[ Simon McVittie ] * ikisite backup: Create the bundle as the site's user, so the backup works when git run as root would consider the repository untrusted. * debian: Depend on python3-docutils instead of python-docutils Closes: #945656 * debian: smoke-files: The makesite test needs an extra file copied * debian: Use Testsuite: autopkgtest-pkg-perl

• Fix the test suite to work when ikiwiki-hosting is not installed.

• Avoid directly running init scripts, instead use the service command.
• Avoid running apache2ctl graceful which may start an apache process outside of systemd control (see bug #927302). (But note that certbot still uses apache2ctl graceful.)
• As ssh RSA keys are being deprecated in an upcoming ssh release, the gitpush plugin will generate a Ed25519 key for the site if one does not yet exist.
• The gitpush plugin, when listing the site's ssh keys, will list all available public keys, rather than just one.
• Fix anonymous git push to branchable sites, which has been broken since 2018 by a git behavior change.
• Fix ACL setting in ikisite enable to come after chmod, which otherwise would mess up the ACLs and break anonymous git push.
• Added hostname_stopwords config that can be used to prevent use of particular words in names of sites.
• ikisite enable, ikisite letsencrypt: When a fullchain file is available, use it for apache's SSLCertificateFile, and do not use the chain file. This avoids a problem with leteencrypt and apache where apache serves up 2 copies of the certificate, one from the cert file, and one from the fullchain file, which confuses some SSL clients.

• [ Joey Hess ]
  • ikisite: Deleting per-domain letsencrypt cert when a wildcard cert exists was too dangerous and buggy, including sometimes deleting the letsencrypt wildcard cert. Removed that behavior; any per-domain cert will be used in preference to the wildcard cert.
  • Further fix to IkiWiki::Hosting for syslog name change. (Fixes ikidns)
  • ikidns: Fix typo in letsencrypt command.
• [ Simon McVittie ]
  • debian: Pass dpkg-buildflags CFLAGS to make
  • debian: Override dh_missing to detect any files that are installed by dh_auto_install but not packaged

• [ Joey Hess ]
  • Renamed IkiWiki::Hosting::syslog to IkiWiki::Hosting::logger to avoid conflict with Sys::Syslog::syslog.
  • Prevent ikisite letsencrypt from unncessarily reloading apache when there is no configuration change. ikisite maintaincerts runs it once per site, and the resulting many reloads of apache close together tended to cause apache to fall over, due to bug #873115.
  • ikiwiki-hosting.conf: Removed wildcard_ssl_cert, wildcard_ssl_key, wildcard_ssl_chain, and in its place added wildcard_ssl_cert_dir.
  • ikidns: Added letsencrypt command, which generates wildcard certificates for the domains listed in ikiwiki-hosting.conf, using DNS verification. This needs the python3-certbot-dns-rfc2136 package to be installed, and ikidns to have already been used to configure the dns server.
  • ikisite letsencrypt: Avoid getting a per-domain cert when a usable wildcard cert exists.
  • ikisite letsencrypt: When a per-domain cert was already obtained, and a wildcard cert now exists, the per-domain cert will be deleted, and the wildcard cert used.
• [ Simon McVittie ]
  • build: Use set -e to trap failure in shell loops
  • build: Add a dist target to the Makefile
  • Move d/changelog to ./CHANGELOG
  • Separate upstream releases from Debian packaging
  • debian/control: Don't use autopkgtest-pkg-perl. Since 0.20160811 the autogenerated test list is not used.
  • ikiwiki-hosting-web: Depend on real package apache2-suexec-pristine in preference to virtual apache2-suexec
  • ikiwiki-hosting-web: Add missing dependency on lsb-base
  • debian/control: Declare compliance with Debian Policy 4.1.4