diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000000000000000000000000000000000000..96f6f824be4d70ed54361ac22ec00daec3c095e7
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,49 @@
+libcacard (1:2.6.1-1) unstable; urgency=medium
+
+ * new upstream release
+ * vscclient is just a test tool, upstream stopped building it
+ by default, so do not create libcacard-tools package anymore
+ * d/source/options: add 2 files present in git but not shipped in the tarball
+ * disable testsuite for now as it needs some love
+ * d/control: update VCS fields
+
+ -- Michael Tokarev <mjt@tls.msk.ru> Wed, 12 Dec 2018 15:44:55 +0300
+
+libcacard (1:2.5.3-1) unstable; urgency=medium
+
+ [ Laurent Bigonville ]
+ * New upstream release (Closes: #822720)
+ - Drop patches applied upstream and refresh the remaining one
+ - debian/libcacard0.symbols: Add new exported symbol
+ * debian/control:
+ - Bump Standards-Version to 4.1.3 (no further changes)
+ - Bump priority to optional, extra is deprecated
+ - Add libpcsclite-dev to the build-dependency to enabled pcsc passthrough
+
+ [ Helmut Grohne ]
+ * Fix FTCBFS: demote libtool-bin build dependency to libtool (Closes: #871679)
+
+ -- Michael Tokarev <mjt@tls.msk.ru> Tue, 10 Apr 2018 09:03:52 +0300
+
+libcacard (1:2.5.0-3) unstable; urgency=high
+
+ * smartcard-fix-memory-leak-in-vcard_apdu_new-CVE-2017-6414.patch
+ Closes: #856501, CVE-2017-6414
+ * dont-fail-if-caller-didn-t-pick-previous-response.patch
+
+ -- Michael Tokarev <mjt@tls.msk.ru> Sat, 04 Mar 2017 11:57:23 +0300
+
+libcacard (1:2.5.0-2) unstable; urgency=medium
+
+ * add remove-requires.private.patch to remove Requires.private
+ from libcacard.pc. We're not building static library so
+ these are not used, but pkg-config wants to see the dependent
+ .pc files. Arguably it is pkg-config bug. (Closes: #804289)
+
+ -- Michael Tokarev <mjt@tls.msk.ru> Sat, 07 Nov 2015 13:03:01 +0300
+
+libcacard (1:2.5.0-1a) unstable; urgency=medium
+
+ * Initial release, source has been split out of qemu
+
+ -- Michael Tokarev <mjt@tls.msk.ru> Fri, 09 Oct 2015 13:58:13 +0300
diff --git a/debian/compat b/debian/compat
new file mode 100644
index 0000000000000000000000000000000000000000..ec635144f60048986bc560c5576355344005e6e7
--- /dev/null
+++ b/debian/compat
@@ -0,0 +1 @@
+9
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000000000000000000000000000000000000..5b8a6784edf4bdbe80c43e877dd461bb72c7b4cf
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,44 @@
+Source: libcacard
+Section: otherosfs
+Priority: optional
+Maintainer: Michael Tokarev <mjt@tls.msk.ru>
+Build-Depends: debhelper (>=9), pkg-config, libtool,
+ libnss3-dev (>=3.12.8~),
+ libglib2.0-dev (>=2.22~),
+ libpcsclite-dev,
+Standards-Version: 4.1.3
+Homepage: http://cgit.freedesktop.org/spice/libcacard/
+Vcs-Browser: https://salsa.debian.org/qemu-team/libcacard
+Vcs-Git: https://salsa.debian.org/qemu-team/libcacard.git
+
+Package: libcacard0
+Section: libs
+Architecture: any
+Multi-Arch: same
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Description: Virtual Common Access Card (CAC) Emulator (runtime library)
+ This emulator is designed to provide emulation of actual smart cards to a
+ virtual card reader running in a guest virtual machine. The emulated smart
+ cards can be representations of real smart cards, where the necessary
+ functions such as signing, card removal/insertion, etc. are mapped to real,
+ physical cards which are shared with the client machine the emulator is
+ running on, or the cards could be pure software constructs.
+ .
+ This package provides the runtime library.
+
+Package: libcacard-dev
+Section: libdevel
+Architecture: any
+Multi-Arch: same
+Depends: ${misc:Depends}, libcacard0 (= ${binary:Version}), libnss3-dev
+Description: Virtual Common Access Card (CAC) Emulator (development files)
+ This emulator is designed to provide emulation of actual smart cards to a
+ virtual card reader running in a guest virtual machine. The emulated smart
+ cards can be representations of real smart cards, where the necessary
+ functions such as signing, card removal/insertion, etc. are mapped to real,
+ physical cards which are shared with the client machine the emulator is
+ running on, or the cards could be pure software constructs.
+ .
+ This package provides files necessary to develop programs using the library.
+
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000000000000000000000000000000000000..9d56fe92f030e2e33232435c2823d604ce45f9a9
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,75 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: libcacard
+Source: http://www.spice-space.org/download/libcacard/
+
+Files: *
+Copyright: 2011 Red Hat.
+License: LGPL-2.1+
+
+Files: m4/*
+Copyright: 2011 Rhys Ulerich <rhys.ulerich@gmail.com>
+ 2014 Mike Frysinger <vapier@gentoo.org>
+ 2014-2015 Philip Withnall <philip@tecnocode.co.uk>
+ 2015 David King <amigadave@amigadave.com>
+License: auto-permissive
+ Auto-generated file under the permissive license.
+
+Files: m4/ax_append_compile_flags.m4
+ m4/ax_append_flag.m4
+ m4/ax_check_compile_flag.m4
+Copyright: 2008 Guido U. Draheim <guidod@gmx.de>
+ 2011 Maarten Bosmans <mkbosmans@gmail.com>
+License: GPL-3.0+ with autoconf exception
+ This program is free software: you can redistribute it and/or modify it
+ under the terms of the GNU General Public License as published by the
+ Free Software Foundation, either version 3 of the License, or (at your
+ option) any later version.
+ .
+ On Debian systems, the complete text of the GNU General Public License
+ Version 3 can be found in `/usr/share/common-licenses/GPL-3'.
+ .
+ As a special exception, the respective Autoconf Macro's copyright owner
+ gives unlimited permission to copy, distribute and modify the configure
+ scripts that are the output of Autoconf when processing the Macro. You
+ need not follow the terms of the GNU General Public License when using
+ or distributing such scripts, even though portions of the text of the
+ Macro appear in them. The GNU General Public License (GPL) does govern
+ all other use of the material that constitutes the Autoconf Macro.
+ .
+ This special exception to the GPL applies to versions of the Autoconf
+ Macro released by the Autoconf Archive. When you make and distribute a
+ modified version of the Autoconf Macro, you may extend this special
+ exception to the GPL to apply to your modified version as well.
+
+Files: src/glib-compat.h
+Copyright: 2013 IBM, Corp.
+License: GPL-2.0+
+ This work is licensed under the terms of the GNU GPL, version 2 or later.
+ .
+ On Debian systems, the complete text of the GNU General Public License
+ Version 2 can be found in `/usr/share/common-licenses/GPL-2'.
+
+Files: m4/ax_code_coverage.m4
+Copyright: 2012 Christian Persch
+ 2012 Dan Winship
+ 2012 Paolo Borelli
+ 2012 Philip Withnall
+ 2012 Xan Lopez
+ 2015 Bastien ROUCARIES
+License: LGPL-2.1+
+
+Files: debian/*
+Copyright: 2015 Michael Tokarev <mjt@tls.msk.ru>
+License: GPL-2+
+ This work is licensed under the terms of the GNU GPL, version 2 or later.
+ .
+ On Debian systems, the complete text of the GNU General Public License
+ Version 2 can be found in `/usr/share/common-licenses/GPL-2'.
+
+License: LGPL-2.1+
+ This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
+ See the COPYING file in the top-level directory.
+ .
+ On Debian systems, the complete text of the GNU Lesser General Public License
+ Version 2.1 can be found in `/usr/share/common-licenses/LGPL-2.1'.
+
diff --git a/debian/libcacard-dev.install b/debian/libcacard-dev.install
new file mode 100644
index 0000000000000000000000000000000000000000..e872030bb1dc415cc147d502042a8ff7b33f3ff0
--- /dev/null
+++ b/debian/libcacard-dev.install
@@ -0,0 +1,4 @@
+usr/lib/*/libcacard.so
+#usr/lib/*/libcacard.a
+usr/lib/*/pkgconfig/libcacard.pc
+usr/include/cacard
diff --git a/debian/libcacard-tools.install b/debian/libcacard-tools.install
new file mode 100644
index 0000000000000000000000000000000000000000..b0e4123b6a5e2b49cc0e0c84cef681a1f4755dab
--- /dev/null
+++ b/debian/libcacard-tools.install
@@ -0,0 +1 @@
+usr/bin/vscclient
diff --git a/debian/libcacard0.install b/debian/libcacard0.install
new file mode 100644
index 0000000000000000000000000000000000000000..6480366d6e6ec7658279f75f997e8871d359d5a9
--- /dev/null
+++ b/debian/libcacard0.install
@@ -0,0 +1 @@
+usr/lib/*/libcacard.so.*
diff --git a/debian/libcacard0.symbols b/debian/libcacard0.symbols
new file mode 100644
index 0000000000000000000000000000000000000000..9eef2dcfff94fa0371a3e08acac01535b309c57b
--- /dev/null
+++ b/debian/libcacard0.symbols
@@ -0,0 +1,78 @@
+libcacard.so.0 libcacard0 #MINVER#
+ cac_card_init@Base 2.2
+ vcard_add_applet@Base 2.2
+ vcard_apdu_delete@Base 2.2
+ vcard_apdu_new@Base 2.2
+ vcard_applet_get_aid@Base 2.2
+ vcard_buffer_response_delete@Base 2.2
+ vcard_buffer_response_new@Base 2.2
+ vcard_delete_applet@Base 2.2
+ vcard_emul_delete_key@Base 2.2
+ vcard_emul_force_card_insert@Base 2.2
+ vcard_emul_force_card_remove@Base 2.2
+ vcard_emul_get_atr@Base 2.2
+ vcard_emul_get_login_count@Base 2.2
+ vcard_emul_init@Base 2.2
+ vcard_emul_login@Base 2.2
+ vcard_emul_options@Base 2.2
+ vcard_emul_replay_insertion_events@Base 2.2
+ vcard_emul_reset@Base 2.2
+ vcard_emul_rsa_op@Base 2.2
+ vcard_emul_type_from_string@Base 2.2
+ vcard_emul_type_select@Base 2.2
+ vcard_emul_usage@Base 2.2
+ vcard_find_applet@Base 2.2
+ vcard_free@Base 2.2
+ vcard_get_atr@Base 2.2
+ vcard_get_buffer_response@Base 2.2
+ vcard_get_current_applet_private@Base 2.2
+ vcard_get_private@Base 2.2
+ vcard_get_type@Base 2.2
+ vcard_init@Base 2.2
+ vcard_make_response@Base 2.2
+ vcard_new@Base 2.2
+ vcard_new_applet@Base 2.2
+ vcard_process_apdu@Base 2.2
+ vcard_process_applet_apdu@Base 2.2
+ vcard_reference@Base 2.2
+ vcard_reset@Base 2.2
+ vcard_response_delete@Base 2.2
+ vcard_response_new@Base 2.2
+ vcard_response_new_bytes@Base 2.2
+ vcard_response_new_data@Base 2.2
+ vcard_response_new_status_bytes@Base 2.2
+ vcard_response_set_status_bytes@Base 1:2.5.3
+ vcard_select_applet@Base 2.2
+ vcard_set_applet_private@Base 2.2
+ vcard_set_atr_func@Base 2.2
+ vcard_set_buffer_response@Base 2.2
+ vcard_set_type@Base 2.2
+ vevent_delete@Base 2.2
+ vevent_get_next_vevent@Base 2.2
+ vevent_new@Base 2.2
+ vevent_queue_init@Base 2.2
+ vevent_queue_vevent@Base 2.2
+ vevent_wait_next_vevent@Base 2.2
+ vreader_add_reader@Base 2.2
+ vreader_card_is_present@Base 2.2
+ vreader_free@Base 2.2
+ vreader_get_id@Base 2.2
+ vreader_get_name@Base 2.2
+ vreader_get_private@Base 2.2
+ vreader_get_reader_by_id@Base 2.2
+ vreader_get_reader_by_name@Base 2.2
+ vreader_get_reader_list@Base 2.2
+ vreader_init@Base 2.2
+ vreader_insert_card@Base 2.2
+ vreader_list_delete@Base 2.2
+ vreader_list_get_first@Base 2.2
+ vreader_list_get_next@Base 2.2
+ vreader_list_get_reader@Base 2.2
+ vreader_new@Base 2.2
+ vreader_power_off@Base 2.2
+ vreader_power_on@Base 2.2
+ vreader_queue_card_event@Base 2.2
+ vreader_reference@Base 2.2
+ vreader_remove_reader@Base 2.2
+ vreader_set_id@Base 2.2
+ vreader_xfr_bytes@Base 2.2
diff --git a/debian/patches/remove-requires.private.patch b/debian/patches/remove-requires.private.patch
new file mode 100644
index 0000000000000000000000000000000000000000..70c76614078b38ffd4bcf6b08d359977a9bcc8af
--- /dev/null
+++ b/debian/patches/remove-requires.private.patch
@@ -0,0 +1,17 @@
+Subject: remove Reqires.private from libcacard.pc
+From: Michael Tokarev <mjt@tls.msk.ru>
+Bug-Debian: http://bugs.debian.org/804289
+
+Since we're not providing static library, Requires.private is not used.
+But pkg-config complains about missing dependensies even if they're not
+used.
+
+--- a/libcacard.pc.in
++++ b/libcacard.pc.in
+@@ -7,6 +7,5 @@ Name: cacard
+ Description: CA Card library
+ Version: @PACKAGE_VERSION@
+ Requires: glib-2.0
+-Requires.private: nss
+ Libs: -L${libdir} -lcacard
+ Cflags: -I${includedir}/cacard
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000000000000000000000000000000000000..958b840e17b708fe9a324d1fc51a7f4613e76f57
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+remove-requires.private.patch
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000000000000000000000000000000000000..8c05a97fe9ac165065c0160581b9266b4935c329
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,8 @@
+#!/usr/bin/make -f
+
+%:
+ dh $@
+# --with autoreconf
+
+# testsuite needs some more work
+override_dh_auto_test:
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000000000000000000000000000000000000..163aaf8d82b6c54f23c45f32895dbdfdcc27b047
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/debian/source/options b/debian/source/options
new file mode 100644
index 0000000000000000000000000000000000000000..8c8a761182e6526392933192e631f1b1351dac90
--- /dev/null
+++ b/debian/source/options
@@ -0,0 +1,4 @@
+# list of autogen files to ignore to be able to build from git source
+extend-diff-ignore = ^src/link_test\.c$|^autogen\.sh$|^build-aux/git-version-gen$|^git\.mk$
+extend-diff-ignore = ^\.version$|^Makefile\.in$|^aclocal\.m4$|^build-aux/compile$|^build-aux/config\.(guess|sub)$|^build-aux/depcomp$|^build-aux/install-sh$|^build-aux/ltmain\.sh$|^build-aux/missing$|^configure$|^m4/libtool\.m4$|^src/Makefile\.in$|^ChangeLog$|^\.tarball-version|^\.travis\.yml$
+extend-diff-ignore = ^\.gitlab-ci\.yml$|^build-aux/nss\.supp$
diff --git a/debian/watch b/debian/watch
new file mode 100644
index 0000000000000000000000000000000000000000..3ad25305957dfef22bf0f7886036914bfb278109
--- /dev/null
+++ b/debian/watch
@@ -0,0 +1,2 @@
+version=3
+http://www.spice-space.org/download/libcacard/libcacard-(\d+\.\d+\.\d)\.tar\.xz