This upload of debian-edu-config targets at releasing Debian Edu 13
(available via D-I / debian-cd) after the Debian 13.8 point release.
Note that Debian Edu 13 development has only started around end of
August 2026 and Debian Edu in trixie is currently totally
non-functional.
[ Reason ]
This new release of debian-edu-config to Debian trixie addresses various
problems observed during Debian Edu development over the past weeks,
plus adding various features we'd like to see land in Debian Edu 13.
Instead of cherry-picking individual fixes the Debian Edu team reached
the decision to propose an upload of debian-edu-config that provides
feature parity with debian-edu-config in Debian testing/unstable.
(Common practice also in previous years / release cycles).
[ Impact ]
No functional Debian Edu 13.
[ Tests ]
All code changes have been tested on Debian Edu 13 machines during
developemnt.
All recent debian-edu-* changes are now also backed by a range of
integration tests in Debian's openQA. Tests in openQA run against the
latest Debian Edu 13 ISO images, complemented by packages from
trixie-proposed-updates and for a selected range of packages we include
package builds created by Salsa CI.
[ Risks ]
Minimal. Only for Debian Edu.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
```
+debian-edu-config (2.13.6) unstable; urgency=medium
+
+ [ Roland Clobus ]
+ * Support 'locales-all' (Closes: #1149230).
+
+ -- Mike Gabriel <sunweaver@debian.org> Sun, 01 Nov 2026 14:53:56 +0100
+
+debian-edu-config (2.13.5) unstable; urgency=medium
+
+ [ Roland Clobus ]
+ * debian-edu-ltsp-install:
+ - Rework DLW installation method (Closes: #1150421). Apply code path of
+ X2Go thinclient installation method to DLW installation method.
+ - Fix running outside of Debian Installer. The script can be run outside
+ the d-i environment. If the BD ISO was used to install, and it is still
+ available, use the packages on the BD ISO instead of downloading them.
+
+ -- Mike Gabriel <sunweaver@debian.org> Wed, 14 Oct 2026 19:56:17 +0200
+
+debian-edu-config (2.13.4) unstable; urgency=medium
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-pxeinstall:
+ - Report progress of D-I provisioning to the admin.
+
+ [ Roland Clobus ]
+ * sbin/debian-edu-pxeinstall:
+ - Always use the versioned logo
+ - Update the dark logo too (Closes: #1150417)
+ * sbin/debian-edu-ltsp-install:
+ - Update X2Go TCE preparation for trixie (Closes: #1147625)
+ * finish-install:
+ - Keep the BD-ROM mounted (Closes: #1147630, #1147702).
+ * Enable the CI for aptly.
+
+ -- Mike Gabriel <sunweaver@debian.org> Fri, 09 Oct 2026 18:00:10 +0200
+
+debian-edu-config (2.13.3) unstable; urgency=medium
+
+ * debian/control:
+ + Require debian-edu-artwork (>= 2.13.5-1~). Needed for debian-edu-
+ pxeinstall to be able to use the correct Debian Installer version's
+ logo banner in the graphical installer (relevant for multi-version-
+ netboot-di setups, see changes below).
+ * bin/debian-edu-ldapserver:
+ - Don't use $ldapserver uninitialised.
+ * sbin/debian-edu-ltsp-install:
+ - Support KDE in X2Go sessions again.
+ * share/debian-edu-config/tools/run-at-firstboot:
+ - Silence warnings during D-I installation about unability to use an
+ interactive debconf frontend.
+ * sbin/debian-edu-pxeinstall:
+ - When downloading the netinstaller, skip if download fails. (Closes:
+ #1147699).
+ - Support multiple D-I versions if installed as DEB. (Closes: #1147764).
+ - Default to amd64 only, since trixie there is no i386 Debian-Installer
+ anymore.
+ - Stop and abort if no netboot installers could be found, don't create/
+ touch the TFTP config in that case.
+ - Enable iPXE graphical background image.
+ - When generating ltsp.ipxe, make the script continue/ignore if console
+ iPXE command is unknown to the iPXE firmware build/version.
+ - Use Debian-version-specific installer logo PNG in Debian Installers
+ installing older versons of Debian Edu.
+ * tools/pxe-addfirmware:
+ - Refactor script. Adjust for trixie and for multi-version netboot D-I.
+
+ -- Mike Gabriel <sunweaver@debian.org> Fri, 25 Sep 2026 08:55:54 +0200
+
+debian-edu-config (2.13.2~deb13u1) trixie; urgency=medium
+
+ * Release to trixie.
+
+ -- Mike Gabriel <sunweaver@debian.org> Mon, 07 Sep 2026 10:58:57 +0200
+
+debian-edu-config (2.13.2) unstable; urgency=medium
+
+ [ Serhii Horichenko ]
+ * share/debian-edu-config/tools/run-at-firstboot:
+ - Add an environment check to avoid starting the image creation on
+ an LTSP-client (Closes: #1092123).
+ - Add an ability to create a Diskless Workstation chroot and separate
+ the creation of an image on an LTSP-server without the Main-Server
+ role (Closes: #1092123).
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-ltsp-install:
+ - When creating a DLW, set PROFILE to 'Workstation' (Closes: #1092123).
+ * share/debian-edu-config/tools/kerberos-kdc-init:
+ - Don't hard-code master_key_type, use MIT/Kerberos' default. (Closes:
+ #1052962).
+ * Stop using killer script in Debian Edu. (Closes: #703710).
+ * cf3/cf.ldapclient:
+ - Ensure empty file /etc/netgroup exists. (Closes: #1146398).
+ * exim4/exim-ldap-{server,client}-v4.conf:
+ - Write logs to syslog. (Closes: #1051836).
+ * run-at-firstboot:
+ - Initialize first user's mailbox only when logging into Main-Server.
+
+ -- Mike Gabriel <sunweaver@debian.org> Fri, 04 Sep 2026 23:35:24 +0200
+
+debian-edu-config (2.13.1) unstable; urgency=medium
+
+ [ Daniel Teichmann ]
+ * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by
+ openldap:openldap. Regression check for Debian bug #1144741.
+ * debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes
+ commit: 63575146)
+ * Drop unused wicd preconnect hook.
+ wicd is no longer in Debian. The hook was the only remaining wicd
+ integration and is not referenced anywhere else in the package.
+ * testsuite/hostname: escape regex dot and exit non-zero on failure.
+ The unescaped dot in the 'tjener.intern' grep matched any character.
+ Escape it so the FQDN check is exact. Both error paths now exit 1 so a
+ broken hostname fails the test instead of silently passing.
+ * share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict.
+ * debian/control: Depend on iproute2
+ * testsuite/network: Stop using net-tools, use ip from iproute2 instead
+ * ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead
+ of ifconfig
+ * share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat
+ * testsuite/ldap-server: Use ss instead of netstat
+ * debian/control: Drop Depends: net-tools
+ * share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and
+ sanitization from /proc/cmdline.
+ Handle hostname= as first cmdline token, ignore empty values and
+ strip characters invalid in hostnames.
+ * share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present.
+ Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only
+ fires when there actually is a leading/trailing hyphen to remove.
+ * tools/create-debian-edu-certs: Switch root CA and server key generation
+ to ECDSA prime256v1.
+ RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
+ 'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
+ prime256v1 (secp256r1 / NIST P-256) curve.
+ * tools/create-server-cert: Switch key generation to ECDSA prime256v1 and
+ drop keyEncipherment key usage
+ keyEncipherment is only meaningful for RSA keys. For ECDSA server
+ certificates only the digitalSignature key usage is applicable
+ (RFC 5480).
+ * v3.cnf: Drop keyEncipherment from server cert key usage
+ keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
+ digitalSignature is required for TLS server certificates.
+
+ [ Mike Gabriel ]
+ * debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).
+ * ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf
+ are UTF-8 based.
+ This resolves GECOS field transliteration after having retrieved
+ debian-edu-config/first-user-fullname from the debconf db.
+ (Closes: #939717).
+ * share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup
+ * share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname
+ and derive FQDN from /etc/hosts. (Closes: #893394).
+ * testsuite/hostname: Test that /etc/hostname on installation profile
+ Main-Server is set correctly
+ * cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines.
+ Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian
+ Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka
+ tjener).
+ In Debian Edu, we use cfengine3 for managing configuration adjustments
+ via manual invocation of the cf-agent command, but we don't support
+ (yet?) to use cfengine3 for constant system management.
+ Partially addresses #1051834.
+ * sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we
+ define it
+ * sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands
+ ... by using double quotes, not single quotes.
+ * sbin/update-hostname-from-ip: white-space cleanup
+ * sbin/update-hostname-from-ip: Stop using net-tools, use ip command from
+ iproute2 instead
+ * share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via
+ /proc/cmdline. (Closes: #1008597).
+
+ [ Wolfgang Schweer ]
+ * share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft.
+ (Closes: #1055648).
+
+ [ Serhii Horichenko ]
+ * ltsp: Add 'quiet splash' to hide boot details on clients.
+ (Closes: #1065564).
+ * etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list
+ packages available for upgrade.
+
+ -- Mike Gabriel <sunweaver@debian.org> Tue, 25 Aug 2026 21:18:07 +0200
+
+debian-edu-config (2.13.0) unstable; urgency=medium
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-fsautoresize:
+ - Avoid division by zero error on unused mountpoints.
+ * sbin/debian-edu-pxeinstall:
+ - Support overriding tasksel/desktop selection via mydesktop parameter in
+ /etc/debian-edu/pxeinstall.conf.
+ - Fix comment about mapping debconf template keywords to kernel cmdline
+ keywords and drop unused variable assignment.
+ - sbin/debian-edu-pxeinstall: Regression fix, only adjust desktop to
+ mydesktop from pxeinstall.conf if we are processing the tasksel/desktop
+ setting.
+ * share/debian-edu-config/tools/copy-host-keytab:
+ - Support SSH publickey login to tjener, if this is possible (e.g. if admin
+ is using SSH agent forwarding).
+
+ [ Daniel Teichmann ]
+ * Add new file 'debian-edu-router.ldif'. Empty proxy groups should be
+ installed on all new Tjeners.
+ * ldap-bootstrap/debian-edu-router.ldif: Add 'server-hosts' nisNetgroup
+ to 'proxy-trusted' nisNetgroup, via 'memberNisNetgroup' attribute.
+ * share/debian-edu-config/gosa.conf.template: Activate nisNetgroup tab
+ for user accounts.
+ * apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including
+ Debian-Edu_rootCA.crt).
+ (Closes: #1068388)
+ * etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x
+ compatibility.
+ * debian/control: Add 'Conflicts: firefox-esr-mobile-config'.
+ (Closes: #1126881)
+ * v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility.
+ * v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility.
+ * tools/create-debian-edu-certs: Fix script to apply correct configurations.
+ * tools/create-server-cert: Add OpenSSL 3 extensions and fix base config.
+
+ -- Mike Gabriel <sunweaver@debian.org> Sat, 23 May 2026 00:45:16 +0200
+
+debian-edu-config (2.12.904) unstable; urgency=medium
+
+ * share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override:
+ + Drop file. This setting is theme-specific and should be shipped in
+ debian-edu-artwork-<THEME> if diverting from system defaults.
+ * cf3/:
+ + Support recognizing FAI based installations of Debian Edu systems (except
+ from main server).
+
+ -- Mike Gabriel <sunweaver@debian.org> Mon, 15 Sep 2025 15:22:48 +0200
```
[ Other info ]
Getting this package into trixie before the Debian 13.8 point release
will be highly appreciated!!!