This upload of debian-edu-config targets at making a release candidate
of Debian Edu based on trixie available (via D-I / debian-cd). Note that
Debian Edu 13 development has only started a few weeks back and Debian
Edu in trixie is currently totally non-functional. This upload is the
first step of getting Debian Edu 13 alive (again). (After having skipped
an official Debian Edu 12 release). Hence, the size of shipped changes.
[ Reason ]
Currently, Debian Edu 13 as found in 13.6 fails during installation via D-I:
https://openqa.debian.net/tests/566649#step/_graphical_wait_login/23
This backport of debian-edu-config to Debian trixie addresses that one
problem plus many other problems observed during Debian Edu development
over the past weeks, plus adding various features we'd like to see land
in Debian Edu 13.
Instead of cherry-picking individual fixes the Debian Edu team reached
the decision to propose an upload of debian-edu-config that provides
feature parity with debian-edu-config in Debian testing/unstable.
(Common practice also in previous years / release cycles).
[ Impact ]
No functional Debian Edu 13.
[ Tests ]
All fixes have been tested on Debian 14 (via openQA, manually)
and patch-by-patch on Debian Edu 13 machines. Whether everything
works at installation time will be revealed once we have the
Debian (Edu) 13.7 images for testing.
[ Risks ]
Minimal. Only for Debian Edu.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
```
--- debian-edu-config-2.12.903~deb13u1/debian/changelog 2025-09-15 09:09:50.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/debian/changelog 2026-09-07 10:58:57.000000000 +0200
@@ -1,8 +1,168 @@
-debian-edu-config (2.12.903~deb13u1) trixie; urgency=medium
+debian-edu-config (2.13.2~deb13u1) trixie; urgency=medium
- * Upload to trixie.
+ * Release to trixie.
- -- Mike Gabriel <sunweaver@debian.org> Mon, 15 Sep 2025 09:09:50 +0200
+ -- Mike Gabriel <sunweaver@debian.org> Mon, 07 Sep 2026 10:58:57 +0200
+
+debian-edu-config (2.13.2) unstable; urgency=medium
+
+ [ Serhii Horichenko ]
+ * share/debian-edu-config/tools/run-at-firstboot:
+ - Add an environment check to avoid starting the image creation on
+ an LTSP-client (Closes: #1092123).
+ - Add an ability to create a Diskless Workstation chroot and separate
+ the creation of an image on an LTSP-server without the Main-Server
+ role (Closes: #1092123).
+ [ Mike Gabriel ]
+ * sbin/debian-edu-ltsp-install:
+ - When creating a DLW, set PROFILE to 'Workstation' (Closes: #1092123).
+ * share/debian-edu-config/tools/kerberos-kdc-init:
+ - Don't hard-code master_key_type, use MIT/Kerberos' default. (Closes:
+ #1052962).
+ * Stop using killer script in Debian Edu. (Closes: #703710).
+ * cf3/cf.ldapclient:
+ - Ensure empty file /etc/netgroup exists. (Closes: #1146398).
+ * exim4/exim-ldap-{server,client}-v4.conf:
+ - Write logs to syslog. (Closes: #1051836).
+ * run-at-firstboot:
+ - Initialize first user's mailbox only when logging into Main-Server.
+
+ -- Mike Gabriel <sunweaver@debian.org> Fri, 04 Sep 2026 23:35:24 +0200
+
+debian-edu-config (2.13.1) unstable; urgency=medium
+
+ [ Daniel Teichmann ]
+ * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by
+ openldap:openldap. Regression check for Debian bug #1144741.
+ * debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes
+ commit: 63575146)
+ * Drop unused wicd preconnect hook.
+ wicd is no longer in Debian. The hook was the only remaining wicd
+ integration and is not referenced anywhere else in the package.
+ * testsuite/hostname: escape regex dot and exit non-zero on failure.
+ The unescaped dot in the 'tjener.intern' grep matched any character.
+ Escape it so the FQDN check is exact. Both error paths now exit 1 so a
+ broken hostname fails the test instead of silently passing.
+ * share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict.
+ * debian/control: Depend on iproute2
+ * testsuite/network: Stop using net-tools, use ip from iproute2 instead
+ * ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead
+ of ifconfig
+ * share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat
+ * testsuite/ldap-server: Use ss instead of netstat
+ * debian/control: Drop Depends: net-tools
+ * share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and
+ sanitization from /proc/cmdline.
+ Handle hostname= as first cmdline token, ignore empty values and
+ strip characters invalid in hostnames.
+ * share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present.
+ Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only
+ fires when there actually is a leading/trailing hyphen to remove.
+ * tools/create-debian-edu-certs: Switch root CA and server key generation
+ to ECDSA prime256v1.
+ RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
+ 'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
+ prime256v1 (secp256r1 / NIST P-256) curve.
+ * tools/create-server-cert: Switch key generation to ECDSA prime256v1 and
+ drop keyEncipherment key usage
+ keyEncipherment is only meaningful for RSA keys. For ECDSA server
+ certificates only the digitalSignature key usage is applicable
+ (RFC 5480).
+ * v3.cnf: Drop keyEncipherment from server cert key usage
+ keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
+ digitalSignature is required for TLS server certificates.
+
+ [ Mike Gabriel ]
+ * debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).
+ * ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf
+ are UTF-8 based.
+ This resolves GECOS field transliteration after having retrieved
+ debian-edu-config/first-user-fullname from the debconf db.
+ (Closes: #939717).
+ * share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup
+ * share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname
+ and derive FQDN from /etc/hosts. (Closes: #893394).
+ * testsuite/hostname: Test that /etc/hostname on installation profile
+ Main-Server is set correctly
+ * cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines.
+ Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian
+ Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka
+ tjener).
+ In Debian Edu, we use cfengine3 for managing configuration adjustments
+ via manual invocation of the cf-agent command, but we don't support
+ (yet?) to use cfengine3 for constant system management.
+ Partially addresses #1051834.
+ * sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we
+ define it
+ * sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands
+ ... by using double quotes, not single quotes.
+ * sbin/update-hostname-from-ip: white-space cleanup
+ * sbin/update-hostname-from-ip: Stop using net-tools, use ip command from
+ iproute2 instead
+ * share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via
+ /proc/cmdline. (Closes: #1008597).
+
+ [ Wolfgang Schweer ]
+ * share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft.
+ (Closes: #1055648).
+
+ [ Serhii Horichenko ]
+ * ltsp: Add 'quiet splash' to hide boot details on clients.
+ (Closes: #1065564).
+ * etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list
+ packages available for upgrade.
+
+ -- Mike Gabriel <sunweaver@debian.org> Tue, 25 Aug 2026 21:18:07 +0200
+
+debian-edu-config (2.13.0) unstable; urgency=medium
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-fsautoresize:
+ - Avoid division by zero error on unused mountpoints.
+ * sbin/debian-edu-pxeinstall:
+ - Support overriding tasksel/desktop selection via mydesktop parameter in
+ /etc/debian-edu/pxeinstall.conf.
+ - Fix comment about mapping debconf template keywords to kernel cmdline
+ keywords and drop unused variable assignment.
+ - sbin/debian-edu-pxeinstall: Regression fix, only adjust desktop to
+ mydesktop from pxeinstall.conf if we are processing the tasksel/desktop
+ setting.
+ * share/debian-edu-config/tools/copy-host-keytab:
+ - Support SSH publickey login to tjener, if this is possible (e.g. if admin
+ is using SSH agent forwarding).
+
+ [ Daniel Teichmann ]
+ * Add new file 'debian-edu-router.ldif'. Empty proxy groups should be
+ installed on all new Tjeners.
+ * ldap-bootstrap/debian-edu-router.ldif: Add 'server-hosts' nisNetgroup
+ to 'proxy-trusted' nisNetgroup, via 'memberNisNetgroup' attribute.
+ * share/debian-edu-config/gosa.conf.template: Activate nisNetgroup tab
+ for user accounts.
+ * apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including
+ Debian-Edu_rootCA.crt).
+ (Closes: #1068388)
+ * etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x
+ compatibility.
+ * debian/control: Add 'Conflicts: firefox-esr-mobile-config'.
+ (Closes: #1126881)
+ * v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility.
+ * v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility.
+ * tools/create-debian-edu-certs: Fix script to apply correct configurations.
+ * tools/create-server-cert: Add OpenSSL 3 extensions and fix base config.
+
+ -- Mike Gabriel <sunweaver@debian.org> Sat, 23 May 2026 00:45:16 +0200
+
+debian-edu-config (2.12.904) unstable; urgency=medium
+
+ * share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override:
+ + Drop file. This setting is theme-specific and should be shipped in
+ debian-edu-artwork-<THEME> if diverting from system defaults.
+ * cf3/:
+ + Support recognizing FAI based installations of Debian Edu systems (except
+ from main server).
+
+ -- Mike Gabriel <sunweaver@debian.org> Mon, 15 Sep 2025 15:22:48 +0200
debian-edu-config (2.12.903) unstable; urgency=medium
```
[ Other info ]
Getting this package into trixie before the Debian 13.7 point release
will be highly appreciated!!!