changelog

turnkey-tkldev-19.0 (1) turnkey; urgency=low

  * Upgraded base distribution to Debian 13.x/Trixie.

  * Update squid https proxy CA cert config so it generates a CA cert that is
    valid against current requirements.

  * TurnKey build tool (fab):

    - Bugfix:
      - Fix removelist bug where non-file non-dirs (e.g. symlinks or
        file-sockets) would not be removed.

    - New contrib convenience scripts for improved app-dev flow:
      - fab-investigate:
        - Interactivly enter and investigate an appliance chroot (fab-chroot
          with some extra setup and tear down).
      - fab-rewind:
        - Wind back build step/s.

    - ARM64 support:
      - Initial support for arm64 - incomplete, but now supports basic arm64
        builds.

    - Misc clean up and improvements in code and packaging. See fab release
      notes for full details.

  * Misc bootstrap updates and improvements.

  * Improvments to 'tkldev-setup' script which make it more useful for
    updating git repos - not just initial set up (perhaps needs a name
    change?).

  * Chroot management (turnkey-chroot):

    - Bugfix:
      - Fix 'mnt_profile' mutation bug. Special thanks to Marcos:
        https://github.com/marcos-mendez - https://popsolutions.co/

    - Features/improvements:
      - Mount /run (tmpfs) by default.
      - Make chroot system mount mounting/unmounting more robust.

    - Misc clean up and improvements in code and packaging. See
      turnkey-chroot release notes for full details.

  * Replace TurnKey custom Debian-Installer based 'di-live' with new custom
    TurnKey installer built from scratch; 'tkl-installer'.

  * Updated release signing keys & apt repo keys - now included as
    'turnkey-keys' deb package.

  * Replace legacy '.list' apt remote config files with Deb822 '.sources'
    files.

  * "Proper" IPv6 support. May still have some gaps and still requires cosmetic
     work but fully functional.

  * Improved fail2ban config:
    - Increased default findtime (10 minutes) & bumped maxretry (3) to minimize
      risk of user accidentally locking themself out.
    - Removed redundant v18.x custom patches.

  * Include 'zstd' by default to support smaller initramfs that unpacks faster.

  * Replace 'ifupdown' with 'ifupdown-ng' (and 'ifupdown-ng-compat').

  * Replace 'udhcpc' (IPv4 only) with 'dhcpcd-base' (dual stack ipv4/6). Also
    include custom TurnKey config (if-pre-up & if-post-down scripts provided by
    'tkl-dhcpcd-ifupdown-glue') to ensure DHCP config is in sync with
    /etc/network/interfaces file.

  * General code cleanup of TurnKey code; build code, build tools and TurnKey
    custom tools & libraries. Updates include linting, formating and style
    updates. Still WIP but solid start.

  * Configuration console (confconsole):
    - Bugfixes:
      - Support for firewall config when setting a static IP. Particularly
        affected OpenVPN (which ships with firewall enabled by default).
        Closes #2037.
      - Fix Let's Encrypt integration failing back-to-back runs. Closes #2121.
    - Features:
      - "Proper" support for IPv6:
        - Make ifutil.py module code "IPv6 aware", including reliable
          management of /etc/network/interfaces with "inet6" stanza/s.
        - Show IPv6 info on "usage" page - only shown if IPv6 configured.
          Special thanks to Marcos:
          https://github.com/marcos-mendez - https://popsolutions.co/
    - Misc clean up and improvements in code and packaging. See Confconsole
      release notes for full details.

  * Firstboot Initialization (inithooks):
    - Bugfixes:
      - Ensure everyboot scripts only run once per boot.
      - firstboot.d/15regen-sslcert:
        - Only services which are already running need to be restarted as
          restart is only to apply updated certs.
      - firstboot.d/01ipconfig:
        - Minor bugfix.
    - Features/improvements and other changes of significance:
      - Reimplement an 'inithooks.service' and refactor integration with
        getty1.
      - Delay start of inithooks/confconsole at boot time to reduce chance of
        boot messages overwriting inithooks/confconsole.
        - Developers - please note that hooks with a prefix less than '30' will
          still run early, so should _always_ be non-interactive.
      - TurnKey 'init-fence' (blocks web access at firstboot):
        - Run by default on all builds pre firstboot initialization (previously
          only enabled on "headless" builds).
        - New pre-seed variable 'AUTO_RUN' to skip interactive config
          (re-implements previous "headless" build functionality).
        - Replace legacy init.d script with systemd
          'turnkey-init-fence.service' (& script which is called by the
          service).
        - Add support for 'systemctl reload turnkey-init-fence.service' -
          which restarts 'simplehttpd.py' (init-fence mini web server) but does
          not disable the firewall rules.
        - Support for custom init-fence content.
        - Update dynamically generated SSH information for IPv6 address
          display.
        - Add IPv6 support to mini server.
    - Ensure inithook 'SEC_UPDATES' pre-seed variable test is case insensitive;
      eliminates risk of unintended behavior when pre-seeding.
    - Misc clean up and improvements in code and packaging. See Inithooks
      release notes for full details.

  * Web management console (webmin):
    - Upgraded Webmin to latest upstream.
    - Refactored TurnKey Webmin packaging process to support easier updates;
      with the intention of following upstream releases as closely as possible
      (provided via TurnKey apt repo).
    - Updated default Webmin config:
      - Listen on IPv6 by default.
      - Preconfigured IPv6 firewall matching IPv4 rules (but not enabled - as
        per historical IPv4 default).
      - Auto redirect http => https.
      - Default 30 min user logout (can be overridden via login page "remember
        me" checkbox or webmin "authentication" config).
      - Updated logging paths and fixed log file rotation.

  * Backup (tklbam):
    - Bugfixes:
      - Fix broken help pager (not sure how long that has been broken!?).
      - Fix broken tar command (deprecated functionality removed in Debian
        Trixie).
    - Features/improvements:
      - Migrate core program and direct dependency python2 runtime from
        cpython2 (EOL) to Pypy (still supported - packaged by TurnKey).
      - Migrate all other components to python3.
        Note: remaining python2 TKLBAM code port to python3 is in progress but
        no ETA yet...
    - Misc clean up and improvements in code and packaging. See TKLBAM release
      notes for full details.

  * Misc code cleanup and improvements.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Thu, 16 Jul 2026 17:35:02 +1000

turnkey-tkldev-18.1 (1) turnkey; urgency=low

  * v18.1 rebuild - includes latest Debian & TurnKey packages.

  * Clone "core" buildcode on firstboot - reintroduce previous default
    behaviour - closes #1857.

  * Ensure hashfile includes URL to public key - closes #1864.

  * Web management console (webmin):
    - Include webmin-logviewer module by default - closes #1866.
    - Upgraded webmin to v2.105.
    - Replace webmin-shell with webmin-xterm module by default - closes #1904.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Fri, 05 Jul 2024 11:17:04 +0000

turnkey-tkldev-18.0 (1) turnkey; urgency=low

  * Upgraded base distribution to Debian 12.x/Bookworm.

  * Configuration console (confconsole):
    - Support for DNS-01 Let's Encrypt challenges.
      [ Oleh Dmytrychenko <dmytrychenko.oleh@gmail.com> github: @NitrogenUA ]
    - Support for getting Let's Encrypt cert via IPv6 - closes #1785.
    - Refactor network interface code to ensure that it works as expected and
      supports more possible network config (e.g. hotplug interfaces & wifi).
    - Show error message rather than stacktrace when window resized to
      incompatible resolution - closes  #1609.
      [ Stefan Davis <stefan@turnkeylinux.org> ]
    - Bugfix exception when quitting configuration of mail relay.
      [ Oleh Dmytrychenko <dmytrychenko.oleh@gmail.com> github: @NitrogenUA ]
    - Improve code quality: implement typing, fstrings and make (mostly) PEP8
      compliant.
      [Stefan Davis <stefan@turnkeylinux.org> & Jeremy Davis

  * Firstboot Initialization (inithooks):
    - Refactor start up (now hooks into getty process, rather than having it's
      own service).
      [ Stefan Davis <stefan@turnkeylinux.org> ]
    - Refactor firstboot.d/01ipconfig (and 09hostname) to ensure that hostname
      is included in dhcp info when set via inithooks.
    - Package turnkey-make-ssl-cert script (from common overlay - now packaged
      as turnkey-ssl). Refactor relevant scripts to leverage turnkey-ssl.
    - Refactor run script - use bashisms and general tidying.
    - Show blacklisted password characters more nicely.
    - Misc packaging changes/improvements.
    - Support returning output from MySQL - i.e. support 'SELECT'. (Only
      applies to apps that include MySQL/MariaDB).

  * Web management console (webmin):
    - Upgraded webmin to v2.0.21.
    - Removed stunnel reverse proxy (Webmin hosted directly now).
    - Ensure that Webmin uses HTTPS with default cert
      (/etc/ssl/private/cert.pem).
    - Disabled Webmin Let's Encrypt (for now).

  * Web shell (shellinabox):
    - Completely removed in v18.0 (Webmin now has a proper interactive shell).

  * Backup (tklbam):
    - Ported dependencies to Debian Bookworm; otherwise unchanged.

  * Security hardening & improvements:
    - Generate and use new TurnKey Bookworm keys.
    - Automate (and require) default pinning for packages from Debian
      backports. Also support non-free backports.

  * IPv6 support:
    - Adminer (only on LAMP based apps) listen on IPv6.
    - Nginx/NodeJS (NodeJS based apps only) listen on IPv6.

  * Misc bugfixes & feature implementations:
    - Remove rsyslog package (systemd journal now all that's needed).
    - Include zstd compression support.
    - Enable new non-free-firmware apt repo by default.
    - Improve turnkey-artisan so that it works reliably in cron jobs (only
      Laravel based LAMP apps).

  * TKLDev specific updates/tweaks below:

  * fab:
    - Improve typing and implement fstrings.
    - Improved code styling (mostly PEP8 compliant now).
    - Support debug logging via '-d|--debug' switch.
    [ Stefan Davis <stefan@turnkeylinux.org> & Jeremy Davis ]
    - Ensure that pool doesn't choke on invalid versions generated from git
      tags.
    - Default pool-info to use '--registered' - closes #1699.
    [ Stefan Davis <stefan@turnkeylinux.org> ]
    - Properly handle branch names that include a slash ('/') - closes #1761.
    [ Stefan Davis <stefan@turnkeylinux.org> ]

  * autoversion:
    - Typing and code style updates/improvements (mostly PEP8 compliant now).
    - Now defaults to 'autoversion HEAD' if no args given.
    - support for debian style branch/tag names (i.e. owner/branch or
      owner/tag - e.g. debian/dev or debian/2.1.4).

  * bootstrap:
    - Update to streamline build process - add install target to install
      bootstrap into tkldev.
    [ Stefan Davis <stefan@turnkeylinux.org> ]
    - add lsb_release as bootstrap dependency.
    [ Stefan Davis <stefan@turnkeylinux.org> ]

  * misc:
    - Require RELEASE to be set (rather than CODENAME). Falls back to current
      host if not set (eases transition).
    - Include tkldev-changelog, fab-rewind & fab-investigate scripts in TKLDev
      by default.
    - Support setting NODE_VER / RBY_VER (NodeJS / Ruby versions respectively)
      from Makefile (only applies to apps that include NodeJS/Ruby).

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Wed, 30 Aug 2023 04:23:46 +0000

turnkey-tkldev-17.2 (1) turnkey; urgency=low

  * Rebuild to include latest fab (v1.0.2) improvements/bugfixes.

  * Add preliminary support for Raspberry Pi. (Much more work required to
    complete this - but it's a start).
    [Yannick Heneault <https://github.com/heneault>]

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Tue, 14 Feb 2023 05:50:24 +0000

turnkey-tkldev-17.1 (1) turnkey; urgency=low

  * Updated all Debian packages to latest.
    [ autopatched by buildtasks ]

  * Patched bugfix release. Closes #1734.
    [ autopatched by buildtasks ]

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Tue, 12 May 2022 01:41:55 +0000

turnkey-tkldev-17.0 (1) turnkey; urgency=low

  * Upgraded base distribution to Debian 11.1/Bullseye.

  * caching proxy:

    - Switch from Polipo (only cached http and is no longer available in
      Debian) to Squid. Squid is configured as a caching http/https proxy.
      Using 'squid-openssl' package, it is configured to act as a MITM (man in
      the middle) caching proxy - closes #1560.

  * fab:

    - Port code to python3 and major code refactoring.
    - Use new 'turnkey-chroot' library for use in 'fab-chroot'.
    - Use xorriso (instead of genisoimage) for generating ISO. This provides
      UEFI boot support (note this only supports booting the ISO via UEFI;
      additional work in di-live required to complete UEFI install support).
      Part of #1435.
      NOTE: The UEFI support started for v17.0 di-live and ISO builds has been
      (temporarily) rolled back and won't be implemented in v17.0.

  * pool:

    - Port code to python3 and major code refactoring. Closes #1272.
    - (Still not pre-installed by default).

  * bootstrap:

    - Include 'ca-certificates' package (to support https apt repos via squid
      https proxy).

  * corestrap:

    - Support the option of using a "corestrap", rather than a minimalist
      bootstrap. A corestrap is a bootstrap, but with all core packages
      (except the kernel) pre-installed. It is larger than the bootstrap, but
      speeds up builds significantly.

  * Note: Please refer to turnkey-core's 17.0 changelog for changes common to
    all appliances. Here we only describe changes specific to this appliance.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Fri, 01 Apr 2022 03:49:39 +0000

turnkey-tkldev-16.1 (1) turnkey; urgency=low

  * Include debootstrap package by default - closes #1450.

  * Minor tweak to bootstrap generation to provide transition guidance.

  * Note: Please refer to turnkey-core's 16.1 changelog for changes common to
    all appliances. Here we only describe changes specific to this appliance.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Thu, 20 May 2021 18:48:58 +1000

turnkey-tkldev-16.0 (1) turnkey; urgency=low

  * No longer include pool, chanko and friends by default. tkldev-chanko-setup
    script has been tweaked and some config setup has been moved to package
    postinst scripts.

    TODO: more work is still required to make it possible for users to easily
          build packages. Plus the buildroot repo needs update.

  * fab:

    - major changes to way that the bootstrap is built. Now leverages Debian's
      debootstrap directly (bootstrap components removed from fab, remaining
      changes in turnkey/bootstrap repo).

  * buildtasks:

    - significant refactoring, including inclusion of bt-bootstrap script to
      build bootstrap if relevant bootstrap not currently available.
    - updates to most bt- scripts for Buster.
    - refactoring of bin/signature-verify to support forcing check of hashfile
      GPG signing via '--force-gpg' switch (default behaviour remains unsigned
      files just giving warning).

  * tkldev-setup:

    - refactor to give more meaningful output.
    - change order of repo cloning (now 1st) & bootstrap download (now 2nd).
    - leverage buildtasks/config/common.cfg (fallback to config.example if not
      setup) to set relevant GPG key ID (BT_GPGKEY).
    - leverage buildtasks/bin/signature-verify script to check downloaded
      bootstrap file.

  * Docs:

    - additional development docs now included in build code repo (none
      included in built appliance by default; yet).
    - many docs rewritten and/or improved.
    - many docs still outdated and/or in need of improvement. :(

  * Note: Please refer to turnkey-core's changelog for changes common to all
    appliances. Here we only describe changes specific to this appliance.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Fri, 27 Mar 2020 16:23:05 +1100

turnkey-tkldev-15.0 (1) turnkey; urgency=low

  * Replace auFS support with OverlayFS support (new default Debian union 
    filesystem).
    [ Stefan Davis ]

  * New packages:

    - dirmngr - new dependency for tkldev-setup
    [ Stefan Davis ]
    - tklpatch - required for buildtasks optimized builds

  * tkldev-setup

    - updated to use .hash files (previously .sig files)
    [ Stefan Davis ]
    - include tklbam-profiles - closes #1067.

  * fab, pool, deckdebuild, chanko, autoversion & repo:

    - packages are now reproducible (security)
      [ Chris Lamb ]

  * deck:

    - complete rewrite (as bash script) to support OverlayFS
      [ Alon Swartz, Stefan Davis, Anton Pyrogovskyi & Jeremy Davis ]

  * Note: Please refer to turnkey-core's changelog for changes common to all
    appliances. Here we only describe changes specific to this appliance.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Mon, 18 Jun 2018 09:39:51 +1000

turnkey-tkldev-14.2 (1) turnkey; urgency=low

  * Included buildtasks - supports building optimized builds.

  * Included pool & chanko - supports building Debian packages from source
    and building appliances offline. 

  * Installed security updates.

  * Note: Please refer to turnkey-core's changelog for changes common to all
    appliances. Here we only describe changes specific to this appliance.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Fri, 21 Jul 2017 19:03:44 +1000

turnkey-tkldev-14.1 (1) turnkey; urgency=low

  * Adjusted confconsole text so it is clear that Webmin & Webshell are 
    disabled by default (#342).

  * Note: Please refer to turnkey-core's changelog for changes common to all
    appliances. Here we only describe changes specific to this appliance.

 -- Jeremy Davis <jeremy@turnkeylinux.org>  Wed, 17 Feb 2016 17:40:20 +1100

turnkey-tkldev-14.0 (1) turnkey; urgency=low

  * Includes tkldev-setup script executed on firstboot.

  * Improved documentation.

  * Miscellaneous:

    - Fab: root.tmp has been renamed to root.sandbox.
    - Fab: pre-process ISO's with iso-hybrid.
    - Common: updated cdroot-dynamic and cdroots/gfxboot-turnkey.

  * Note: Please refer to turnkey-core's changelog for changes common to all
    appliances. Here we only describe changes specific to this appliance.

 -- Alon Swartz <alon@turnkeylinux.org>  Wed, 06 May 2015 12:01:55 +0300

turnkey-tkldev-13.0 (1) turnkey; urgency=low

  * Related bugfixes and tweaks:

    - Deck: improved deck.is_dirty logic (bugfix).
    - Fab: removed release specific mksquashfs binaries.
    - Fab: support MKSQUASHFS override if set in environment.
    - Common: use release codename from build system instead of hardcoding.
    - Bugfixed and improved documentation.

  * Note: Please refer to turnkey-core's changelog for changes common to all
    appliances. Here we only describe changes specific to this appliance.

 -- Alon Swartz <alon@turnkeylinux.org>  Fri, 11 Oct 2013 11:43:49 +0300

turnkey-tkldev-12.1 (1) turnkey; urgency=low

  * Initial public release of TKLDev.

  * TKLDev related:

    - Full usage and development documentation.
    - Includes TurnKey developed components: fab, deck and friends.
    - Turnkey development directory structure with preconfigured CDPATH.
    - Integrated caching proxy for fast and iterative development.
    - Webmin and shellinabox included but disabled by default.

  * Note: Please refer to turnkey-core's changelog for changes common to all
    appliances. Here we only describe changes specific to this appliance.

 -- Alon Swartz <alon@turnkeylinux.org>  Tue, 02 Jul 2013 18:56:00 +0300