File	SHA-256
`libsrs2_1.0.18.orig.tar.gz`	`68d534105c4b0f5956cf4a711f681536d6f721c404726da15664565db0d0b862`
`libsrs2_1.0.18-4.diff.gz`	`055f17c08122c763f5dd015c5aa3e3f8fdd307a2ca5533d5762899bb712acd3b`
`libsrs2_1.0.18-4.dsc`	`d098988df52a92eb362c287a05ad9d748b8e2c896a6800be57b6eda0855504c5`

The old .dsc uses weak historical checksums and cannot normally be signature-verified without its retired Debian archive key. The release job must therefore verify all three SHA-256 values above before extraction.

Patch order

After dpkg-source -x libsrs2_1.0.18-4.dsc, apply only the Debian packaging conversion directly:

patch -d libsrs2-1.0.18 -p1 < patches/0003-debian-trixie.patch
# The historical 1.0 diff only converted win32.h from CRLF to LF. Restore the
# byte-identical upstream file so it is not an untracked 3.0 (quilt) change.
tar -xOf libsrs2_1.0.18.orig.tar.gz \
    libsrs2-1.0.18.orig/libsrs2/win32.h \
    > libsrs2-1.0.18/libsrs2/win32.h
install -Dm0644 patches/0001-build-modernization.patch \
    libsrs2-1.0.18/debian/patches/0001-build-modernization.patch
install -Dm0644 patches/0002-security-hardening.patch \
    libsrs2-1.0.18/debian/patches/0002-security-hardening.patch

debian/patches/series then applies the source changes in this order:

0001-build-modernization.patch
0002-security-hardening.patch

The first patch includes Gentoo's parallel-build correction. The second is shared with the Gentoo overlay and fixes bounded formatting, allocation and secret cleanup, long-HMAC handling, 64-bit SHA-1 out-of-bounds reads, Unix socket bounds, and daemon I/O. The third converts the archived Debian package from source format 1.0 and CDBS/debhelper 5 to source format 3.0 (quilt), debhelper 13, and proper Multi-Arch paths.

Build and verification

Build both source and binary artifacts on Trixie:

dpkg-buildpackage -us -uc -S
dpkg-buildpackage -us -uc -b

Compile tests/security-regression.c against the newly built library. It checks an RFC 2202 HMAC-SHA1 vector, a long secret, SRS forward/reverse, bounded output, and the allocation API. Release builds must also confirm that Bongo links against these newly built packages.

The release ZIP contains the resulting Trixie binary packages and the full source package (.dsc, upstream tarball, Debian tarball, and source changes file). It must not contain an archived pre-Trixie .deb or the historical Debian .diff.gz.