Version in base suite: 2.13.2~deb13u1 Version in overlay suite: 2.13.6~deb13u1 Base version: debian-edu-config_2.13.6~deb13u1 Target version: debian-edu-config_2.13.7~deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/d/debian-edu-config/debian-edu-config_2.13.6~deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/d/debian-edu-config/debian-edu-config_2.13.7~deb13u1.dsc /srv/release.debian.org/tmp/UXtMF5bT03/debian-edu-config-2.13.7~deb13u1/ltsp-tjener-tosend.tar |binary debian-edu-config-2.13.7~deb13u1/Makefile | 2 debian-edu-config-2.13.7~deb13u1/cf3/cf.cfengine3 | 13 -- debian-edu-config-2.13.7~deb13u1/cf3/cf.ldapserver | 5 debian-edu-config-2.13.7~deb13u1/debian/changelog | 54 ++++++++++ debian-edu-config-2.13.7~deb13u1/debian/debian-edu-config.postinst | 7 + debian-edu-config-2.13.7~deb13u1/etc/apache2/sites-available/debian-edu-default.conf | 12 +- debian-edu-config-2.13.7~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases | 2 debian-edu-config-2.13.7~deb13u1/sbin/debian-edu-ltsp-install | 6 + debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map | 44 -------- debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map.template | 44 ++++++++ debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/d-i/finish-install | 12 -- debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/tools/run-at-firstboot | 28 +++-- debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/tools/update-firefox-homepage | 2 14 files changed, 149 insertions(+), 82 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpzerrake8/debian-edu-config_2.13.6~deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpzerrake8/debian-edu-config_2.13.7~deb13u1.dsc: no acceptable signature found diff -Nru debian-edu-config-2.13.6~deb13u1/Makefile debian-edu-config-2.13.7~deb13u1/Makefile --- debian-edu-config-2.13.6~deb13u1/Makefile 2026-10-17 20:41:36.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/Makefile 2026-11-09 00:22:40.000000000 +0000 @@ -359,7 +359,7 @@ $(INSTALL_DATA) sbin/debian-edu-fsautoresizetab $(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab set -e ; for f in \ - share/debian-edu-config/apache2_tjener-aliases.map \ + share/debian-edu-config/apache2_tjener-aliases.map.template \ share/debian-edu-config/avahi.smb.service \ share/debian-edu-config/rsyslog-collector \ share/debian-edu-config/rsyslog-filters \ diff -Nru debian-edu-config-2.13.6~deb13u1/cf3/cf.cfengine3 debian-edu-config-2.13.7~deb13u1/cf3/cf.cfengine3 --- debian-edu-config-2.13.6~deb13u1/cf3/cf.cfengine3 2026-09-21 07:19:38.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/cf3/cf.cfengine3 2026-11-09 00:22:40.000000000 +0000 @@ -1,15 +1,12 @@ bundle agent cfengine3 { -# Disable cfengine3 services which are enabled by default when systemd is used (#1043353) +# Mask cfengine3 services which are enabled by default when systemd is used (#1043353) -services: +commands: - debian.systemd.installation:: + debian.installation:: - "cfengine3.service" - service_policy => "stop"; - - "cfengine3.service" - service_policy => "disable"; + "/bin/systemctl mask cfengine3.service cf-apache.service cf-execd.service cf-hub.service cf-monitord.service cf-postgres.services cf-reactor.service cf-serverd.service" + contain => in_shell; } diff -Nru debian-edu-config-2.13.6~deb13u1/cf3/cf.ldapserver debian-edu-config-2.13.7~deb13u1/cf3/cf.ldapserver --- debian-edu-config-2.13.6~deb13u1/cf3/cf.ldapserver 2026-09-15 22:02:18.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/cf3/cf.ldapserver 2026-11-09 00:22:40.000000000 +0000 @@ -30,9 +30,8 @@ vars: "default" slist => { "SLAPD_SERVICES=\"ldap:/// ldaps:/// ldapi:///\"", - "export KRB5_KTNAME=/etc/krb5.keytab.ldap", - "SLAPD_OPTIONS=\"-4\"", - "ulimit -n 32768" }; + "KRB5_KTNAME=/etc/krb5.keytab.ldap", + "SLAPD_OPTIONS=\"-4\"" }; files: diff -Nru debian-edu-config-2.13.6~deb13u1/debian/changelog debian-edu-config-2.13.7~deb13u1/debian/changelog --- debian-edu-config-2.13.6~deb13u1/debian/changelog 2026-11-01 13:57:41.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/debian/changelog 2026-11-09 00:23:30.000000000 +0000 @@ -1,3 +1,57 @@ +debian-edu-config (2.13.7~deb13u1) trixie; urgency=medium + + * Release to trixie. + + -- Mike Gabriel Mon, 09 Nov 2026 01:23:30 +0100 + +debian-edu-config (2.13.7) unstable; urgency=medium + + * libexec/debian-edu-apache2-update-tjener-aliases: + - Stop modifying the apache2_tjener-aliases.map under /usr at runtime. + Instead, create a copy on first install to /var/lib/debian-edu/ and + update it there in regular intervals. Plus some typo/grammar fixes. + (Closes: #1153381). + - debian/debian-edu-config.postinst: Only create initial version of + /var/lib/debian-edu/apache2_tjener-aliases.map on the Main-Server. + * etc/apache2/sites-available/debian-edu-default.conf: + - Don't redirect sitesummary-client requests to https. + The sitesummary-client tool cannot handle 302-moved-permanently + return codes gracefully and aborts with failure. (Closes: + #1153379). + * sbin/debian-edu-ltsp-install: + - Mark DLW / TC chroots as successfully created once the package + installation is complete + * share/debian-edu-config/tools/run-at-firstboot: + - Fix indentation in LTSP image creation code block. Make script more + readable. + - Re-try DLW chroot creation if previous attempt was not successful. + This can, for example, happen if the server got rebooted to quickly + after the first boot, although the DLW chroot creation had not finished. + (Closes: #1153430). + * share/debian-edu-config/{d-i/finish-install,tools/run-at-first-boot: + - Move X2Go ThinClient creation into run-at-firstboot script (if LTSP- + Server profile gets installed). To ensure success of the X2Go ThinClient + creation, check wether the installation has been successful at previous + boots. If not, try to start from scratch. (See also: #1153430). + (Closes: #1153431). + * cf3/cf.ldapserver: + - Drop 'export' from variable declaration in /etc/default/slapd. + This does not get understood by systemd. (Closes: #1153429). + - Stop sneaking in ulimit -n 32768 call into /etc/default/slapd. + If this really still needed, we need to bring up the topic with the + slapd maintainers in Debian or tweak the slapd.service systemd unit + itself. (Closes: #1153454). + * cf3/cf.cfengine3: + - Ensure that all cfengine3 related sub-services get stopped and masked + during finish-install. + - In fact, simplify cfengine3 service deactivations and use systemctl to + mask those services. (Closes: #1153457). + * update-firefox-homepage: + - With Firefox-ESR in Debian 13.7/13.8 the browser.startup.homepage only + needs the URL. (Closes: #1153470). + + -- Mike Gabriel Mon, 09 Nov 2026 00:46:06 +0100 + debian-edu-config (2.13.6~deb13u1) trixie; urgency=medium * Release to trixie. diff -Nru debian-edu-config-2.13.6~deb13u1/debian/debian-edu-config.postinst debian-edu-config-2.13.7~deb13u1/debian/debian-edu-config.postinst --- debian-edu-config-2.13.6~deb13u1/debian/debian-edu-config.postinst 2026-09-15 22:02:19.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/debian/debian-edu-config.postinst 2026-11-09 00:22:40.000000000 +0000 @@ -217,6 +217,13 @@ fi fi +# On the main-server, take the /usr/share/debian-edu-config/apache2_tjener-aliases.map.template and create its runtime counterpart from it. +if grep -q Main-Server /etc/debian-edu/config; then + if [ ! -e /var/lib/debian-edu/apache2_tjener-aliases.map ]; then + cp /usr/share/debian-edu-config/apache2_tjener-aliases.map.template /var/lib/debian-edu/apache2_tjener-aliases.map + fi +fi + # Register all changes done by this postinst script if command -v etckeeper > /dev/null ; then etckeeper commit "end of debian-edu-config postinst" || true diff -Nru debian-edu-config-2.13.6~deb13u1/etc/apache2/sites-available/debian-edu-default.conf debian-edu-config-2.13.7~deb13u1/etc/apache2/sites-available/debian-edu-default.conf --- debian-edu-config-2.13.6~deb13u1/etc/apache2/sites-available/debian-edu-default.conf 2026-09-21 07:19:38.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/etc/apache2/sites-available/debian-edu-default.conf 2026-11-09 00:22:40.000000000 +0000 @@ -8,24 +8,28 @@ UseCanonicalName On RewriteEngine On - RewriteMap tjeneralias "txt:/usr/share/debian-edu-config/apache2_tjener-aliases.map" + RewriteMap tjeneralias "txt:/var/lib/debian-edu/apache2_tjener-aliases.map" # 1. Exclusions: Skip the redirect rules entirely for wpad.dat and Debian-Edu_rootCA.crt RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC] RewriteRule ^ - [L] - # 2. Check if the requested HTTP Host matches Edu IP subnet e.g. 10.x.x.x/8 subnet.. + # 2. Exclusions: sitesummary-client cannot handle 302 Moved permanently return codes + RewriteCond %{REQUEST_URI} ^/cgi-bin/sitesummary-collector\.cgi$ [NC] + RewriteRule ^ - [L] + + # 3. Check if the requested HTTP Host matches Edu IP subnet e.g. 10.x.x.x/8 subnet.. # NOTE: Single IPs should be part of the TJENER alias map. # NOTE: .999.999 is technically possible, but harmless. RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR] - # 3. Path A (The Happy Path): HTTP Host is a known TJENER alias + # 4. Path A (The Happy Path): HTTP Host is a known TJENER alias # We strip the port, check the map. If it matches, redirect preserving the requested name. RewriteCond %{HTTP_HOST} ^([^:]+) RewriteCond ${tjeneralias:%1|DENY} ^ALLOW$ [NC] RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L] - # 4. Path B (The Fallback): HTTP Host is not a known TJENER alias + # 5. Path B (The Fallback): HTTP Host is not a known TJENER alias # If the request makes it past Rule 3 without triggering the [L] flag, # it means the name was not in the map. We safely redirect to the static ServerName. RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L] diff -Nru debian-edu-config-2.13.6~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases debian-edu-config-2.13.7~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases --- debian-edu-config-2.13.6~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases 2026-09-21 07:19:38.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases 2026-11-09 00:22:40.000000000 +0000 @@ -18,7 +18,7 @@ # Configuration # ----------------------------------------------------------------------------- SCRIPT_PATH="/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases" -MAP_FILE="/usr/share/debian-edu-config/apache2_tjener-aliases.map" +MAP_FILE="/var/lib/debian-edu/apache2_tjener-aliases.map" BACKUP_DIR="/var/backups/apache2-tjener-aliases" LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no" LDAP_OPTS="-x" Binary files /srv/release.debian.org/tmp/dl2MZn_lPP/debian-edu-config-2.13.6~deb13u1/ltsp-tjener-tosend.tar and /srv/release.debian.org/tmp/UXtMF5bT03/debian-edu-config-2.13.7~deb13u1/ltsp-tjener-tosend.tar differ diff -Nru debian-edu-config-2.13.6~deb13u1/sbin/debian-edu-ltsp-install debian-edu-config-2.13.7~deb13u1/sbin/debian-edu-ltsp-install --- debian-edu-config-2.13.6~deb13u1/sbin/debian-edu-ltsp-install 2026-11-01 13:57:25.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/sbin/debian-edu-ltsp-install 2026-11-09 00:22:40.000000000 +0000 @@ -563,6 +563,9 @@ EOF fi + # Mark the chroot as successfully created. + touch /srv/ltsp/x2go-"$thin_type"-"$arch"/CREATED_SUCCESSFULLY_$(date +%Y%m%d-%H%M) + if [ "$img" == "yes" ] ; then ltsp image /srv/ltsp/x2go-"$thin_type"-"$arch" fi @@ -706,6 +709,9 @@ umount /srv/ltsp/dlw/media/cdrom fi + # Mark the chroot as successfully created. + touch /srv/ltsp/dlw/CREATED_SUCCESSFULLY_$(date +%Y%m%d-%H%M) + # Create optional SquashFS image file. if [ "yes" == "$img" ] ; then ltsp image dlw diff -Nru debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map --- debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map 2026-09-21 07:19:38.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map 1970-01-01 00:00:00.000000000 +0000 @@ -1,44 +0,0 @@ -# /usr/share/debian-edu-config/apache2_tjener-aliases.map -# Format: ALLOW -# -# IMPORTANT: This file will be changed daily by a script using cron/systemd. -# It contains allowed HTTP Host: header values (TJENER aliases -# and IPs), not client machines. -# The script tries to smartly merge existing hand-made entries, -# but you should execute the script manually once to make sure your -# changes are sticking: -# $ /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases -# -# WARNING: If you can read this and the file modification date is more than 24h -# in the past, then there is an issue with the automatic updating -# script managed by either cron or systemd. This file only contains -# the most basic configuration settings for Debian Edu and needs to be -# updated. -# -# DEV NOTE: If you're are updating this file in the debian-edu-config package -# please be aware that you'll have to adapt the update script too. - -# Local loopback devices -localhost ALLOW -::1 ALLOW -127.0.0.1 ALLOW - -# --------------------------- -# | Debian Edu defaults | -# --------------------------- -# NOTE: 10.x.x.x/8 network is allowed, so next line is redundand. -10.0.2.2 ALLOW -www ALLOW -www.intern ALLOW -tjener ALLOW -tjener.intern ALLOW -ldap ALLOW -ldap.intern ALLOW -# --------------------------- - - -# ----- IMPORTANT HAND-EDIT ADDITIONS ----- -# If a user browses to the raw IP and it is not here, it will trigger a 302 -# response to a pre-defined server name. -# Add any other IP addresses assigned to Tjeners interfaces: -# 172.16.0.51 ALLOW diff -Nru debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map.template debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map.template --- debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map.template 1970-01-01 00:00:00.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map.template 2026-11-09 00:22:40.000000000 +0000 @@ -0,0 +1,44 @@ +# /usr/share/debian-edu-config/apache2_tjener-aliases.map +# Format: ALLOW +# +# IMPORTANT: This file will be changed daily by a script using cron/systemd. +# It contains allowed HTTP Host: header values (TJENER aliases +# and IPs), not client machines. +# The script tries to smartly merge existing hand-made entries, +# but you should execute the script manually once to make sure your +# changes are sticking: +# $ /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +# +# WARNING: If you can read this and the file modification date is more than 24h +# in the past, then there is an issue with the automatic updating +# script managed by either cron or systemd. This file only contains +# the most basic configuration settings for Debian Edu and needs to be +# updated. +# +# DEV NOTE: If you're are updating this file in the debian-edu-config package +# please be aware that you'll have to adapt the update script too. + +# Local loopback devices +localhost ALLOW +::1 ALLOW +127.0.0.1 ALLOW + +# --------------------------- +# | Debian Edu defaults | +# --------------------------- +# NOTE: 10.x.x.x/8 network is allowed, so next line is redundant. +10.0.2.2 ALLOW +www ALLOW +www.intern ALLOW +tjener ALLOW +tjener.intern ALLOW +ldap ALLOW +ldap.intern ALLOW +# --------------------------- + + +# ----- IMPORTANT HAND-EDIT ADDITIONS ----- +# If a user browses to the raw IP and it is not listed here, it will trigger a 302 +# response to a pre-defined server name. +# Add any other IP addresses assigned to Tjeners interfaces: +# 172.16.0.51 ALLOW diff -Nru debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/d-i/finish-install debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/d-i/finish-install --- debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/d-i/finish-install 2026-11-01 13:57:25.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/d-i/finish-install 2026-11-09 00:22:40.000000000 +0000 @@ -64,18 +64,6 @@ db_get debian-edu-install/profile PROFILE="$RET" -# Create LTSP thin client image and iPXE setup in case of a combined server. -if echo "$PROFILE" | grep -Eq 'Main-Server.*LTSP-Server' ; then - in-target /bin/sh -c "modprobe squashfs" || true - in-target /bin/sh -c "modprobe loop" || true - in-target /bin/sh -c "modprobe overlay" || true - if in-target /bin/sh -c "/usr/sbin/debian-edu-ltsp-install --diskless_workstation no --thin_type bare" ; then - log "info: Running 'debian-edu-ltsp-install' succeeded" - else - log "error: 'debian-edu-ltsp-install' failed" - fi -fi - # Register changes before and after cf-agent is executed, to make it # easier to track our changes edu-etcvcs commit diff -Nru debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/tools/run-at-firstboot debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/tools/run-at-firstboot --- debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/tools/run-at-firstboot 2026-09-28 07:57:25.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/tools/run-at-firstboot 2026-11-09 00:22:40.000000000 +0000 @@ -74,18 +74,30 @@ # If this runs on a combi server (Main-Server + LTSP-Server), create # Diskless Workstation chroot from scratch as clean environment. if echo "$PROFILE" | grep -Eq 'Main-Server' && \ - echo "$PROFILE" | grep -Eq 'LTSP-Server'; then - if [ ! -d /srv/ltsp/dlw ]; then - /usr/sbin/debian-edu-ltsp-install --dlw yes - fi + echo "$PROFILE" | grep -Eq 'LTSP-Server'; then + if [ -d /srv/ltsp/dlw ] && [ -z "$(find /srv/ltsp/dlw/ -name "SUCCESSFULLY_CREATED_*")" ]; then + rm -Rf /srv/ltsp/dlw + fi + if [ ! -d /srv/ltsp/dlw ] || [ -n "$(find /srv/ltsp/dlw/ -name "SUCCESSFULLY_CREATED_*")" ]; then + /usr/sbin/debian-edu-ltsp-install --dlw yes + fi # else if this runs on a pure LTSP-Server (no Main-Server role), then # let's use the file system of the LTSP-Server and generate the LTSP # image directly from it (faster!). elif echo "$PROFILE" | grep -Eqv 'Main-Server' && \ - echo "$PROFILE" | grep -Eq 'LTSP-Server'; then - if [ ! -f /srv/ltsp/images/$ltspimg ] ; then - /usr/sbin/debian-edu-ltsp-install --diskless_workstation yes - fi + echo "$PROFILE" | grep -Eq 'LTSP-Server'; then + if [ ! -f /srv/ltsp/images/$ltspimg ] ; then + /usr/sbin/debian-edu-ltsp-install --diskless_workstation yes + fi + fi + # Always create the thin client image for all LTSP-Server variants/combinations. + if echo "$PROFILE" | grep -Eq 'LTSP-Server'; then + if [ -d /srv/ltsp/x2go-bare-amd64 ] && [ -z "$(find /srv/ltsp/x2go-bare-amd64/ -name "SUCCESSFULLY_CREATED_*")" ]; then + rm -Rf /srv/ltsp/x2go-bare-amd64/ + fi + if [ ! -d /srv/ltsp/x2go-bare-amd64 ] || [ -n "$(find /srv/ltsp/x2go-bare-amd64/ -name "SUCCESSFULLY_CREATED_*")" ]; then + /usr/sbin/debian-edu-ltsp-install --thin_type bare + fi fi fi diff -Nru debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/tools/update-firefox-homepage debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/tools/update-firefox-homepage --- debian-edu-config-2.13.6~deb13u1/share/debian-edu-config/tools/update-firefox-homepage 2026-09-15 22:02:19.000000000 +0000 +++ debian-edu-config-2.13.7~deb13u1/share/debian-edu-config/tools/update-firefox-homepage 2026-11-09 00:22:40.000000000 +0000 @@ -26,7 +26,7 @@ else cat > $etcfile.new <