This package has a rather strange relation to upstream:

* Upstreams and debian goals differ in some aspects too much to build
  the package on upstream versions as in a normal package.

* Because of this the version numbers of the debian package are just
  clues of the aequivalent upstream version. Sometimes in a source file
  the last incorporated upstream version may be given.

* Also the package is treated as a native debian package.



Speaking about source, we consider http://netpbm.alioth.debian.org/ the
technical upstream, and this release can be exported out of alioth by
  cvs -z3 -d:pserver:anonymous@cvs.alioth.debian.org:/cvsroot/netpbm export \
  -r debian-9-25-8 netpbm

On alioth the source of Debian's netpbm-free 9.20-10 was imported and then
updated. netpbm-free 9.20-10 is successor of the first debian packages by
Steve, source-equivalent to the version in woody r2, and the last with
another technical upstream. This upstream was
http://netpbm.sourceforge.net/ and the source file could have been
downloaded from http://download.sourceforge.net/netpbm/netpbm-9.20.tgz

Packaging was not a simple job, as the licensing is complicated upstream.
The upstream source is split into two to allow Debian packaging - some of
it is free and some goes into non-free. Some of the upstream source files
cannot be redistributed at all, as there is no license associated with
them. These cases are tried to be handled on a case-by-case basis.
In creating the Debian "upstream" source packages, Steve has removed the
references to the non-free and non-distributable files.

This package was debianised by Steve McIntyre
<stevem@chiark.greenend.org.uk>, finishing on Sun 7th October 2001.
The maintainership was transfered in August 2003 to Andreas Barth
<aba@not.so.argh.org>, first as cooperative maintainership and
sponsored by Steve.

The last package used for updating the cvs-version can be downloaded from
http://download.sourceforge.net/netpbm/netpbm-9.25.tgz



Relating security:

In README.Security the incorporated advisories are given; however, this
list is only complete for advisories starting in August 2003.



Andreas Barth <aba@not.so.argh.org>
