to 3.8.4 (no changes required).
+
+ -- Russ Allbery <rra@debian.org>  Sun, 21 Feb 2010 21:13:40 -0800
+
+wallet (0.9-1) unstable; urgency=low
+
+  * New upstream release.
+    - The wallet client now supports -f and stdin for store.
+    - kasetkey supports enable, disable, and examine.
+    - Stop setting Stanford-specific server defaults.
+  * The test suite no longer needs libio-string-perl.
+  * Use a separate stamp file for configure and install and use touch $@
+    to create stamp files.
+  * Update debhelper compatibility level to V5 (no changes required).
+
+ -- Russ Allbery <rra@debian.org>  Thu, 24 Apr 2008 16:09:19 -0700
+
+wallet (0.8-1) unstable; urgency=low
+
+  * New upstream version.
+    - Fix protocol mismatch between client and server.
+    - Add file object support to the wallet server.
+    - Correctly handle empty objects in the wallet client.
+    - Add -q flag to wallet-backend to suppress syslog logging.
+    - Add class registration to the wallet-admin utility.
+    - Updated design documentation.
+
+ -- Russ Allbery <rra@debian.org>  Wed, 13 Feb 2008 13:59:06 -0800
+
+wallet (0.7-1) unstable; urgency=low
+
+  * New upstream version.
+    - Add exists and autocreate wallet server interfaces.
+    - Implement autocreation on the client instead of the server.
+    - Make create once again an ADMIN-only function.
+    - Always generate the srvtab from the newly downloaded keys.
+    - Pass kadmin.local ktadd its options in the correct order.
+    - Check naming policy before checking default ACLs.
+    - Work around a bug in Net::Remctl with explicit undef arguments.
+    - Correctly enable syslog logging in wallet-backend.
+    - Fix the remctl configuration for keytab-backend.
+  * Create /var/lib/keytabs in the keytab-backend package.
+
+ -- Russ Allbery <rra@debian.org>  Fri, 08 Feb 2008 11:22:54 -0800
+
+wallet (0.6-1) unstable; urgency=low
+
+  * New upstream version.
+    - Safer handling of file creation with -f in the client.
+    - The client can get configuration from krb5.conf.
+    - Support get in the client without -f.
+    - Client support for merging keys into an existing keytab.
+    - New client -u option to obtain new Kerberos credentials.
+    - New wallet-admin command-line utility for the server.
+    - The server supports enforcing a local object naming policy.
+    - New wallet-report script (currently Stanford-specific).
+  * Change hard-coded wallet server to wallet.stanford.edu.
+  * Add --enable-reduced-depends to configure to eliminate unnecessary
+    shared library dependencies.
+
+ -- Russ Allbery <rra@debian.org>  Mon, 28 Jan 2008 15:17:25 -0800
+
+wallet (0.5-2) unstable; urgency=low
+
+  * Hard-code lsdb-new.stanford.edu as the wallet server name for the time
+    being.
+
+ -- Russ Allbery <rra@debian.org>  Mon, 17 Dec 2007 21:17:08 -0800
+
+wallet (0.5-1) unstable; urgency=low
+
+  * New upstream release.
+    - Allow more valid arguments to wallet-backend.
+    - Load Perl modules for object types and ACL verifiers properly.
+    - Correctly implement clearing attribute values.
+    - Fix keytab principal validation to allow periods.
+    - When writing files from the client, remove old backup files.
+    - Check default creation ACLs before the ADMIN ACL.
+
+ -- Russ Allbery <rra@debian.org>  Thu, 06 Dec 2007 22:26:55 -0800
+
+wallet (0.4-1) unstable; urgency=low
+
+  * New upstream release.
+    - Globally cache ACL verifiers.
+    - Add the netdb-root ACL verifier, which requires root instances.
+    - Determine object and ACL scheme classes from the database.
+    - Coding style fixes and cleanup.
+  * Update debian/copyright using the information from LICENSE.
+  * Update standards version to 3.7.3 (no changes required).
+
+ -- Russ Allbery <rra@debian.org>  Wed, 05 Dec 2007 17:01:20 -0800
+
+wallet (0.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * Initial packaging of all components of wallet.
+
+ -- Russ Allbery <rra@debian.org>  Fri, 30 Nov 2007 20:30:30 -0800
+
+wallet (0.1-1) unstable; urgency=low
+
+  * Initial release building only kasetkey.
+
+ -- Russ Allbery <rra@debian.org>  Thu,  8 Mar 2007 16:07:05 -0800
+
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 0000000..ec63514
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1 @@
+9
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..6da5d89
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,66 @@
+Source: wallet
+Section: net
+Priority: extra
+Maintainer: Russ Allbery <rra@debian.org>
+Build-Depends: debhelper (>= 9), libdatetime-format-sqlite-perl,
+ libdbd-sqlite3-perl, libdbi-perl, libdbix-class-perl, libkrb5-dev,
+ libremctl-dev, libsql-translator-perl, libtest-pod-perl, libwebauth-perl,
+ perl
+Standards-Version: 3.9.4
+Homepage: http://www.eyrie.org/~eagle/software/wallet/
+Vcs-Git: git://git.eyrie.org/kerberos/wallet.git -b debian
+Vcs-Browser: http://git.eyrie.org/?p=kerberos/wallet.git
+
+Package: keytab-backend
+Architecture: all
+Multi-Arch: foreign
+Depends: ${misc:Depends}, ${perl:Depends}, krb5-admin-server, perl,
+ remctl-server
+Description: Provide existing MIT Kerberos keytabs via remctl
+ keytab-backend is a service that runs under remctld and allows
+ authenticated clients to download Kerberos keytabs from an MIT Kerberos
+ KDC without changing the key stored in the Kerberos KDC.  It must run on
+ the same host as the Kerberos KDC and uses kadmin.local to extract the
+ existing key.  It applies additional ACLs to limit which keys may be
+ extracted in this way.  This interface is not needed for Heimdal.
+
+Package: wallet-client
+Architecture: any
+Multi-Arch: foreign
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Kerberos-authenticated secure data management client
+ The wallet is a system for managing secure data, authorization rules to
+ retrieve or change that data, and audit rules for documenting actions
+ taken on that data.  Objects of various types may be stored in the
+ wallet or generated on request and retrieved by authorized users.  The
+ wallet tracks ACLs, metadata, and trace information.  It uses Kerberos
+ authentication.  One of the object types it supports is Kerberos keytabs,
+ making it suitable as a user-accessible front-end to Kerberos kadmind
+ with richer ACL and metadata operations.
+ .
+ This package contains the wallet client, which talks to a remote wallet
+ server to store, download, and manage objects.
+
+Package: wallet-server
+Architecture: all
+Multi-Arch: foreign
+Depends: ${misc:Depends}, ${perl:Depends},
+ libdbd-sqlite3-perl | libdbd-mysql-perl | libdbd-pg-perl,
+ libdbix-class-perl, libsql-translator-perl, remctl-server
+Recommends: libdatetime-format-sqlite-perl,
+ krb5-user | libheimdal-kadm5-perl, remctl-server (>= 2.14)
+Suggests: libauthen-sasl-perl, libnet-ldap-perl, libnet-remctl-perl,
+ libwebauth-perl (>= 4.4.0)
+Description: Kerberos-authenticated secure data management server
+ The wallet is a system for managing secure data, authorization rules to
+ retrieve or change that data, and audit rules for documenting actions
+ taken on that data.  Objects of various types may be stored in the
+ wallet or generated on request and retrieved by authorized users.  The
+ wallet tracks ACLs, metadata, and trace information.  It uses Kerberos
+ authentication.  One of the object types it supports is Kerberos keytabs,
+ making it suitable as a user-accessible front-end to Kerberos kadmind
+ with richer ACL and metadata operations.
+ .
+ This package contains the wallet server, which runs under remctl,
+ maintains the database of object metadata and secure objects, and
+ responds to requests from the wallet client.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..ff7b975
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,177 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Contact: Russ Allbery <rra@stanford.edu>
+Source: http://www.eyrie.org/~eagle/software/wallet/
+Copyright: 2006-2010, 2012-2013
+    The Board of Trustees of the Leland Stanford Junior University
+License: Expat
+
+Files: *
+Copyright: 2000-2002, 2004-2012 Russ Allbery <rra@stanford.edu>
+  2001-2013 The Board of Trustees of the Leland Stanford Junior University
+License: Expat
+
+Files: Makefile.in
+Copyright: 1994-2011 Free Software Foundation, Inc.
+  2006-2008, 2010, 2013
+    The Board of Trustees of the Leland Stanford Junior University
+License: FSF-unlimited and Expat
+
+Files: aclocal.m4
+Copyright: 1996-2012 Free Software Foundation, Inc.
+License: FSF-unlimited
+
+Files: build-aux/compile build-aux/depcomp build-aux/missing
+Copyright: 1996-1997, 1999-2000, 2002-2012 Free Software Foundation, Inc.
+License: GPL-2+ with Autoconf exception or Expat
+
+Files: build-aux/install-sh
+Copyright: 1994 X Consortium
+License: X11
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of this software and associated documentation files (the
+ "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish,
+ distribute, sublicense, and/or sell copies of the Software, and to permit
+ persons to whom the Software is furnished to do so, subject to the
+ following conditions:
+ .
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ OTHER DEALINGS IN THE SOFTWARE.
+ .
+ Except as contained in this notice, the name of the X Consortium shall
+ not be used in advertising or otherwise to promote the sale, use or other
+ dealings in this Software without prior written authorization from the X
+ Consortium.
+
+Files: client/wallet-rekey.1 client/wallet-rekey.pod client/wallet.1
+ client/wallet.pod docs/design docs/design-acl docs/design-api
+ docs/netdb-role-api docs/notes docs/objects-and-schemes docs/setup
+ docs/stanford-naming perl/t/data/README tests/HOWTO tests/config/README
+Copyright: 2006-2013
+    The Board of Trustees of the Leland Stanford Junior University
+  2010 Russ Allbery <rra@stanford.edu>
+License: all-permissive
+ Copying and distribution of this file, with or without modification, are
+ permitted in any medium without royalty provided the copyright notice and
+ this notice are preserved.  This file is offered as-is, without any
+ warranty.
+
+Files: configure
+Copyright: 1992-1996, 1998-2012 Free Software Foundation, Inc.
+License: FSF-configure
+ This script is free software; the Free Software Foundation gives unlimited
+ permission to copy, distribute and modify it.
+
+Files: m4/gssapi.m4 m4/krb5-config.m4 m4/krb5.m4 m4/lib-depends.m4
+ m4/lib-pathname.m4 m4/remctl.m4 m4/snprintf.m4 m4/vamacros.m4
+Copyright: 2005-2012
+    The Board of Trustees of the Leland Stanford Junior University
+License: unlimited
+ This file is free software; the authors give unlimited permission to copy
+ and/or distribute it, with or without modifications, as long as this
+ notice is preserved.
+
+Files: portable/asprintf.c portable/dummy.c portable/krb5-extra.c
+ portable/krb5.h portable/macros.h portable/mkstemp.c portable/setenv.c
+ portable/stdbool.h portable/strlcat.c portable/strlcpy.c portable/system.h
+ portable/uio.h tests/portable/asprintf-t.c tests/portable/mkstemp-t.c
+ tests/portable/setenv-t.c tests/portable/strlcat-t.c
+ tests/portable/strlcpy-t.c util/macros.h
+Copyright: no copyright notice, see License
+License: rra-public-domain
+ The authors hereby relinquish any claim to any copyright that they may
+ have in this work, whether granted under contract or by operation of law
+ or international treaty, and hereby commit to the public, at large, that
+ they shall not, at any time in the future, seek to enforce any copyright
+ in this work against any person or entity, or prevent any person or
+ entity from copying, publishing, distributing or creating derivative
+ works of this work.
+
+Files: portable/snprintf.c tests/portable/snprintf-t.c
+Copyright: 1995 Patrick Powell
+  2000-2006 Russ Allbery <rra@stanford.edu>
+  2001 Hrvoje Niksic
+  2009-2010 The Board of Trustees of the Leland Stanford Junior University
+License: Powell-snprintf
+ This code is based on code written by Patrick Powell (papowell@astart.com)
+ It may be used for any purpose as long as this notice remains intact
+ on all source code distributions
+
+Files: util/messages.c util/messages.h util/xmalloc.c util/xmalloc.h
+Copyright: 1991, 1994-2003 The Internet Software Consortium and Rich Salz
+  2004-2006 Internet Systems Consortium, Inc.
+  2008-2010, 2012
+    The Board of Trustees of the Leland Stanford Junior University
+License: ISC
+ Permission to use, copy, modify, and distribute this software for any
+ purpose with or without fee is hereby granted, provided that the above
+ copyright notice and this permission notice appear in all copies.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY
+ SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+License: Expat
+ Permission is hereby granted, free of charge, to any person obtaining a
+ copy of this software and associated documentation files (the
+ "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish,
+ distribute, sublicense, and/or sell copies of the Software, and to permit
+ persons to whom the Software is furnished to do so, subject to the
+ following conditions:
+ .
+ The above copyright notice and this permission notice shall be included
+ in all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT
+ OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
+ THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+License: FSF-unlimited
+ This file is free software; the Free Software Foundation gives unlimited
+ permission to copy and/or distribute it, with or without modifications, as
+ long as this notice is preserved.
+ .
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
+ implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+
+License: GPL-2+ with Autoconf exception
+ This file is free software; you can redistribute it and/or modify it
+ under the terms of the GNU General Public License as published by the
+ Free Software Foundation; either version 2 of the License, or (at your
+ option) any later version.
+ .
+ This program is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General
+ Public License for more details.
+ .
+ You should have received a copy of the GNU General Public License along
+ with this program.  If not, see <http://www.gnu.org/licenses/>.
+ .
+ As a special exception to the GNU General Public License, if you
+ distribute this file as part of a program that contains a configuration
+ script generated by Autoconf, you may include it under the same
+ distribution terms that you use for the rest of that program.
+Comment: The option described in the license has been accepted and these
+ files are distributed under the same terms as the package as a whole, as
+ described at the top of this file.  You can find the GPL version 2 in
+ /usr/share/common-licenses/GPL-2 on Debian systems.
+
diff --git a/debian/keytab-backend.dirs b/debian/keytab-backend.dirs
new file mode 100644
index 0000000..c601e1a
--- /dev/null
+++ b/debian/keytab-backend.dirs
@@ -0,0 +1,2 @@
+/etc/remctl/acl
+/var/lib/keytabs
diff --git a/debian/keytab-backend.docs b/debian/keytab-backend.docs
new file mode 100644
index 0000000..724e084
--- /dev/null
+++ b/debian/keytab-backend.docs
@@ -0,0 +1,2 @@
+README
+TODO
diff --git a/debian/keytab-backend.install b/debian/keytab-backend.install
new file mode 100644
index 0000000..666b71c
--- /dev/null
+++ b/debian/keytab-backend.install
@@ -0,0 +1,6 @@
+debian/tmp/etc/remctl/acl/keytab
+debian/tmp/usr/sbin/keytab-backend
+debian/tmp/usr/share/man/man8/keytab-backend.8
+
+config/allow-extract            etc/krb5kdc
+config/keytab                   etc/remctl/conf.d
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..9df5a93
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,33 @@
+#!/usr/bin/make -f
+
+# Add hardening build flags.
+export DEB_BUILD_MAINT_OPTIONS = hardening=+bindnow,+pie
+
+%:
+	dh $@ --parallel
+
+override_dh_auto_configure:
+	dh_auto_configure --parallel -- --enable-reduced-depends
+
+# We rebuild the perl directory Makefile to encode the correct installation
+# paths, since otherwise it defaults to using the local site module path.
+override_dh_auto_install:
+	cd perl && perl Makefile.PL INSTALLDIRS=vendor
+	dh_auto_install
+	install -d debian/tmp/etc/remctl/acl
+	install -m 0644 config/keytab.acl debian/tmp/etc/remctl/acl/keytab
+	install -m 0644 config/wallet-report.acl \
+	    debian/tmp/etc/remctl/acl/wallet-report
+
+# Override install to check for missing installed files.
+override_dh_install:
+	dh_install --fail-missing
+
+override_dh_installchangelogs:
+	dh_installchangelogs NEWS
+
+override_dh_compress:
+	dh_compress -X examples
+
+override_dh_builddeb:
+	dh_builddeb -- -Zxz
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..163aaf8
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/debian/source/local-options b/debian/source/local-options
new file mode 100644
index 0000000..7423a2d
--- /dev/null
+++ b/debian/source/local-options
@@ -0,0 +1 @@
+single-debian-patch
diff --git a/debian/source/local-patch-header b/debian/source/local-patch-header
new file mode 100644
index 0000000..7aa2307
--- /dev/null
+++ b/debian/source/local-patch-header
@@ -0,0 +1,16 @@
+Subject: Collected Debian patches for wallet
+Author: Russ Allbery <rra@debian.org>
+
+Since I am also upstream for this package, there will normally not be any
+patches to apply to the upstream source.  However, occasionally I'll pull
+up specific upstream commits prior to making an upstream release.  When
+this happens, this patch will collect all of those modifications.
+
+I use Git to maintain both the upstream source and the Debian packages,
+and generating individual patches rather than using git cherry-pick takes
+extra work for no gain.  Since I'm also upstream, there's no need to
+separate the patches for later upstream submission.  Hence, I take this
+approach with a unified patch when it's necessary.
+
+For full commit history and separated commits, see the upstream Git
+repsitory.
diff --git a/debian/source/options b/debian/source/options
new file mode 100644
index 0000000..b7bc1f2
--- /dev/null
+++ b/debian/source/options
@@ -0,0 +1 @@
+compression = "xz"
diff --git a/debian/wallet-client.docs b/debian/wallet-client.docs
new file mode 100644
index 0000000..724e084
--- /dev/null
+++ b/debian/wallet-client.docs
@@ -0,0 +1,2 @@
+README
+TODO
diff --git a/debian/wallet-client.install b/debian/wallet-client.install
new file mode 100644
index 0000000..2940357
--- /dev/null
+++ b/debian/wallet-client.install
@@ -0,0 +1,4 @@
+debian/tmp/usr/bin/wallet
+debian/tmp/usr/bin/wallet-rekey
+debian/tmp/usr/share/man/man1/wallet.1
+debian/tmp/usr/share/man/man1/wallet-rekey.1
diff --git a/debian/wallet-server.dirs b/debian/wallet-server.dirs
new file mode 100644
index 0000000..0e856f2
--- /dev/null
+++ b/debian/wallet-server.dirs
@@ -0,0 +1 @@
+/etc/wallet
diff --git a/debian/wallet-server.docs b/debian/wallet-server.docs
new file mode 100644
index 0000000..ceecb82
--- /dev/null
+++ b/debian/wallet-server.docs
@@ -0,0 +1,8 @@
+README
+TODO
+docs/design
+docs/design-acl
+docs/design-api
+docs/netdb-role-api
+docs/notes
+docs/setup
diff --git a/debian/wallet-server.examples b/debian/wallet-server.examples
new file mode 100644
index 0000000..bb13c59
--- /dev/null
+++ b/debian/wallet-server.examples
@@ -0,0 +1,4 @@
+contrib/used-principals
+contrib/wallet-contacts
+contrib/wallet-summary
+contrib/wallet-unknown-hosts
diff --git a/debian/wallet-server.install b/debian/wallet-server.install
new file mode 100644
index 0000000..dfc1d6e
--- /dev/null
+++ b/debian/wallet-server.install
@@ -0,0 +1,12 @@
+debian/tmp/etc/remctl/acl/wallet-report
+debian/tmp/usr/sbin/wallet-admin
+debian/tmp/usr/sbin/wallet-backend
+debian/tmp/usr/sbin/wallet-report
+debian/tmp/usr/share/man/man3/*.3pm
+debian/tmp/usr/share/man/man8/wallet-admin.8
+debian/tmp/usr/share/man/man8/wallet-backend.8
+debian/tmp/usr/share/man/man8/wallet-report.8
+debian/tmp/usr/share/perl5
+debian/tmp/usr/share/wallet
+
+config/wallet                   etc/remctl/conf.d
diff --git a/debian/watch b/debian/watch
new file mode 100644
index 0000000..95945db
--- /dev/null
+++ b/debian/watch
@@ -0,0 +1,2 @@
+version=3
+http://archives.eyrie.org/software/kerberos/wallet-(.*)\.tar\.gz