-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 25 Aug 2026 21:18:07 +0200 Source: debian-edu-config Architecture: source Version: 2.13.1 Distribution: unstable Urgency: medium Maintainer: Debian Edu Developers <debian-edu@lists.debian.org> Changed-By: Mike Gabriel <sunweaver@debian.org> Closes: 893394 939717 1008597 1055648 1065564 1136493 Changes: debian-edu-config (2.13.1) unstable; urgency=medium . [ Daniel Teichmann ] * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by openldap:openldap. Regression check for Debian bug #1144741. * debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes commit: 63575146) * Drop unused wicd preconnect hook. wicd is no longer in Debian. The hook was the only remaining wicd integration and is not referenced anywhere else in the package. * testsuite/hostname: escape regex dot and exit non-zero on failure. The unescaped dot in the 'tjener.intern' grep matched any character. Escape it so the FQDN check is exact. Both error paths now exit 1 so a broken hostname fails the test instead of silently passing. * share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict. * debian/control: Depend on iproute2 * testsuite/network: Stop using net-tools, use ip from iproute2 instead * ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead of ifconfig * share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat * testsuite/ldap-server: Use ss instead of netstat * debian/control: Drop Depends: net-tools * share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and sanitization from /proc/cmdline. Handle hostname= as first cmdline token, ignore empty values and strip characters invalid in hostnames. * share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present. Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only fires when there actually is a leading/trailing hyphen to remove. * tools/create-debian-edu-certs: Switch root CA and server key generation to ECDSA prime256v1. RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace 'openssl genrsa' with 'openssl genpkey -algorithm EC' using the prime256v1 (secp256r1 / NIST P-256) curve. * tools/create-server-cert: Switch key generation to ECDSA prime256v1 and drop keyEncipherment key usage keyEncipherment is only meaningful for RSA keys. For ECDSA server certificates only the digitalSignature key usage is applicable (RFC 5480). * v3.cnf: Drop keyEncipherment from server cert key usage keyEncipherment is not applicable to ECDSA keys (RFC 5480), only digitalSignature is required for TLS server certificates. . [ Mike Gabriel ] * debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493). * ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf are UTF-8 based. This resolves GECOS field transliteration after having retrieved debian-edu-config/first-user-fullname from the debconf db. (Closes: #939717). * share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup * share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname and derive FQDN from /etc/hosts. (Closes: #893394). * testsuite/hostname: Test that /etc/hostname on installation profile Main-Server is set correctly * cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines. Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka tjener). In Debian Edu, we use cfengine3 for managing configuration adjustments via manual invocation of the cf-agent command, but we don't support (yet?) to use cfengine3 for constant system management. Partially addresses #1051834. * sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we define it * sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands ... by using double quotes, not single quotes. * sbin/update-hostname-from-ip: white-space cleanup * sbin/update-hostname-from-ip: Stop using net-tools, use ip command from iproute2 instead * share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via /proc/cmdline. (Closes: #1008597). . [ Wolfgang Schweer ] * share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft. (Closes: #1055648). . [ Serhii Horichenko ] * ltsp: Add 'quiet splash' to hide boot details on clients. (Closes: #1065564). * etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list packages available for upgrade. Checksums-Sha1: fe70b7587cc98fe326ff354208dcaf1fa5c309a7 1978 debian-edu-config_2.13.1.dsc 7b9bce2c8fb1933265f3e4faaebacca526f4b101 365232 debian-edu-config_2.13.1.tar.xz c503d773c0ac0cf14ff0aeeae63c746d0279ad5c 6689 debian-edu-config_2.13.1_source.buildinfo Checksums-Sha256: 16fb9c0e2b784f8f7f5367a6187d96d99a461e68dcef18d5a481832afd83c609 1978 debian-edu-config_2.13.1.dsc d652a233635ff9b55533692aa26194b397b215f1cce42545ddf33dd660332fdc 365232 debian-edu-config_2.13.1.tar.xz ed8fc89632bd4d9c1a6376b18d785199ab0abeff5acf98e52561dd18c1a317ee 6689 debian-edu-config_2.13.1_source.buildinfo Files: 2523fe7a0cc1260e8f98261aeebc5969 1978 misc optional debian-edu-config_2.13.1.dsc 72f2c0838313ada04d7c748088370614 365232 misc optional debian-edu-config_2.13.1.tar.xz e5cd2ea9457dc485e2b7a501dcc9a466 6689 misc optional debian-edu-config_2.13.1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJJBAEBCgAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmqN6usVHHN1bndlYXZl ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxKiEQAJLrq+83Yoi/nAKjB5Miua6b4qaW 5t7kmwXDPCnhy/oi16oSopoEIfVMZHuRdXClttIblR1ObSwBK5kXcZt0+TlvLL6t 6RXtrFzMbBkvGLNXlmqiIFza0fgPZX3/ObU3UpEWE/O7hdnAGiYstUPQ0apNFC+3 KooeDaQAgIm93y0DByIWMR4K0id70RCz9wZ2jEYlkPNsbJUFY3OCYRWEgKs51lna ctUfrQA/abYRk8pij85bU/f3PBpswM8xEo7GCEiX1OOvkuWqBEoEcFd/T3yYU5bt TOFRXYyiQREH6vsTPwPYMdCH1Y30LsIs9AJQrAqYs5KyfVk1siVvhccejX9P3wZQ 8/u47hYmTUqoghX+2uUOGDqVwqdHDzxkDEK4FPlfNBHr3TsA0fyqFzzRj6qu6bdS F7LriPc6qLkmvZ0duFrUjlAtdsezi5eXMMJ1XkWqnVz6ybTDgG0ZtghhSNL8GLG4 /t92DCvfRyCuuxNeRAcn05O1+CoEncecQUOyj2aRWSX0F5RDmb40FlYfprIEkOtW US5K/w+csWBgei2nOuqXyiyyxsa1rltm6Zb4hNz4z1RLU7THqkBDGHI2gmvizyU4 YrS9J9eNDKNJ4M6IW5/rkvIbqDDGf9OgeRiAUKECmtTa7ijVkUIHi759lTk5SWjO RJAePFDi2LRNwy3K =oFlx -----END PGP SIGNATURE-----
