dak/docs/release.txt

Notes from the Debian bookworm release
======================================

Some notes from the Debian bookworm release including some
corrections. There might still be errors.

configdir=${configdir:-"/srv/ftp-master.debian.org/dak/config/debian"}
export SCRIPTVARS=${configdir}/vars
. "${SCRIPTVARS}"
. "${configdir}/common"
. "${configdir}/dinstall.functions"
umask 022

xpsql() {
  psql "${sql_opts[@]}" "${@}"
}

sql() {(
  set -eu
  xpsql -qAt "${@}"
)}

rename-suite() {(
  set -xeu

  local oldsuite="${1:?}"
  local newsuite="${2:?}"
  archive_path=$(sql -c "SELECT path FROM archive WHERE id=(SELECT archive_id FROM suite WHERE suite_name='${oldsuite}')")

  cd ${archive_path:?}/dists
  if [[ -L ${newsuite} || -e ${newsuite} ]]; then
    echo "E: ${newsuite} already exists" >&2
    exit 1
  fi

  mv -nT -- ${oldsuite} ${newsuite}

  sql -1 <<-EOT
	UPDATE suite
	SET
	  suite_name='${newsuite}',
	  copychanges = CASE WHEN copychanges IS NULL THEN NULL ELSE 'dists/${newsuite}' END
	WHERE suite_name='${oldsuite}'
	;
	UPDATE suite
	SET overridesuite='${newsuite}'
	WHERE overridesuite='${oldsuite}'
	;
	EOT
)}

rename-policy-queue() {(
  set -xeu
  oldqueue="${1:?}"
  newqueue="${2:?}"
  newpath="${3:?}"
  oldpath=$(sql -c "SELECT path FROM policy_queue WHERE queue_name='${oldqueue}'")
  if [[ -L ${newpath} || -e ${newpath} ]]; then
    echo "E: ${newpath} already exists" >&2
    exit 1
  fi
  mv -nT -- ${oldpath:?} ${newpath}
  sql -c "UPDATE policy_queue SET queue_name='${newqueue}', path='${newpath}' WHERE queue_name='${oldqueue}'"
)}

export new_stable_version=12
export new_stable_date='10 June 2023'
export new_stable_short_date='Sat, 10 Jun 2023'

export new_oldoldoldstable=""
export new_oldoldstable=buster
export new_oldstable=bullseye
export new_stable=bookworm
export new_testing=trixie

export new_stable_components="main contrib non-free-firmware non-free"
export new_testing_components="main contrib non-free-firmware non-free"

export new_oldoldoldstable_key=E1CF20DDFFE4B89E802658F1E0B11894F66AEC98
export new_oldoldoldstable_security_key=6ED6F5CB5FA6FB2F460AE88EEDA0D2388AE22BA9
export new_oldoldstable_key=80D15823B7FD1561F9F7BCDDDC30D7C23CBBABEE
export new_oldoldstable_security_key=5E61B217265DA9807A23C5FF4DFAB270CAA96DFA
export new_oldstable_key=1F89983E0081FDE018F3CC9673A4F27B8DD47936
export new_oldstable_security_key=AC530D520F2F3269F5E98313A48449044AAD5C5D
export new_stable_key=B8B80B5B623EAB6AD8775C45B7C5D7D6350947F8
export new_stable_security_key=05AB90340C0C5E797F44A8C8254CF3B5AEC0A8F0

export di_version=20230607

sql_vars=(new_stable_version new_stable_date new_oldoldoldstable new_oldoldstable new_oldstable new_stable new_testing new_oldoldstable_key new_oldoldstable_security_key new_oldstable_key new_oldstable_security_key new_stable_key new_stable_security_key)
sql_opts=()
for v in ${sql_vars[@]}; do
  sql_opts+=(--set="${v}=${!v}")
done

if [[ -n "${new_oldoldoldstable}" ]]; then
  rename-suite {,old}oldoldstable
  rename-suite {,old}oldoldstable-updates
  rename-suite {,old}oldoldstable-debug
fi

# Careful! Some suites might have stable-X symlinks, but not use the
# name in the database.  We used to fix these symlinks later, but
# sometimes the newer testing-X suite now uses the name in the
# database, blocking the rename here until the (older) stable-X
# symlink is fixed...

rename-suite {,old}oldstable
rename-suite {,old}oldstable-debug
# buster-updates has suite_name=buster-updates, but release_suite needs to be updated to oldoldstable-updates
#rename-suite {,old}oldstable-updates
rename-suite {,old}oldstable-proposed-updates
rename-suite {,old}oldstable-proposed-updates-debug
rename-suite buildd-{,old}oldstable-proposed-updates
rename-suite {,old}oldstable-new
rename-policy-queue oldstable-new oldoldstable-new /srv/ftp-master.debian.org/queue/o-o-p-u-new
rename-suite buildd-{,old}oldstable-backports-sloppy
rename-suite {,old}oldstable-backports-sloppy
rename-suite {,old}oldstable-backports-sloppy-debug
# trixie release: might also need to rename more backports suites here!

rename-suite {,old}stable
rename-suite {,old}stable-debug
rename-suite {,old}stable-updates
rename-suite {,oldstable-}proposed-updates
rename-suite {,oldstable-}proposed-updates-debug
rename-suite {,old}stable-new
rename-suite buildd-{,oldstable-}proposed-updates
rename-policy-queue stable-new oldstable-new /srv/ftp-master.debian.org/queue/o-p-u-new
rename-suite {,old}stable-backports-sloppy
rename-suite {,old}stable-backports-sloppy-debug
rename-suite buildd-{,old}stable-backports-sloppy
# trixie release: might also need to rename more backports suites here!

rename-suite testing stable
rename-suite testing-debug stable-debug
rename-suite testing-proposed-updates proposed-updates
rename-suite testing-proposed-updates-debug proposed-updates-debug
rename-suite {testing,stable}-updates
rename-suite {testing,stable}-backports
rename-suite {testing,stable}-backports-debug
rename-suite buildd-{testing,stable}-backports
rename-suite buildd-{testing-,}proposed-updates
# trixie release: might also need to rename more backports suites here!

UPDATE SUITES:

begin;

-- update suites:

update suite set
  version = concat(:'new_stable_version', '.0'),
  description = concat('Debian ', :'new_stable_version', '.0 Released ', :'new_stable_date'),
  changelog = null, overrideprocess = false, overrideorigin = null, allowcsset = false, announce = array['debian-changes@lists.debian.org'], validtime = 0 where codename = :'new_stable';
update suite set
  version = concat(:'new_stable_version', '.0'),
  description = concat('Debian ', :'new_stable_version', '.0 Released ', :'new_stable_date', ' - Debug Information'),
  allowcsset = false, validtime = 0 where codename = concat(:'new_stable', '-debug');

update suite set copychanges = 'dists/oldoldstable-proposed-updates', validtime = 0 where codename = concat(:'new_oldoldstable', '-proposed-updates');
update suite set release_suite = 'oldoldstable-updates', validtime = 0 where codename = concat(:'new_oldoldstable', '-updates');

update suite set copychanges = 'dists/oldstable-proposed-updates', overridesuite = 'oldstable' where codename = concat(:'new_oldstable', '-proposed-updates');
update suite set release_suite = 'oldstable-updates' where codename = concat(:'new_oldstable', '-updates');

update suite set
  version = concat(:'new_stable_version', '-updates'),
  description = concat('Debian ', :'new_stable_version', ' - Proposed Updates'),
  copychanges = 'dists/proposed-updates', overridesuite = 'stable', announce = array['debian-changes@lists.debian.org'] where codename = concat(:'new_stable', '-proposed-updates');
update suite set release_suite = 'stable-updates' where codename = concat(:'new_stable', '-updates');

update suite set
  version = concat(:'new_stable_version', '-updates'),
  description = concat('Debian ', :'new_stable_version', ' - Proposed Updates - Debug Information')
  where codename = concat(:'new_stable', '-proposed-updates-debug');

update suite set
  version = concat(:'new_stable_version', '-updates'),
  description = concat('Debian ', :'new_stable_version', ' - Updates')
  where codename = concat(:'new_stable', '-updates');

update suite set untouchable = true where codename in (:'new_oldoldstable', :'new_stable', concat(:'new_stable', '-debug'), concat(:'new_oldoldstable', '-proposed-updates'), concat(:'new_oldoldstable', '-updates'));

-- remember to switch to new_stable_key later...
update suite set signingkeys = ARRAY[:'new_oldoldstable_key', :'new_oldstable_key'] WHERE suite_name LIKE 'buildd-%' OR suite_name LIKE concat(:'new_stable', '%') OR suite_name IN ('stable', 'stable-debug', 'proposed-updates', 'proposed-updates-debug', 'experimental', 'experimental-debug', 'unstable', 'unstable-debug', 'unstable-data');
update suite set signingkeys = ARRAY[:'new_oldoldstable_key', :'new_oldstable_key'] WHERE suite_name LIKE 'oldstable%' OR suite_name LIKE concat(:'new_oldstable', '%');

commit;

# The previous SQL block sets oldoldstable-p-u, oldoldstable-updates to untouchable.
# But we want to regenerate the Release files to have the updated Suite: field.
# Ideally we also want to sign it with the old keys.
# (Note: There was no problem with oldoldstable-updates (buster-updates) during
# the bookworm release as the suite_name was using the codename...)
# Needs to be looked at for trixie.

MOVE STUFF AROUND:

cd /srv/ftp-master.debian.org/ftp/dists

rm oldstable-backports oldstable-proposed-updates oldstable-updates
ln -sTf ${new_oldstable}-backports oldstable-backports
ln -sTf ${new_oldstable}-proposed-updates oldstable-proposed-updates
ln -sTf ${new_oldstable}-updates oldstable-updates

rm stable-backports stable-proposed-updates stable-updates
ln -sTf ${new_stable}-backports stable-backports
ln -sTf ${new_stable}-proposed-updates stable-proposed-updates
ln -sTf ${new_stable}-updates stable-updates

rm testing testing-proposed-updates testing-updates
ln -sTf ${new_testing} testing
ln -sTf ${new_testing}-proposed-updates testing-proposed-updates
ln -sTf ${new_testing}-updates testing-updates

ln -sT ${new_stable} Debian${new_stable_version}.0

cd ${base}/archive/debian-debug/dists
# fix symlinks there too...

# update README files
cd ${ftpdir}
sensible-editor README README.html dists/README
rm -- README~ README.html~ dists/README~

# remove pdiffs for new stable
cd ${base}/archive/debian-debug
rm -r dists/${new_stable}-debug/*/*.diff dists/${new_stable}-debug/*/*/*.diff
cd ${ftpdir}
rm -r dists/${new_stable}/*/*.diff dists/${new_stable}/*/*/*.diff
rm dists/${new_stable}/ChangeLog*
# add new dists/${new_stable}/ChangeLog:
cd /srv/ftp-master.debian.org/ftp/dists/${new_stable}
cat >ChangeLog <<EOT
=========================================
${new_stable_short_date} - Debian ${new_stable_version}.0 released
=========================================
EOT

# check win32-loader!
#  - even copy in testing/ might be outdated.

cd /srv/ftp-master.debian.org/public/incoming.debian.org/web/debian-buildd/dists
# This already looked fine during bookworm release.
#rm buildd-${new_stable}-proposed-updates buildd-${new_oldstable}-proposed-updates
#mv -nT buildd-proposed-updates buildd-${new_oldstable}-proposed-updates
#mv -nT buildd-testing-proposed-updates buildd-${new_stable}-proposed-updates
#ln -sT buildd-${new_oldstable}-proposed-updates buildd-oldstable-proposed-updates
#ln -sT buildd-${new_stable}-proposed-updates buildd-proposed-updates

D-I CLEANUP:
cd /srv/ftp-master.debian.org/ftp/dists/${new_stable}/main
morgue=/srv/ftp-master.debian.org/morgue/d-i
for arch in installer-*; do
  for version in ${arch}/20*; do
    case ${version} in
      */${di_version}) ;;
      *) mv -nv -- ${version} ${morgue}/${arch}/ ;;
    esac
  done
done

INDICES:
suite=stable
dak generate-packages-sources2 --force -s ${suite},${suite}-debug
dak contents generate -f -s ${suite} -a ftp-master

for suite in stable stable-debug oldstable oldstable-debug ${new_oldstable}-updates oldoldstable oldoldstable-debug ${new_oldoldstable}-updates; do
  dak generate-releases -f -s ${suite}
done

for suite in oldoldstable oldoldstable-debug ${new_oldoldstable}-updates oldstable oldstable-debug stable stable-debug; do
  ${scriptsdir}/sync-release ${suitename}
done

mkdir -p ~/${new_stable}_${new_stable_version}.0
cp -r ${ftpdir}/zzz-dists ~/${new_stable}_${new_stable_version}.0/zzz-dists-pre-signature-merge
cp -r ${base}/archive/debian-debug/zzz-dists ~/${new_stable}_${new_stable_version}.0/debug-zzz-dists-pre-signature-merge

# Add signatures from release team
# Import function `merge-release-signatures` from config/debian/pointrelease

suitename=${new_stable:?}
newrev=${new_stable_version:?}.0
release_base=https://release.debian.org/proposed-updates/${newrev%%.*}/${newrev}
wget="wget --ca-directory=/etc/ssl/ca-debian"

set -x
# stable
for suite in oldstable oldoldstable; do
  merge-release-signatures $(get_archiveroot ftp-master) ${suite} Release.gpg Release Release-${suite}.gpg https://release.debian.org/proposed-updates/${new_stable_version}/${new_stable_version}.0/sigs/Release-${suite}.gpg
  merge-release-signatures $(get_archiveroot ftp-master) ${suite} InRelease "" InRelease-${suite}.gpg https://release.debian.org/proposed-updates/${new_stable_version}/${new_stable_version}.0/sigs/InRelease-${suite}.gpg
done
for suite in stable-debug oldstable-debug oldoldstable-debug; do
  merge-release-signatures $(get_archiveroot debian-debug) ${suite} Release.gpg Release Release-${suite}.gpg https://release.debian.org/proposed-updates/${new_stable_version}/${new_stable_version}.0/sigs/Release-${suite}.gpg
  merge-release-signatures $(get_archiveroot debian-debug) ${suite} InRelease "" InRelease-${suite}.gpg https://release.debian.org/proposed-updates/${new_stable_version}/${new_stable_version}.0/sigs/InRelease-${suite}.gpg
done

# mirror push (CD MIRROR ONLY!)
(
  export SCRIPTVARS=${configdir}/vars
  . "${SCRIPTVARS}"
  . "${configdir}/common"
  . "${configdir}/dinstall.functions"
  umask 022
  mirror
  mirrorpush-release
)

# switch to new signing key:
update suite set signingkeys = ARRAY[:'new_oldstable_key', :'new_stable_key'] where signingkeys is not null;

${NEW_STABLE}-R0:
dak admin suite add ${new_stable}-r0 '' description='Extraneous packages/sources required for GPL compliance' origin=Debian label=Debian codename=${new_stable}-r0 accept_source_uploads=false accept_binary_uploads=false archive=ftp-master
dak admin s-c add ${new_stable}-r0 ${new_stable_components}
dak admin s-a add ${new_stable}-r0 $(dak admin s-a list-arch stable)

dak control-suite -l stable | grep '^debian-installer ' | dak control-suite -a ${new_stable}-r0
dak control-suite -l ${new_stable}-r0

begin;
  update suite set untouchable=true where codename=concat(:'new_stable', '-r0');
commit;

POLICY QUEUES:
dak admin suite add stable-new '' codename=${new_stable}-new accept_source_uploads=false accept_binary_uploads=false archive=policy

begin;
insert into policy_queue (queue_name, path, change_perms, suite_id) values ('stable-new', '/srv/ftp-master.debian.org/queue/p-u-new', '0644', (select id from suite where codename=concat(:'new_stable', '-new')));
update suite set policy_queue_id = (select id from policy_queue where queue_name = 'stable-new') where codename = concat(:'new_stable', '-proposed-updates');
commit;

dak admin s-c add stable-new ${new_stable_components}
dak admin s-a add stable-new source all $(dak admin s-a list-arch stable)

NEW TESTING:
dak admin suite add testing '' origin=Debian label=Debian codename=${new_testing} description='Debian x.y Testing distribution - Not Released' accept_source_uploads=false accept_binary_uploads=false allowcsset=True archive=ftp-master changelog_url='https://metadata.ftp-master.debian.org/changelogs/@CHANGEPATH@_changelog'
dak admin s-c add testing ${new_testing_components}
dak admin s-a add testing source all $(dak admin s-a list-arch stable)

dak admin suite add testing-debug '' origin=Debian label='Debian debug' codename=${new_testing}-debug description='Debian x.y Testing distribution - Not Released - Debug Information' accept_source_uploads=false accept_binary_uploads=false allowcsset=True archive=debian-debug
dak admin s-c add testing-debug ${new_testing_components}
dak admin s-a add testing-debug source all $(dak admin s-a list-arch stable)

dak admin suite add testing-proposed-updates '' origin=Debian label=Debian codename=${new_testing}-proposed-updates description='Debian x.y Testing distribution - Proposed Updates - Not Released' allowcsset=True archive=ftp-master
dak admin s-c add testing-proposed-updates ${new_testing_components}
dak admin s-a add testing-proposed-updates source all $(dak admin s-a list-arch stable)

dak admin suite add testing-proposed-updates-debug '' origin=Debian label='Debian debug' codename=${new_testing}-proposed-updates-debug description='Debian x.y Testing - Proposed Updates - Not Released - Debug Information' accept_source_uploads=false accept_binary_uploads=false archive=debian-debug
dak admin s-c add testing-proposed-updates-debug ${new_testing_components}
dak admin s-a add testing-proposed-updates-debug source all $(dak admin s-a list-arch stable)

dak admin suite add testing-updates '' origin=Debian label=Debian codename=${new_testing}-updates description='Debian x.y Testing distribution Updates - Not Released' accept_source_uploads=false accept_binary_uploads=false allowcsset=True archive=ftp-master
dak admin s-c add testing-updates ${new_testing_components}
dak admin s-a add testing-updates source all $(dak admin s-a list-arch stable)

for c in ${new_testing_components}; do
  for t in deb dsc udeb; do
    dak control-overrides -s stable -t ${t} -c ${c} -l | dak control-overrides -s testing -t ${t} -c ${c} --set
  done
done

time dak update-suite stable testing

# update-suite doesn't work for testing-debug (as there are no source packages)
#time dak update-suite stable-debug testing-debug
begin;
  insert into bin_associations (suite, bin)
  select
    (select id from suite where codename = concat(:'new_testing', '-debug')) as suite,
    bin
  from bin_associations
  where suite = (select id from suite where codename = concat(:'new_stable', '-debug'));
commit;

begin;
  update suite set changelog = concat('dists/', :'new_testing', '/ChangeLog'), overrideprocess=true, overrideorigin = 'unstable' where codename = :'new_testing';
  update suite set announce=array['debian-testing-changes@lists.debian.org'] where codename in (:'new_testing', concat(:'new_testing', '-proposed-updates'));
  update suite set overridesuite = 'testing' where codename in (:'new_testing', concat(:'new_testing', '-proposed-updates'), concat(:'new_testing', '-updates'));
  update suite set signingkeys = array[:'new_oldstable_key', :'new_stable_key'], separate_contents_architecture_all=true where codename in (:'new_testing', concat(:'new_testing', '-debug'), concat(:'new_testing', '-proposed-updates'), concat(:'new_testing', '-proposed-updates-debug'), concat(:'new_testing', '-updates'));

  update suite set debugsuite_id = (select id from suite where codename = concat(:'new_testing', '-debug')) where codename = :'new_testing';
  update suite set debugsuite_id = (select id from suite where codename = concat(:'new_testing', '-proposed-updates-debug')) where codename = concat(:'new_testing', '-proposed-updates');

  update suite set indices_compression = array['xz'], byhash=true, checksums=array['sha256'] where suite_name in ('testing-debug', 'testing-proposed-updates-debug', 'buildd-testing-proposed-updates', 'testing-proposed-updates', 'testing-updates');
  update suite set indices_compression = array['gzip', 'xz'], byhash=true, checksums=array['md5sum', 'sha256'] where suite_name = 'testing';
commit;

dak external-overrides copy unstable testing

dak admin s add-build-queue testing-proposed-updates buildd-testing-proposed-updates buildd-${new_testing}-proposed-updates build-queues

cd /srv/ftp-master.debian.org/public/incoming.debian.org/web/debian-buildd/dists
mkdir buildd-${new_testing}-proposed-updates
ln -sT buildd-${new_testing}-proposed-updates buildd-testing-proposed-updates

MOVE MOVING AROUND:
cd /srv/ftp-master.debian.org/queue
mv -nT oldstable-proposed-updates oldoldstable-proposed-updates
mv -nT proposed-updates oldstable-proposed-updates
mkdir -p p-u-new/COMMENTS proposed-updates

V-C:
dak admin v-c add testing-proposed-updates Enhances testing
dak admin v-c add testing-proposed-updates MustBeOlderThan experimental
dak admin v-c add testing-proposed-updates MustBeNewerThan stable
dak admin v-c add testing-proposed-updates MustBeNewerThan oldstable
dak admin v-c add testing-proposed-updates MustBeNewerThan oldoldstable
dak admin v-c add testing-updates Enhances testing
dak admin v-c add testing-proposed-updates MustBeNewerThan testing
dak admin v-c add testing-updates MustBeNewerThan testing
dak admin v-c add testing-updates MustBeOlderThan experimental
dak admin v-c add testing-updates MustBeNewerThan stable
dak admin v-c add testing-updates MustBeNewerThan oldstable
dak admin v-c add testing-updates MustBeNewerThan oldoldstable
dak admin v-c add unstable MustBeNewerThan testing
dak admin v-c add experimental MustBeNewerThan testing

# copy d-i to new testing (so same d-i in stable, testing, unstable)
cd ${ftpdir}/dists
mkdir -p ${new_testing}/main
dak copy-installer ${di_version:?}

# backports
dak admin suite add stable-backports-sloppy '' origin="Debian Backports" label='Debian Backports' codename=${new_stable}-backports-sloppy description="Debian ${new_stable_version} - Sloppy Backports" archive=ftp-master
dak admin suite add stable-backports-sloppy-debug '' origin="Debian Backports" label='Debian Backports debug' codename=${new_stable}-backports-sloppy-debug description="Debian ${new_stable_version} - Sloppy Backports - Debug Information" archive=debian-debug

dak admin suite add testing-backports '' origin="Debian Backports" label='Debian Backports' codename=${new_testing}-backports description='Debian X.Y - Backports' archive=ftp-master
dak admin suite add testing-backports-debug '' origin="Debian Backports" label='Debian Backports debug' codename=${new_testing}-backports-debug description='Debian X.Y - Backports - Debug Information' archive=debian-debug

configure-backports-suite() {(
  local suite=${1:?}
  local reference=${2:?}
  local components=${3:?}
  dak admin s-c add ${suite} ${components}
  dak admin s-a add ${suite} source all $(dak admin s-a list-arch ${reference})
  dak admin suite-config set ${suite} notautomatic=true butautomaticupgrades=true accept_source_uploads=false accept_binary_uploads=false close_bugs=false
)}

for suite in stable-backports-sloppy stable-backports-sloppy-debug; do
  configure-backports-suite ${suite} ${new_stable} "${new_stable_components}"
done
for suite in testing-backports testing-backports-debug; do
  configure-backports-suite ${suite} ${new_testing} "${new_testing_components}"
done

cd ${ftpdir}/dists
ln -sT ${new_stable}-backports-sloppy stable-backports-sloppy
ln -sT ${new_testing}-backports testing-backports

dak admin s add-build-queue stable-backports-sloppy buildd-stable-backports-sloppy buildd-${new_stable}-backports-sloppy build-queues
dak admin s add-build-queue testing-backports buildd-testing-backports buildd-${new_testing}-backports build-queues

begin;

  update suite set
    description = concat('Debian ', :'new_stable', ' - Backports')
    where codename = concat(:'new_stable', '-backports');

  update suite set
    description = concat('Debian ', :'new_stable', ' - Backports - Debug Information')
    where codename = concat(:'new_stable', '-backports-debug');

  update suite set
      debugsuite_id = (select id from suite where codename=concat(:'new_stable', '-backports-sloppy-debug')),
      policy_queue_id = (select id from policy_queue where queue_name = 'backports-policy')
      where codename=concat(:'new_stable', '-backports-sloppy');
  update suite set debugsuite_id = (select id from suite where codename=concat(:'new_testing', '-backports-debug')) where codename=concat(:'new_testing', '-backports');

  update suite set
    announce=array['debian-backports-changes@lists.debian.org'],
    indices_compression=array['xz'],
    i18n_compression=array['xz'],
    byhash=true,
    checksums=array['sha256'],
    new_queue_id=10,
    changelog_url='https://metadata.ftp-master.debian.org/changelogs/@CHANGEPATH@_changelog',
    separate_contents_architecture_all=true,
    signingkeys=ARRAY[:'new_oldstable_key', :'new_stable_key'],
    close_bugs=false
  where codename in (
      concat(:'new_stable', '-backports-sloppy'), concat(:'new_testing', '-backports'),
      concat(:'new_stable', '-backports-sloppy-debug'), concat(:'new_testing', '-backports-debug'),
      concat('buildd-', :'new_stable', '-backports-sloppy'), concat('buildd-', :'new_testing', '-backports'));

  insert into suite_permission (suite_id, role)
    select id, 'backports' from suite
    where codename in (concat(:'new_stable', '-backports-sloppy'), concat(:'new_testing', '-backports'));

commit;

dak init-dirs

for s in ${new_oldstable}-backports-sloppy{,-debug} ${new_stable}-backports{,-debug} ${new_testing}-backports{,-debug}; do
  dak generate-packages-sources2 -s ${s}
done

FINISH:
for s in testing testing-proposed-updates testing-updates; do
  dak generate-packages-sources2 -s ${s}
  dak contents generate -s ${s} -a ftp-master
done
dak generate-releases -a ftp-master
dak generate-packages-sources2 -s testing-debug
dak generate-releases -s testing-debug
# ${new_testing}-backports-debug and others might be missing!
dak generate-packages-sources2 -a build-queues
dak generate-releases -a build-queues

# after the bookworm release some symlinks/directories in
#   - debian-buildd/dists/
#   - debian-debug/dists/
# were incorrect, e.g., testing-debug and buildd-testing-backports
# were directories and not symlinks to ${codename}-debug, buildd-${codename}-backports
# and the latter directories did not exist.
# make sure this is correct.

# do not forget to push incoming.d.o as well

########################################################################
# On security-master:

#rename-suite {,old}oldoldstable
rename-suite {,old}oldstable
rename-suite {,old}stable-security
rename-suite {testing,stable}-security
rename-suite {,old}oldstable-debug
rename-suite {,old}stable-security-debug
rename-suite {testing,stable}-security-debug stable-debug
rename-suite buildd-{,old}oldoldstable
rename-suite buildd-{,old}oldstable
rename-suite buildd-{,old}stable-security
rename-suite buildd-{testing,stable}-security

begin;
  update suite set signingkeys = array[:'new_oldstable_security_key', :'new_stable_security_key'] where suite_name in ('oldstable', 'oldstable-debug', 'buildd-oldstable', 'stable-security', 'stable-security-debug', 'buildd-stable-security');
  update suite set indices_compression=array['xz'], i18n_compression=array['xz'], checksums=array['sha256'], byhash=true where suite_name in ('buildd-stable-security', 'stable-security-debug', 'stable-security');

  update suite set version = :'new_stable_version', description = concat('Debian ', :'new_stable_version', ' - Security Updates') where suite_name = 'stable-security';
  update suite set version = :'new_stable_version', description = concat('Debian ', :'new_stable_version', ' - Security Updates - Debug Information') where suite_name = 'stable-security-debug';
commit;


dak admin suite add testing-security '' origin=Debian label=Debian-Security codename=${new_testing:?}-security description='Debian x.y Testing - Security Updates - Not Released' accept_source_uploads=false accept_binary_uploads=false archive=security

dak admin suite add testing-security-debug '' origin=Debian label="Debian-Security debug" codename=${new_testing:?}-security-debug description='Debian x.y Testing - Security Updates - Debug Information - Not Released' accept_source_uploads=false accept_binary_uploads=false archive=debian-security-debug

for suite in testing-security testing-security-debug; do
  dak admin s-c add ${suite} updates/{main,contrib,non-free,non-free-firmware}
  dak admin s-a add ${suite} source all $(dak admin s-a list-arch stable-security)
done

dak admin s add-build-queue testing-security buildd-testing-security buildd-${new_testing:?}-security build-queues

begin;
  update suite set indices_compression=array['xz'], i18n_compression=array['xz'], checksums=array['sha256'], byhash=true, signingkeys = array[:'new_oldstable_security_key', :'new_stable_security_key'] where suite_name in ('testing-security', 'testing-security-debug', 'buildd-testing-security');
  update suite set
      debugsuite_id = (select id from suite where suite_name = 'testing-security-debug'),
      policy_queue_id = (select id from policy_queue where queue_name = 'embargoed')
      where suite_name = 'testing-security';
commit;

cd ${ftpdir}/dists
mkdir ${new_testing}-security
ln -sT ${new_testing}-security testing-security
ln -sT . ${new_testing}-security/updates

cd /srv/security-master.debian.org/build-queues/dists
mkdir buildd-${new_testing}-security
ln -sT buildd-${new_testing}-security buildd-testing-security
ln -sT . buildd-${new_testing}-security/updates

cd /srv/security-master.debian.org/archive/debian-security-debug/dists
mkdir ${new_testing}-security-debug
ln -sT ${new_testing}-security-debug testing-security-debug
ln -sT . ${new_testing}-security-debug/updates

for suite in testing-security buildd-testing-security; do
  dak generate-packages-sources2 -s ${suite}
  dak generate-releases -s ${suite}
done