<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en" style="--code-editor-font: GitLab Mono, JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospace;">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style data-premailer="ignore" type="text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: 0.875rem;
}
body {
-webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px;
}
body {
font-family: "GitLab Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji"; font-size: inherit;
}
</style>
</head>
<body style='font-size: inherit; -webkit-text-shadow: rgba(255,255,255,0.01) 0 0 1px; font-family: "GitLab Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, Cantarell, "Helvetica Neue", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";'>
<div class="content">
<h3 style="margin-top: 20px; margin-bottom: 10px;">
Guido Berhörster pushed to branch personal/gber/system-trusted-certs at <a href="https://salsa.debian.org/debian-edu/debian-edu-config">Debian Edu / debian-edu-config</a>
</h3>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
Commits:
</h4>
<ul>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/21457dc883407da542bbf95b95cc33d119779b37">21457dc8</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-19T11:46:53+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>ldap-createuser-krb5: fix password prompt
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/fddcfc173f7bd469f2c625dd9c5fbdb564ebc1a9">fddcfc17</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-19T15:15:46+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Disable cfengine3 systemd service
Disabling only cf-execd in 75b4e3f7 (see #1041323) did not work as it gets
pulled in as a dependency of cfengine3. Thus disable the cfengine3 service
instead.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/47cc42ed92bd4b61e9e6432bc4cacebbe8cbaa5b">47cc42ed</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-20T08:23:42+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Rewrite testsuite/filesystems, add exception for /boot
Rewrite for clarity and robustness.
Add exception for /boot which may use ext2.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/7584d0c4757547b085ff27b41672f5e5b4535240">7584d0c4</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-20T08:23:42+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>testsuite/ldap-client: fix invocation of ldapsearch
The -h command line option has been removed, ldapsearch now only accepts a LDAP
URI via the -H option. Use dig and awk instead of host and interpret the SRV
record properly.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/92cba3da0c02ad22939bd27e438afa8b05e15206">92cba3da</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-20T08:23:42+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>testsuite/ldap-client: improve error message on PAM modules
Also do not use the deprecated egrep and get rid of unnecessary wc.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/7b4304a4a73c95cd26aae5c2ec114ec7ed9aabcd">7b4304a4</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-20T08:23:42+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>testsuite/ldap-server: fix invocation of ldapsearch
The -h command line option has been removed, ldapsearch now only accepts a LDAP
URI via the -H option.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/3504627e96902399e1ffbdadaa99bd25a3e7390d">3504627e</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-20T08:23:42+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Fix remaining invocations of ldapsearch
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/6d803b3a9a42dad8a178a4a1b281a60a792e6ca5">6d803b3a</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-20T08:26:17+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Disable the LDAP PAM module
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/ed1d0ca17c8b4aee729057ead20a41c61a9de3fa">ed1d0ca1</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-25T17:59:16+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>setup-freeradius-server: Set commonName and subjectAltNames on the server cert
Closes: #1010159.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/e29c074f5f577fd2712d798d96d360f95225ded0">e29c074f</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-25T17:59:35+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>setup-freeradius-server: Improve robustness
Use update-ini-file for OpenSSL config files.
Use more precise sed substitutions which do not rely on example values.
Increase password length from 8 to 16 characters.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/02c4c4c14c7b9ecccfb2633af103699c41403979">02c4c4c1</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-09-26T10:32:16+00:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Change minimum UID/GID for LDAP user to 2000
With this change local user accounts now use the UID/GID range 1000-1999
instead of 500-999 whereas LDAP user accounts use 2000-59999 instead of
1000-59999. This is to reserve UID/GID 0-999 for system users which is the
default in Debian and not conforming to it is increasingly problematic as
packages are beginning to use systemd-sysusers for creating system user
accounts which does not obey /etc/addusers.conf or /etc/login.defs by default.
The first user account created during installation now has UID/GID 2000 instead
of 1000.
Configure gosa and adjust ldap-createuser-krb5 accordingly.
Closes: #1003192.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/41a4f5c665d1bb0d9ad9beb14b0ff36632a53e52">41a4f5c6</a></strong>
<div>
<span> by Mike Gabriel </span> <i> at 2023-09-27T22:31:46+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>release as 2.12.37
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/01e201ca94e576280b5973d967f747fcc6ca35e8">01e201ca</a></strong>
<div>
<span> by Mike Gabriel </span> <i> at 2023-09-27T22:32:59+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Start 2.12.38 development.
d/changelog entries will be written on release using the git commit
messages.
Use 'gbp dch --since 2.12.37' to write d/changelog entries since that
last release.
Gbp-Dch: ignore
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/dda7b2627301b381ced6d4b37e92a72808dd2a34">dda7b262</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-10-09T14:54:31+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Make libnssckbi.so consumers trust system root certificate store
Add debian-edu-config-p11-kit-nssckbi subpackage which contains a diversion for
libnssckbi.so and replaces it with symlink to p11-kit-trust.so in order to work
around #704180. Note that it is important to keep the renamed file outside of
/usr/lib/<arch>/ in order to prevent ldconfig from overwriting the symlink.
</pre>
</li>
<li>
<strong style="font-weight: bold;"><a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/4b63838ab777314d4611195f0be58c29203b8f1a">4b63838a</a></strong>
<div>
<span> by Guido Berhoerster </span> <i> at 2023-10-09T14:58:56+02:00 </i>
</div>
<pre class="commit-message" style='white-space: pre-wrap; display: block; font-size: 14px; color: #333238; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace; word-break: break-all; word-wrap: break-word; background-color: #fbfafd; border-radius: 2px; margin: 0; padding: 8px 12px; border: 1px solid #dcdcde;'>Stop adding the DebianEdu root CA to NSS shared database
NSS consumers like Firefox, Thunderbird, Chromium should use the system trusted
root CA store via p11-kit (Closes: #926388).
</pre>
</li>
</ul>
<h4 style="margin-top: 10px; margin-bottom: 10px;">
30 changed files:
</h4>
<ul>
<li class="file-stats">
<a href="#836efb6e25a091dcb4ff8e1dbb2f0be6a5cbf14c">
Makefile
</a>
</li>
<li class="file-stats">
<a href="#69e27356ef629022720d868ab0c0e3394775b6c1">
README
</a>
</li>
<li class="file-stats">
<a href="#3292fa1c8541791e9171c5d979945c05e391ac2d">
<span class="deleted-file">
−
bin/debian-edu-copy-pki
</span>
</a>
</li>
<li class="file-stats">
<a href="#289f6e9c1d137e00eba9bb4eba70585bc1f48153">
cf3/cf.adduser
</a>
</li>
<li class="file-stats">
<a href="#5bf54d9422f12712d648c98c5c14b8735c8afe24">
cf3/cf.cf-execd
→
cf3/cf.cfengine3
</a>
</li>
<li class="file-stats">
<a href="#42c9e23b6465819b217a1e2711056cdeeeec4a6d">
cf3/cf.ldapclient
</a>
</li>
<li class="file-stats">
<a href="#b0f6be008dba838c280084b58396c80c80783e11">
cf3/promises.cf
</a>
</li>
<li class="file-stats">
<a href="#9c96da0e9f91d7d8937b69b524702c106258f0d1">
debian/changelog
</a>
</li>
<li class="file-stats">
<a href="#58ef006ab62b83b4bec5d81fe5b32c3b4c2d1cc2">
debian/control
</a>
</li>
<li class="file-stats">
<a href="#caad37d8a857fe7a8dc45c4f9caf9d026e2d4170">
<span class="new-file">
+
debian/debian-edu-config-p11-kit-nssckbi.links
</span>
</a>
</li>
<li class="file-stats">
<a href="#758e4632bb420a5fea01c5106ce810f946a4bd99">
<span class="new-file">
+
debian/debian-edu-config-p11-kit-nssckbi.postrm.in
</span>
</a>
</li>
<li class="file-stats">
<a href="#4c797420fc3848bdaeb482c40a7ac90a15f9c6e1">
<span class="new-file">
+
debian/debian-edu-config-p11-kit-nssckbi.preinst.in
</span>
</a>
</li>
<li class="file-stats">
<a href="#51118321323212c07d7cf53318c8eaefd7e8e78f">
debian/debian-edu-config.lintian-overrides
</a>
</li>
<li class="file-stats">
<a href="#8756c63497c8dc39f7773438edf53b220c773f67">
debian/rules
</a>
</li>
<li class="file-stats">
<a href="#cd024af64977d69eb5bfb85a142c2fc16c14f5a3">
etc/ldap/rootDSE-debian-edu.ldif
</a>
</li>
<li class="file-stats">
<a href="#44a32c770deeae8e4181b906e3997710b84b6e9a">
ldap-bootstrap/firstuser.ldif
</a>
</li>
<li class="file-stats">
<a href="#633a9516203c070f29f8b3078a935f9bcc59e5e1">
ldap-tools/ldap-createuser-krb5
</a>
</li>
<li class="file-stats">
<a href="#c567e839fdd3fda00ac6cbb72175d4a65bf64a86">
ldap-tools/ldap-debian-edu-install
</a>
</li>
<li class="file-stats">
<a href="#1cc3f862e6b052b95089f689e235990808a06a56">
<span class="deleted-file">
−
lib/thunderbird/distribution/policies.json
</span>
</a>
</li>
<li class="file-stats">
<a href="#7bd27eed6067c1b043873788c3e88c17249dcb0b">
sbin/debian-edu-ltsp-install
</a>
</li>
<li class="file-stats">
<a href="#0a23b36167d60475cafef8de481f8abda3339d7f">
share/debian-edu-config/d-i/pre-pkgsel
</a>
</li>
<li class="file-stats">
<a href="#14219f018bf2313b8113fd1824ab6e22619dc263">
share/debian-edu-config/gosa.conf.template
</a>
</li>
<li class="file-stats">
<a href="#d1773cae02afec23bc5bc297666b612e23d9acca">
share/debian-edu-config/pam-nopwdchange.py
</a>
</li>
<li class="file-stats">
<a href="#0eab8b7b7effe626452b847b6e3812b44b367683">
share/debian-edu-config/tools/create-debian-edu-certs
</a>
</li>
<li class="file-stats">
<a href="#e8629f8036aa33844ebf5d2c775e16f84840b666">
<span class="deleted-file">
−
share/debian-edu-config/tools/create-user-nssdb
</span>
</a>
</li>
<li class="file-stats">
<a href="#b63882a901c2447ae27ca5fcd03a2705d441e538">
share/debian-edu-config/tools/goodbye-user-session
</a>
</li>
<li class="file-stats">
<a href="#e956b851abc1b99351cbbae262cd09229de2cabe">
share/debian-edu-config/tools/gosa-create
</a>
</li>
<li class="file-stats">
<a href="#dd3804982135ebc41800ec729d730b4b7ffa08c2">
share/debian-edu-config/tools/kerberos-kdc-init
</a>
</li>
<li class="file-stats">
<a href="#8f0f1466c4e4e1e62024d5dd30d695510ee3bb3b">
share/debian-edu-config/tools/setup-freeradius-server
</a>
</li>
<li class="file-stats">
<a href="#02a7b5856a7dd99ae6c1f525b6215d59c136b552">
<span class="deleted-file">
−
share/debian-edu-config/tools/update-cert-dbs
</span>
</a>
</li>
</ul>
<h5 style="margin-top: 10px; margin-bottom: 10px; font-size: 0.875rem;">
The diff was not included because it is too large.
</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #737278;">
—
<br>
<a href="https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/124070c677508d1b2021e6f2e1bfb556990d48cc...4b63838ab777314d4611195f0be58c29203b8f1a">View it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target="_blank" rel="noopener noreferrer" href="https://salsa.debian.org">salsa.debian.org</a>. <a href="https://salsa.debian.org/-/profile/notifications" target="_blank" rel="noopener noreferrer" class="mng-notif-link">Manage all notifications</a> · <a href="https://salsa.debian.org/help" target="_blank" rel="noopener noreferrer" class="help-link">Help</a>
</p>
</div>
</body>
</html>