config.layout | 29 29 + 0 - 0 !
1 file changed, 29 insertions(+)

 add debian layout (fhs-compatible)

lib/RT/Interface/Web/Handler.pm | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 use rt_sitemodules.pm in lib/rt/interface/web/handler.pm

sbin/rt-setup-database.in | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix relative references to config path

docs/system_administration/database.pod | 60 42 + 18 - 0 !
1 file changed, 42 insertions(+), 18 deletions(-)

 customise backup docs for debian

docs/customizing/styling_rt.pod | 13 6 + 7 - 0 !
docs/extending/clickable_links.pod | 4 2 + 2 - 0 !
docs/initialdata.pod | 2 1 + 1 - 0 !
docs/writing_portlets.pod | 8 4 + 4 - 0 !
4 files changed, 13 insertions(+), 14 deletions(-)

 reference correct local directory for debian

share/html/index.html | 6 3 + 3 - 0 !
1 file changed, 3 insertions(+), 3 deletions(-)

 don't include remote image references or redirects in broken install
 page

This fixes the lintian error privacy-breach-logo

docs/UPGRADING-4.2 | 6 3 + 3 - 0 !
1 file changed, 3 insertions(+), 3 deletions(-)

 debianize upgrading-4.2

etc/upgrade/4.1.0/schema.SQLite | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 fix upgrade problems caused by an rtx::assettracker installation bug

The setup of the wheezy rt4-extension-assettracker package
(RTx::AssetTracker 2.0.0b2) accidentally inserted two pairs of system role
accounts, causing upgrade failures on SQLite backends due to uniqueness
constraint violations.

Bug-Debian: https://bugs.debian.org/773343

lib/RT.pm | 4 1 + 3 - 0 !
1 file changed, 1 insertion(+), 3 deletions(-)

 load rt::generated directly from @inc

This allows for the possibility of overriding RT::Generated in test
scenarios.

lib/RT/Test.pm | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 allow overriding databasetype from the environment in rt::test

configure.ac | 8 4 + 4 - 0 !
share/html/Admin/Tools/Config/Elements/Option | 3 3 + 0 - 0 !
share/html/Elements/Footer | 2 1 + 1 - 0 !
3 files changed, 8 insertions(+), 5 deletions(-)

 extract the correct (debian) version number in configure.ac

Also make clear in the web interface that this version number is from
Debian.

etc/RT_Config.pm.in | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 use noto sans instead of droid sans

Droid Sans is deprecated in Debian, and we are using the fonts from
Debian rather than bundled with RT.

Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804687

lib/RT/Test.pm | 1 1 + 0 - 0 !
1 file changed, 1 insertion(+)

 set lc_all to c

LANG overrides only not set LC_variables, so if LC_CTYPE is set in the
environment, it persists and tons of tests fail.

lib/RT/Interface/Web.pm | 4 4 + 0 - 0 !
1 file changed, 4 insertions(+)

 force the use of cpanel::json::xs

JSON::XS breaks RT due to the removed from_json/to_json methods and JSON.pm
prefers JSON::XS to our preferred implementation Cpanel::JSON::XS by
default.

Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848041

etc/upgrade/upgrade-mysql-schema.pl | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix shebang for debian policy

t/externalauth/ldap.t | 12 9 + 3 - 0 !
t/externalauth/ldap_email_login.t | 11 9 + 2 - 0 !
t/externalauth/ldap_escaping.t | 11 9 + 2 - 0 !
t/externalauth/ldap_group.t | 11 9 + 2 - 0 !
t/externalauth/ldap_privileged.t | 11 9 + 2 - 0 !
t/ldapimport/group-callbacks.t | 11 9 + 2 - 0 !
t/ldapimport/group-import.t | 11 9 + 2 - 0 !
t/ldapimport/group-member-import.t | 11 9 + 2 - 0 !
t/ldapimport/group-rename.t | 11 9 + 2 - 0 !
t/ldapimport/user-import-cfs.t | 11 9 + 2 - 0 !
t/ldapimport/user-import-privileged.t | 11 9 + 2 - 0 !
t/ldapimport/user-import.t | 11 9 + 2 - 0 !
12 files changed, 108 insertions(+), 25 deletions(-)

 force use of ipv4 for ldap test.

Net::LDAP::Server::Test binds to IPv6 by default, but Net::LDAP uses
'localhost' which resolves to an IPv4 address.  Even when I switched
the call to Net::LDAP->new() to use ip6-localhost it failed elsewhere
due to RT using 127.0.0.1.

docs/extensions.pod | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 point to debian location of mason_data.

docs/authentication.pod | 2 1 + 1 - 0 !
docs/automating_rt.pod | 16 8 + 8 - 0 !
docs/customizing/assets/tutorial.pod | 6 3 + 3 - 0 !
docs/customizing/scrip_conditions_and_action.pod | 6 3 + 3 - 0 !
docs/customizing/search_result_columns.pod | 8 4 + 4 - 0 !
docs/extending/external_custom_fields.pod | 8 4 + 4 - 0 !
docs/extensions.pod | 7 3 + 4 - 0 !
docs/full_text_indexing.pod | 30 15 + 15 - 0 !
docs/incremental-export/README | 15 9 + 6 - 0 !
docs/initialdata.pod | 2 1 + 1 - 0 !
docs/reminders.pod | 2 1 + 1 - 0 !
docs/system_administration/database.pod | 10 5 + 5 - 0 !
docs/tracking-rt-configuration.pod | 10 5 + 5 - 0 !
13 files changed, 62 insertions(+), 60 deletions(-)

 use debian location of commands and data

docs/charts.pod | 52 10 + 42 - 0 !
1 file changed, 10 insertions(+), 42 deletions(-)

 on debian there is no need to install the gd modules if gd is
 desired.

etc/cpanfile | 1 0 + 1 - 0 !
1 file changed, 1 deletion(-)

 debian provides the mozilla cas in the ca-certificates package.

t/mail/smime/realmail.t | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 skip t/mail/smime/realmail.t for now.

Broken by OpenSSL 3.0 as the test emails use DES which is now disabled.

etc/cpanfile | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 downgrade dependency on gd::graph to >= 1.54

In Debian, we already have the fix for the XBM failing tests, which
is the only significant change in 1.56.

I'm keeping this patch to simplify backports to Bookworm.

t/mail/gnupg-reverification.t | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 don't run dirmngr during tests runs

This process is left running after the tests finish and prevents this
package from passing the reproducible builds.

docs/charts.pod | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix spelling in documentation

README.md | 9 1 + 8 - 0 !
1 file changed, 1 insertion(+), 8 deletions(-)

 don't include remote images in readme

This fixes a lintian privacy-breach-logo issue.

lib/RT/SearchBuilder.pm | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 drop unnecessary and outdated version requirement of
 DBIx::SearchBuilder

The updated version has already been specified in etc/cpanfile.

Besides, perl 5.40 doesn't like the weird version string "1.40"(numeric 1.40
is ok) and issues a warning:

    Attempt to call undefined import method with arguments ("1.40") via package "DBIx::SearchBuilder"

lib/RT/Test.pm | 16 10 + 6 - 0 !
1 file changed, 10 insertions(+), 6 deletions(-)

 change free port detection to how psgi binds to a port

The previous method using socket/connect would allow us to bind to a
port that PSGI then couldn't bind to. If a port is connected on
a specific IP, then using connect with 0.0.0.0 would still connect
okay.

Using IO::Socket::INET this will fail, which is reasonable for 0.0.0.0,
and then PSGI wouldn't be able to start and the test would fail.

This may resolve the intermittant test failures.

etc/RT_Config.pm | 24 24 + 0 - 0 !
lib/RT/Crypt/SMIME.pm | 2 1 + 1 - 0 !
lib/RT/Interface/Web.pm | 9 7 + 2 - 0 !
lib/RT/Interface/Web/Scrubber/Restrictive.pm | 148 148 + 0 - 0 !
share/html/Asset/Elements/TSVExport | 2 1 + 1 - 0 !
share/html/Elements/CollectionList | 4 2 + 2 - 0 !
share/html/Elements/TSVExport | 2 1 + 1 - 0 !
share/html/Helpers/Permalink | 4 4 + 0 - 0 !
share/html/Search/Build.html | 2 1 + 1 - 0 !
share/html/Search/Edit.html | 2 1 + 1 - 0 !
share/static/js/util.js | 13 12 + 1 - 0 !
11 files changed, 202 insertions(+), 10 deletions(-)

 fix four security issues in rt.

* RT is vulnerable to Cross Site Scripting via injection of malicious
  parameters in a search URL. This vulnerability is assigned CVE-2025-30087.
* RT uses the default OpenSSL cipher, 3DES (des3), for encrypting SMIME email.
  This is an outdated cipher algorithm, so the default is changed to
  aes-128-cbc. In addition, we have made this option configurable so you can
  pick an alternate cipher now or in the future, or revert to des3 if needed
  for compatibility. This vulnerability is assigned CVE-2025-2545.
* RT is vulnerable to Cross Site Scripting via JavaScript injection in an
  Asset name. This vulnerability is assigned CVE-2025-31501.
* RT is vulnerable to Cross Site Scripting via JavaScript injection in an RT
  permalink. This vulnerability is assigned CVE-2025-31500.

lib/RT/Interface/Web/Scrubber/Restrictive.pm | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 improve fix to cve-2025-30087

After releasing the fix for CVE-2025-30087, Best Practical became aware that
the new linking restrictions were too strict in some cases, causing legitimate
links to stop working. This is most pronounced for users running RTIR, where
many links stop working. This patch should resolve that.

t/web/helpers-http-cache-headers.t | 3 3 + 0 - 0 !
1 file changed, 3 insertions(+)

 fix test for 2025-04-08 cve patchset

docs/UPGRADING-5.0 | 44 21 + 23 - 0 !
1 file changed, 21 insertions(+), 23 deletions(-)

 debianize upgrading-5.0

docs/UPGRADING-4.4 | 36 19 + 17 - 0 !
1 file changed, 19 insertions(+), 17 deletions(-)

 debianize upgrading-4.4