The Debian packaging of openQA is maintained in git,
using the merging workflow described in dgit-maint-merge(7).
There isn't a patch queue that can be represented as a quilt series.

A detailed breakdown of the changes is available from their canonical
representation - git commits in the packaging repository.

For example, to see the changes made by the Debian maintainer in the first
upload of upstream version 1.2.3, you could use:

    % git clone https://git.dgit.debian.org/openqa
    % cd openqa
    % git log --oneline 1.2.3..debian/1.2.3-1 -- . ':!debian'

(If you have dgit, use `dgit clone openqa`, rather than plain `git clone`.)

A single combined diff, containing all the changes, follows.
--- openqa-4.6.1653336570.10bff0d.orig/Makefile
+++ openqa-4.6.1653336570.10bff0d/Makefile
@@ -50,6 +50,41 @@ help:
 	@sed -n 's/\(^[^.#[:space:]A-Z]*\):.*$$/\1/p' Makefile | uniq
 	@echo See docs/Contributing.asciidoc for more details
 
+OPENQA_VERSION ?= $(shell git log -1 --pretty=4.6.%ct.%h)
+
+man_names = openqa-cli openqa-client openqa-load-templates openqa-dump-templates openqa-clone-job openqa-label-all openqa-validate-yaml
+manpages = $(addprefix $(man_dir)/,$(addsuffix .1,$(man_names)))
+man_dir = build/man1
+
+$(man_dir):
+	mkdir -p $@
+
+define run-pod2man =
+pod2man --errors=stderr --section=1 \
+	--center "openQA Documentation" \
+	--release "openQA $(OPENQA_VERSION)" \
+	--name=$(notdir $(basename $@)) $< $@
+endef
+
+$(man_dir)/%.1: man/%.1.in
+	sed -e 's/%%VER%%/$(OPENQA_VERSION)/' <$< >$@
+
+$(man_dir)/openqa-%.1 $(man_dir)/%.1: script/%
+	$(run-pod2man)
+
+$(man_dir)/openqa-%-templates.1: script/%_templates
+	$(run-pod2man)
+
+$(man_dir)/openqa-cli.1: lib/OpenQA/CLI.pm
+	$(run-pod2man)
+
+.PHONY: build-manpages
+build-manpages: $(man_dir) $(manpages)
+
+.PHONY: clean
+clean:
+	-rm -r build
+
 .PHONY: install-generic
 install-generic:
 	./tools/generate-packed-assets
--- openqa-4.6.1653336570.10bff0d.orig/assets/assetpack.def
+++ openqa-4.6.1653336570.10bff0d/assets/assetpack.def
@@ -149,7 +149,6 @@
 < https://cdnjs.cloudflare.com/ajax/libs/chosen/1.7.0/chosen.jquery.js
 < https://cdnjs.cloudflare.com/ajax/libs/jquery-ujs/1.2.1/rails.js
 < javascripts/disable_animations.js [mode==test]
-< https://shepherdjs.dev/dist/js/shepherd.js
 
 ! anser.js
 < javascripts/anser-import.js
--- openqa-4.6.1653336570.10bff0d.orig/assets/stylesheets/openqa.scss
+++ openqa-4.6.1653336570.10bff0d/assets/stylesheets/openqa.scss
@@ -3,8 +3,11 @@
 @import "bootswatch_litera_theme.scss";
 @import "openqa_theme.scss";
 
-// include Roboto font
-@import url($web-font-path);
+// use Roboto font from linked build dependency on Debian
+@font-face {
+  font-family: 'Roboto';
+  src: url('../_debian/fonts-roboto-fontface/fonts/roboto/Roboto-Regular.ttf') format('truetype');
+}
 
 // include Bootstrap 4
 @import "../cache/raw.githubusercontent.com/twbs/bootstrap/v4.6.1/scss/bootstrap.scss";
@@ -21,4 +24,3 @@
 @import "comments.scss";
 @import "overview.scss";
 @import "parent_group_overview.scss";
-@import "shepherd.scss";
--- openqa-4.6.1653336570.10bff0d.orig/assets/stylesheets/openqa_theme.scss
+++ openqa-4.6.1653336570.10bff0d/assets/stylesheets/openqa_theme.scss
@@ -6,7 +6,6 @@ $grid-breakpoints: (
     xl: 1000px
 );
 
-$web-font-path:               "https://fonts.googleapis.com/css?family=Roboto:300,400,500,700" !default;
 $default-font:                "Roboto", "Helvetica Neue", Helvetica, Arial, sans-serif;
 $icon-font-path:              '/fonts/';
 $default-font-color:          #666666;
--- openqa-4.6.1653336570.10bff0d.orig/docs/GettingStarted.asciidoc
+++ openqa-4.6.1653336570.10bff0d/docs/GettingStarted.asciidoc
@@ -340,17 +340,20 @@ The personal configuration should be sto
 the `client.conf`, i.e. sections for each machine, e.g. `localhost`.
 
 [[get-testing]]
-== Testing openSUSE or Fedora
+== Testing openSUSE, Fedora or Debian
 
-An easy way to start using openQA is to start testing openSUSE or Fedora as they
+An easy way to start using openQA is to start testing openSUSE, Fedora or Debian as they
 have everything setup and prepared to ease the initial deployment. If you want
 to play deeper, you can configure the whole openQA manually from scratch, but
 this document should help you to get started faster.
 
 === Getting tests
 
-First you need to get actual tests. You can get openSUSE tests and needles (the
-expected results) from
+First you need to get actual tests.
+
+==== OpenSUSE
+
+You can get openSUSE tests and needles (the expected results) from
 https://github.com/os-autoinst/os-autoinst-distri-opensuse[GitHub]. It belongs
 into the `/var/lib/openqa/tests/opensuse` directory. To make it easier, you can just
 run
@@ -363,6 +366,8 @@ run
 Which will download the tests to the correct location and will set the correct
 rights as well.
 
+==== Fedora
+
 Fedora's tests are also in https://pagure.io/fedora-qa/os-autoinst-distri-fedora[git]. To
 use them, you may do:
 
@@ -377,6 +382,31 @@ cd ..
 chown -R geekotest fedora/
 --------------------------------------------------------------------------------
 
+==== Debian
+
+Debian's tests are in https://salsa.debian.org/qa/openqa/openqa-tests-debian.git[git]. To use them, you may do:
+
+NOTE: Roland: Phil, 'fetchneedles' is distributed as part of openqa-common. When I ran it for the first time, it tried to create '/var/lib/openqa/.ssh/known_hosts'. That was possible only after I did 'chown geekotest /var/lib/openqa'. What is the preferred workflow? Use 'fetchneedles' or run the commands directly? i.e. can the Debian instruction become: 'run fetchneedles, just like openSUSE?'
+NOTE: Roland: Phil, can 'python3-jsonschema' become a dependency of openqa-common? (i.e. to allow 'fifloader.py' to run)
+
+[source,sh]
+--------------------------------------------------------------------------------
+# Run as root. Method 1 with fetchneedles
+apt-get install python3-jsonschema ## Can this be integrated in the package openqa-common?
+/usr/share/openqa/script/fetchneedles
+cd /var/lib/openqa/share/tests/debian
+./fifloader.py templates.fif.json --load --clean ## Can this be integrated into fetchneedles?
+
+# Run as root Method 2 without fetchneedles
+apt-get install python3-jsonschema
+cd /var/lib/openqa/share/tests
+git clone https://salsa.debian.org/qa/openqa/openqa-tests-debian.git debian
+cd debian
+./fifloader.py templates.fif.json --load --clean
+cd ..
+chown -R geekotest debian/
+--------------------------------------------------------------------------------
+
 === Getting openQA configuration
 
 To get everything configured to actually run the tests, there are plenty of
@@ -396,6 +426,9 @@ consider reading its help page (`--help`
 
 For Fedora, similarly, you can call:
 
+NOTE: Roland: Fedora team, this is outdated. There is no file 'templates' in your repo any more.
+NOTE: Roland: It is probably as in Debian: './fifloader.py templates.fif.json --load --update'
+
 [source,sh]
 --------------------------------------------------------------------------------
 /var/lib/openqa/share/tests/fedora/templates [--apikey API_KEY] [--apisecret API_SECRET]
@@ -407,6 +440,13 @@ https://pagure.io/fedora-qa/createhdds[c
 repository can be used to create these. See the documentation in that repo
 for more information.
 
+For Debian, you can call:
+
+[source,sh]
+--------------------------------------------------------------------------------
+./fifloader.py templates.fif.json --load --update
+--------------------------------------------------------------------------------
+
 === Adding a new ISO to test
 
 To start testing a new ISO put it in `/var/lib/openqa/share/factory/iso` and call
@@ -446,6 +486,22 @@ openqa-cli api -X POST isos \
          BUILD=Rawhide-20160308.n.0
 --------------------------------------------------------------------------------
 
+For Debian, a sample run might be:
+
+NOTE: Roland: should these 3 examples be simplified? They are nearly duplicates
+
+[source,sh]
+--------------------------------------------------------------------------------
+# Run the first test
+openqa-cli api -X POST isos \
+         ISO=debian-testing-amd64-netinst.iso \
+         DISTRI=debian \
+         VERSION=testing \
+         FLAVOR=netinst-iso \
+         ARCH=x86_64 \
+         BUILD=20220310_0422-testing-amd64
+--------------------------------------------------------------------------------
+
 More details on triggering tests can also be found in the
 <<UsersGuide.asciidoc#usersguide,Users Guide>>.
 
--- openqa-4.6.1653336570.10bff0d.orig/docs/Installing.asciidoc
+++ openqa-4.6.1653336570.10bff0d/docs/Installing.asciidoc
@@ -131,6 +131,7 @@ The easiest way to install openQA is fro
 - For openSUSE, packages are available for Leap and Tumbleweed
 - For Fedora, packages are available in the official repositories for Fedora 23
 and later.
+- For Debian, packages are available in the official repositories for Debian Bookworm and later.
 
 === Development version repository
 
@@ -172,6 +173,9 @@ zypper in openQA
 
 # Fedora
 dnf install openqa openqa-httpd
+
+# Debian
+apt-get install openqa
 -------------------------------------------------------------------------------
 
 To install the openQA worker package use the following.
@@ -180,6 +184,9 @@ To install the openQA worker package use
 -------------------------------------------------------------------------------
 # openSUSE
 zypper in openQA-worker
+
+# Debian
+apt-get install openqa-worker
 -------------------------------------------------------------------------------
 
 Different convenience packages exist for convenience in openSUSE, for example:
@@ -234,28 +241,43 @@ detailed setup instructions with all the
 === Apache proxy
 
 It is required to run openQA behind an http proxy (apache, nginx, etc..). See the
-*openqa.conf.template* config file in */etc/apache2/vhosts.d* (openSUSE) or
-`/etc/httpd/conf.d` (Fedora). To make everything work correctly on openSUSE, you
+*openqa.conf.template* config file in */etc/apache2/vhosts.d* (openSUSE),
+`/etc/httpd/conf.d` (Fedora) or `/etc/apache2/sites-available/openqa.conf.template` (Debian).
+To make everything work correctly on openSUSE or Debian, you
 need to enable the 'headers', 'proxy', 'proxy_http', 'proxy_wstunnel' and 'rewrite'
-modules using the command 'a2enmod'. This is not necessary on Fedora.
+modules using the command 'a2enmod'. On Debian you'll additionally need 'expires'.
+
+This is not necessary on Fedora.
 
 [source,sh]
 --------------------------------------------------------------------------------
-# openSUSE Only
+# openSUSE
+# You can check what modules are enabled by using 'a2enmod -l'
+a2enmod headers
+a2enmod proxy
+a2enmod proxy_http
+a2enmod proxy_wstunnel
+a2enmod rewrite
+
+# Debian
 # You can check what modules are enabled by using 'a2enmod -l'
 a2enmod headers
 a2enmod proxy
 a2enmod proxy_http
 a2enmod proxy_wstunnel
 a2enmod rewrite
+a2enmod expires
 --------------------------------------------------------------------------------
 
-For a basic setup, you can copy *openqa.conf.template* to *openqa.conf* and modify the `ServerName` if required
-setting. This will direct all HTTP traffic to openQA.
+For a basic setup, you can copy *openqa.conf.template* to *openqa.conf* and modify the `ServerName` setting if required. This will direct all HTTP traffic to openQA.
 
 [source,sh]
 --------------------------------------------------------------------------------
+# openSUSE
 cp /etc/apache2/vhosts.d/openqa.conf.template /etc/apache2/vhosts.d/openqa.conf
+
+# Debian
+cp /etc/apache2/sites-available/openqa.conf.template /etc/apache2/sites-enabled/openqa.conf
 --------------------------------------------------------------------------------
 
 === TLS/SSL
@@ -738,16 +760,19 @@ configure where the shared storage is mo
 [source,ini]
 --------------------------------------------------------------------------------
 [global]
-HOST = openqa.opensuse.org openqa.fedora.fedoraproject.org
+HOST = openqa.opensuse.org openqa.fedoraproject.org openqa.debian.net
 
 [openqa.opensuse.org]
 SHARE_DIRECTORY = /var/lib/openqa/opensuse
 
 [openqa.fedoraproject.org]
 SHARE_DIRECTORY = /var/lib/openqa/fedora
+
+[openqa.debian.net]
+SHARE_DIRECTORY = /var/lib/openqa/debian
 --------------------------------------------------------------------------------
 
-Configuring `SHARE_DIRECTORY` is not a hard requirement. Worker will try following
+Configuring `SHARE_DIRECTORY` is not a hard requirement. Workers will try following
 directories prior registering with openQA instance:
 
 1. `SHARE_DIRECTORY`
@@ -756,8 +781,8 @@ directories prior registering with openQ
 4. `/var/lib/openqa`
 5. fail if none of above is available
 
-Once worker registers to openQA instance it checks for available job and starts
-accepting websockets commands. Worker accepts jobs as they will come in, there
+Once a worker registers to an openQA instance it checks for available jobs and starts
+accepting websockets commands. Workers accept jobs as they will come in, there
 is no priority, or other ordering, support at the moment.
 It is possible to mix local openQA instance with remote instances or use only
 remote instances.
--- openqa-4.6.1653336570.10bff0d.orig/etc/apache2/vhosts.d/openqa-ssl.conf.template
+++ openqa-4.6.1653336570.10bff0d/etc/apache2/vhosts.d/openqa-ssl.conf.template
@@ -1,12 +1,12 @@
 # sample apache config file for the ssl enabled openqa vhost.
 # At the very minimum you need to set the ServerName.
 
-# Note that this file will be ignored unless "SSL" is added to
-# APACHE_SERVER_FLAGS in /etc/sysconfig/apache2 (at least under
-# openSUSE).
+# There is a matching file nearby for non-ssl vhosts (openqa.conf.template) that
+# describes how to set things up, which also applies when setting up SSL.
+#
+# For SSL, you'll also need to load:
 
-<IfDefine SSL>
-<IfDefine !NOSSL>
+# a2enmod ssl
 
 <VirtualHost *:443>
 
@@ -26,7 +26,3 @@
     Include /etc/apache2/vhosts.d/openqa-common.inc
 
 </VirtualHost>
-
-</IfDefine>
-</IfDefine>
-
--- openqa-4.6.1653336570.10bff0d.orig/etc/apache2/vhosts.d/openqa.conf.template
+++ openqa-4.6.1653336570.10bff0d/etc/apache2/vhosts.d/openqa.conf.template
@@ -17,6 +17,7 @@
 # a2enmod proxy_http
 # a2enmod proxy_wstunnel
 # a2enmod rewrite
+# a2enmod expires
 
 <VirtualHost *:80>
 
--- openqa-4.6.1653336570.10bff0d.orig/etc/openqa/workers.ini
+++ openqa-4.6.1653336570.10bff0d/etc/openqa/workers.ini
@@ -36,7 +36,7 @@
 # packages against the list of packages during the previous last good job.
 # Configuring this variable provides a command line to list the packages and
 # their versions in plain text.
-#PACKAGES_CMD = rpm -qa
+#PACKAGES_CMD = apt list --installed
 
 # The section ids are the instance of the workers.
 # The key/value pairs will appear in vars.json
--- openqa-4.6.1653336570.10bff0d.orig/lib/OpenQA/CLI.pm
+++ openqa-4.6.1653336570.10bff0d/lib/OpenQA/CLI.pm
@@ -32,8 +32,8 @@ openqa-cli - provides command-line acces
     # Show details for job from arbitrary host
     openqa-cli api --host http://openqa.example.com jobs/408
 
-    # Show details for OSD job (prettified JSON)
-    openqa-cli api --osd --pretty jobs/4160811
+    # Show details for open.debian.net job (prettified JSON)
+    openqa-cli api --odn --pretty jobs/4160811
 
     # Archive job from O3
     openqa-cli archive --o3 408 /tmp/job_408
@@ -46,6 +46,7 @@ openqa-cli - provides command-line acces
     -h, --help                  Get more information on a specific command
         --osd                   Set target host to http://openqa.suse.de
         --o3                    Set target host to https://openqa.opensuse.org
+        --odn                   Set target host to https://openqa.debian.net
 
   Configuration:
     API key and secret are read from "client.conf" if not specified via CLI
--- openqa-4.6.1653336570.10bff0d.orig/lib/OpenQA/CLI/api.pm
+++ openqa-4.6.1653336570.10bff0d/lib/OpenQA/CLI/api.pm
@@ -76,8 +76,8 @@ sub command ($self, @args) {
     # Show details for job from arbitrary host
     openqa-cli api --host http://openqa.example.com jobs/408
 
-    # Show details for job from OSD (prettified JSON)
-    openqa-cli api --osd --pretty jobs/4160811
+    # Show details for job from open.debian.net (prettified JSON)
+    openqa-cli api --odn --pretty jobs/4160811
 
     # List all jobs (CAUTION: this might time out for a large instance)
     openqa-cli api --host openqa.example.com jobs
@@ -144,6 +144,7 @@ sub command ($self, @args) {
     -j, --json                    Request content is JSON
         --osd                     Set target host to http://openqa.suse.de
         --o3                      Set target host to https://openqa.opensuse.org
+        --odn                     Set target host to https://openqa.debian.net
         --param-file <param=file> Load content of params from files instead of
                                   from command line arguments. Multiple params
                                   may be specified by adding the option
--- openqa-4.6.1653336570.10bff0d.orig/lib/OpenQA/CLI/archive.pm
+++ openqa-4.6.1653336570.10bff0d/lib/OpenQA/CLI/archive.pm
@@ -36,8 +36,8 @@ sub command ($self, @args) {
 
   Usage: openqa-cli archive [OPTIONS] JOB PATH
 
-    # Download assets and test results from OSD to /tmp/job_416081
-    openqa-cli archive --osd 416081 /tmp/job_416081
+    # Download assets and test results from ODN to /tmp/job_416081
+    openqa-cli archive --odn 416081 /tmp/job_416081
 
     # Download assets and test results from arbitrary host
     openqa-cli archive --host http://openqa.example.com 407 /tmp/foo
@@ -55,6 +55,7 @@ sub command ($self, @args) {
     -l, --asset-size-limit <num>   Asset size limit in bytes
         --osd                      Set target host to http://openqa.suse.de
         --o3                       Set target host to https://openqa.opensuse.org
+        --odn                      Set target host to https://openqa.debian.net
     -t, --with-thumbnails          Download thumbnails as well
 
 =cut
--- openqa-4.6.1653336570.10bff0d.orig/lib/OpenQA/Command.pm
+++ openqa-4.6.1653336570.10bff0d/lib/OpenQA/Command.pm
@@ -87,7 +87,8 @@ sub run ($self, @args) {
       'apisecret=s' => sub { $self->apisecret($_[1]) },
       'host=s' => sub { $self->host($_[1] =~ m!^/|://! ? $_[1] : "https://$_[1]") },
       'o3' => sub { $self->host('https://openqa.opensuse.org') },
-      'osd' => sub { $self->host('http://openqa.suse.de') };
+      'osd' => sub { $self->host('http://openqa.suse.de') },
+      'odn' => sub { $self->host('https://openqa.debian.net') };
 
     return $self->command(@args);
 }
--- openqa-4.6.1653336570.10bff0d.orig/lib/OpenQA/Utils.pm
+++ openqa-4.6.1653336570.10bff0d/lib/OpenQA/Utils.pm
@@ -49,6 +49,8 @@ BEGIN {
         kde => 'https://bugs.kde.org/show_bug.cgi?id=',
         fdo => 'https://bugs.freedesktop.org/show_bug.cgi?id=',
         jsc => 'https://jira.suse.de/browse/',
+        deb => 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=',
+        bts => 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=',
     );
     %BUGURLS = (
         'https://bugzilla.novell.com/show_bug.cgi?id=' => 'bsc',
@@ -63,6 +65,7 @@ BEGIN {
         $BUGREFS{kde} => 'kde',
         $BUGREFS{fdo} => 'fdo',
         $BUGREFS{jsc} => 'jsc',
+        $BUGREFS{deb} => 'deb',
     );
 
     $MARKER_REFS = join('|', keys %BUGREFS);
--- /dev/null
+++ openqa-4.6.1653336570.10bff0d/man/openqa-label-all.1.in
@@ -0,0 +1,65 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH OPENQA\-LABEL\-ALL 1 "15 September 2021" "openQA %%VER%%" "openQA Documentation"
+.\" Please adjust this date whenever revising the manpage.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for manpage-specific macros, see man(7)
+.SH NAME
+openqa-label-all \- apply labels to openQA jobs based on various criteria
+.SH SYNOPSIS
+.B openqa-label-all
+.RI [OPTIONS]
+.SH DESCRIPTION
+.B openqa-label-all
+allows comments to be applied to a set jobs,
+which match the specified options,
+on the specified server.
+.SH OPTIONS
+.B openqa-label-all
+allows comments to be applied to the set of failing jobs
+that match the specified options.
+.TP
+.BI \-\-build =BUILD
+The build for which to look for a failing module
+.TP
+.BI \-\-module =MODULE
+The failing module to look for. (required)
+.TP
+.BI \-\-groupid =GROUP_ID
+Limits labeling to this group only.
+.TP
+.BI \-\-openqa-host =HOST
+The openQA host to act on, default: 'https://salsa.debian.net'
+.TP
+.BI \-\-result =RESULT
+The result of the jobs to look for, default: 'failed'
+.TP
+.BI \-\-label =LABEL
+The label to write as comment for each found job
+.TP
+.B \-\-dry-run
+Do not do any action on openQA
+.TP
+.B \-\-no-restart
+Do not restart the jobs after labelling
+.TP
+.BR \-v ", " \-\-verbose
+Increase verbosity level, specify multiple times to increase verbosity.
+.TP
+.BR \-h ", " \-\-help
+Prints help.
+
+.SH AUTHOR
+This manual page was written by Philip Hands <phil@hands.com>, for the Debian
+GNU/Linux system (but may be used by others).
--- openqa-4.6.1653336570.10bff0d.orig/profiles/apparmor.d/usr.share.openqa.script.openqa
+++ openqa-4.6.1653336570.10bff0d/profiles/apparmor.d/usr.share.openqa.script.openqa
@@ -84,6 +84,13 @@
   owner /var/lib/openqa/share/tests/** rwl,
   owner /var/lib/openqa/archive/** rwl,
 
+  # Debian specific access to local assets
+  /usr/share/fonts/*/fork-awesome/* r,
+  /usr/share/fonts-fork-awesome/css/* r,
+  /usr/share/javascript/** r,
+  /usr/share/sass/bootstrap/** r,
+  /usr/share/nodejs/** r,
+
 
   profile /usr/bin/ssh {
     #include <abstractions/base>
@@ -100,61 +107,6 @@
 
   }
 
-  # Cover hook script "openqa-trigger-from-obs"
-
-  #include <abstractions/bash>
-  #include <abstractions/openssl>
-
-  /opt/openqa-trigger-from-obs/ r,
-  /opt/openqa-trigger-from-obs/** r,
-  /opt/openqa-trigger-from-obs/*:*/.* rw,
-  /opt/openqa-trigger-from-obs/*:*/*/.* rw,
-  /opt/openqa-trigger-from-obs/*:*/*.lst rw,
-  /opt/openqa-trigger-from-obs/*:*/*/*.lst rw,
-  /opt/openqa-trigger-from-obs/*:*/*products* rw,
-  /opt/openqa-trigger-from-obs/*:*/*/*products* rw,
-
-  /opt/os-autoinst-scripts/** rix,
-  /usr/share/openqa/script/client rix,
-  /usr/share/openqa/script/openqa-cli px,
-  /usr/share/openqa/script/openqa-clone-job mrix,
-  /usr/share/openqa/script/openqa-clone-job r,
-  /{usr/,}bin/{b,d}ash rix,
-  /usr/bin/cat rix,
-  /usr/bin/curl rix,
-  /usr/bin/date mrix,
-  /usr/bin/cp ix,
-  /usr/bin/dirname ix,
-  /usr/bin/env mrix,
-  /usr/bin/gawk mrix,
-  /usr/bin/grep mrix,
-  /usr/bin/head mrix,
-  /usr/bin/hxselect mrix,
-  /usr/bin/hxnormalize mrix,
-  /usr/bin/jq rix,
-  /usr/bin/mv ix,
-  /usr/bin/mktemp rix,
-  /usr/sbin/sendmail ix,
-  /etc/postfix/main.cf r,
-  /usr/sbin/postdrop ix,
-  /var/spool/postfix/maildrop rw,
-  /var/spool/postfix/maildrop/* rwl,
-  /usr/bin/mailx ix,
-  /usr/bin/openqa-cli rix,
-  /usr/bin/perl ix,
-  /usr/bin/python3 ix,
-  /usr/bin/python3.6 ix,
-  /usr/bin/rm rix,
-  /usr/bin/rsync mrix,
-  /usr/bin/sed mrix,
-  /usr/bin/tac mrix,
-  /usr/bin/tail mrix,
-  /usr/bin/wget ix,
-
-  owner /var/log/openqa_gru wk,
-
-  /opt/openqa-trigger-from-obs/script/rsync.sh px -> /opt/openqa-trigger-from-obs/script/rsync.sh,
-
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.share.openqa.script.openqa>
 }
--- openqa-4.6.1653336570.10bff0d.orig/profiles/apparmor.d/usr.share.openqa.script.worker
+++ openqa-4.6.1653336570.10bff0d/profiles/apparmor.d/usr.share.openqa.script.worker
@@ -28,8 +28,11 @@
   /dev/ptmx rw,
   /dev/pts/* rw,
   /dev/tty rw,
+  /etc/apt/** r,
+  /etc/dpkg/dpkg.cfg{,.d,.d/*} r,
   /etc/gitconfig r,
   /etc/libnl/classid r,
+  /etc/machine-id r,
   /etc/openqa/client.conf r,
   /etc/openqa/workers.ini r,
   /etc/qemu/* r,
@@ -37,6 +40,7 @@
   /etc/vde2/vdecmd r,
   /proc/*/auxv r,
   /proc/*/cmdline r,
+  /proc/*/fd/ r,
   /proc/*/mountinfo r,
   /proc/*/net/psched r,
   /proc/*/stat r,
@@ -61,12 +65,14 @@
   /sys/kernel/mm/transparent_hugepage/enabled r,
   /tmp/** rwk,
   /usr/bin/Xvnc rCx,
+  /usr/bin/apt rix,
   /{usr/,}bin/cat rix,
   /usr/bin/chattr rix,
   /usr/bin/cksum rix,
   /usr/bin/cp rix,
   /usr/bin/date rix,
   /usr/bin/dirname rix,
+  /usr/bin/dpkg rix,
   /usr/bin/eatmydata rix,
   /usr/bin/env rix,
   /usr/bin/find rix,
@@ -105,6 +111,7 @@
   /usr/bin/x3270 cx,
   /usr/bin/xterm-console rix,
   /usr/bin/xz rix,
+  /var/cache/apt/** r,
   /usr/lib*/qemu/block-curl.so rix,
   /usr/lib*/qemu/block-iscsi.so mr,
   /usr/lib*/qemu/block-rbd.so mr,
@@ -119,6 +126,7 @@
   /usr/lib/utempter/utempter rix,
   /usr/sbin/smbd rix,
   /usr/sbin/ipmiconsole rix,
+  /usr/share/dpkg/* r,
   /usr/share/openqa/lib/** r,
   /usr/share/openqa/lib/DBIx/Class/Timestamps.pm r,
   /usr/share/openqa/lib/OpenQA/** r,
@@ -129,6 +137,8 @@
   /usr/share/seabios/* r,
   /usr/share/qemu/keymaps/* r,
   /usr/share/OVMF/* rk,
+  /var/lib/apt/** r,
+  /var/lib/dpkg/status r,
   /var/lib/openqa/cache/ r,
   /var/lib/openqa/cache/** rwk,
   /var/lib/openqa/pool/ r,
--- openqa-4.6.1653336570.10bff0d.orig/script/configure-web-proxy
+++ openqa-4.6.1653336570.10bff0d/script/configure-web-proxy
@@ -21,6 +21,6 @@ while true; do
   esac
 done
 
-for i in headers proxy proxy_http proxy_wstunnel rewrite ; do a2enmod $i ; done
+for i in headers proxy proxy_http proxy_wstunnel rewrite expires ; do a2enmod $i ; done
 sed -i -e 's/^.*httpsonly.*$/httpsonly = 0/g' /etc/openqa/openqa.ini
 sed "s/#ServerName.*$/ServerName $(hostname)/" /etc/apache2/vhosts.d/openqa.conf.template > /etc/apache2/vhosts.d/openqa.conf
--- openqa-4.6.1653336570.10bff0d.orig/script/fetchneedles
+++ openqa-4.6.1653336570.10bff0d/script/fetchneedles
@@ -1,19 +1,19 @@
 #!/bin/sh -e
 : "${dbuser:="geekotest"}"
-: "${dbgroup:="www"}"
+: "${dbgroup:="www-data"}"
 
-: "${dist_name:=${dist:-"openSUSE"}}" # the display name, for the help message
-: "${dist:="opensuse"}"
-: "${giturl:="https://github.com/os-autoinst/os-autoinst-distri-opensuse.git"}"
-: "${branch:="master"}"
+: "${dist_name:=${dist:-"Debian"}}" # the display name, for the help message
+: "${dist:="debian"}"
+: "${giturl:="https://salsa.debian.org/qa/openqa/openqa-tests-debian.git"}"
+: "${branch:="debian"}"
 : "${email:="openqa@$HOST"}"
 : "${username:="openQA web UI"}"
 : "${product:="$dist"}"
 
-: "${git_lfs:="0"}"
-: "${needles_separate:="1"}"
-: "${needles_giturl:="https://github.com/os-autoinst/os-autoinst-needles-opensuse.git"}"
-: "${needles_branch:="master"}"
+: "${git_lfs:="1"}"
+: "${needles_separate:="0"}"
+: "${needles_giturl:="https://salsa.debian.org/qa/openqa/openqa-needles-debian.git"}"
+: "${needles_branch:="debian-needles"}"
 
 : "${updateall:="0"}"
 : "${force:="0"}"
--- openqa-4.6.1653336570.10bff0d.orig/script/openqa-validate-yaml
+++ openqa-4.6.1653336570.10bff0d/script/openqa-validate-yaml
@@ -19,6 +19,52 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 # SOFTWARE.
 
+=head1 NAME
+
+openqa-validate-yaml - check YAML files against a schema
+
+=head1 SYNOPSIS
+
+openqa-validate-yaml [I<OPTIONS>] [-] [I<file> ...]
+
+=head1 DESCRIPTION
+
+B<openqa-validate-yaml>
+should be given a list of one or more filenames.
+The files are expected to be YAML files.
+B<openqa-validate-yaml>
+tests each item in the list to see
+if the files are valid when checked against a Schema.
+
+'-' can be specified instead of a filename
+to read the test input from STDIN.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<--validate-schema>
+
+Validate the Schema file itself, in addition to any YAML files.
+
+=item B<--schema-file>=I<SCHEMA>
+
+Specify the schema file or URL to validate against (default .../public/schema/JobTemplates-01.yaml)'],
+
+=item B<-h>
+
+Print a usage message, and exit.
+
+=back
+
+=head1 AUTHOR
+
+This manual page was written by Philip Hands <phil@hands.com>,
+for the Debian GNU/Linux system (but may be used by others).
+
+=cut
+
+
 use strict;
 use warnings;
 use 5.010;
--- openqa-4.6.1653336570.10bff0d.orig/systemd/openqa-webui.service
+++ openqa-4.6.1653336570.10bff0d/systemd/openqa-webui.service
@@ -4,6 +4,7 @@ Wants=apache2.service openqa-setup-db.se
 Before=apache2.service
 After=postgresql.service openqa-setup-db.service openqa-scheduler.service nss-lookup.target remote-fs.target
 Requires=openqa-livehandler.service openqa-websockets.service openqa-gru.service openqa-enqueue-asset-cleanup.timer openqa-enqueue-result-cleanup.timer openqa-enqueue-bug-cleanup.timer
+Documentation=https://open.qa/docs/#_run_the_web_ui
 
 [Service]
 User=geekotest
--- openqa-4.6.1653336570.10bff0d.orig/systemd/openqa-worker@.service
+++ openqa-4.6.1653336570.10bff0d/systemd/openqa-worker@.service
@@ -6,6 +6,7 @@
 Description=openQA Worker #%i
 After=openqa-slirpvde.service network.target nss-lookup.target remote-fs.target
 PartOf=openqa-worker.target
+Documentation=https://open.qa/docs/#_run_openqa_workers
 
 [Service]
 Type=simple
--- openqa-4.6.1653336570.10bff0d.orig/t/43-cli-api.t
+++ openqa-4.6.1653336570.10bff0d/t/43-cli-api.t
@@ -92,6 +92,10 @@ subtest 'Host' => sub {
     like $@, qr/Usage: openqa-cli api/, 'usage';
     is $api->host, 'https://openqa.opensuse.org', 'host';
 
+    eval { $api->run('--odn') };
+    like $@, qr/Usage: openqa-cli api/, 'usage';
+    is $api->host, 'https://openqa.debian.net', 'host';
+
     eval { $api->run(@host) };
     like $@, qr/Usage: openqa-cli api/, 'usage';
     is $api->host, $host, 'host';
--- openqa-4.6.1653336570.10bff0d.orig/t/43-cli-archive.t
+++ openqa-4.6.1653336570.10bff0d/t/43-cli-archive.t
@@ -74,6 +74,10 @@ subtest 'Host' => sub {
     like $@, qr/Usage: openqa-cli archive/, 'usage';
     is $archive->host, 'https://openqa.opensuse.org', 'host';
 
+    eval { $archive->run('--odn') };
+    like $@, qr/Usage: openqa-cli archive/, 'usage';
+    is $archive->host, 'http://openqa.debian.net', 'host';
+
     eval { $archive->run(@host) };
     like $@, qr/Usage: openqa-cli archive/, 'usage';
     is $archive->host, $host, 'host';
--- openqa-4.6.1653336570.10bff0d.orig/t/full-stack.t
+++ openqa-4.6.1653336570.10bff0d/t/full-stack.t
@@ -83,10 +83,6 @@ $driver->click_element_ok('Login', 'link
 # we're back on the main page
 $driver->title_is('openQA', 'back on main page');
 
-# click away the tour
-$driver->click_element_ok('dont-notify', 'id', 'disable tour permanently');
-$driver->click_element_ok('shepherd-cancel-icon', 'class_name', 'confirm dismissing tour');
-
 schedule_one_job_over_api_and_verify($driver, OpenQA::Test::FullstackUtils::job_setup(PAUSE_AT => 'shutdown'));
 
 sub status_text { find_status_text($driver) }
--- openqa-4.6.1653336570.10bff0d.orig/t/ui/19-tests-links.t
+++ openqa-4.6.1653336570.10bff0d/t/ui/19-tests-links.t
@@ -23,9 +23,6 @@ $driver->find_element_by_link_text('Logi
 # we're back on the main page
 $driver->title_is("openQA", "back on main page");
 
-# remove tour
-$driver->find_element_by_class_name('shepherd-cancel-icon')->click();
-
 my @texts = map { $_->get_text() } wait_for_element(selector => '.progress-bar-softfailed');
 is_deeply(\@texts, ['2 softfailed'], 'Progress bars show soft fails');
 
--- openqa-4.6.1653336570.10bff0d.orig/t/ui/21-admin-needles.t
+++ openqa-4.6.1653336570.10bff0d/t/ui/21-admin-needles.t
@@ -54,9 +54,6 @@ $driver->find_element_by_link_text('Logi
 # we're back on the main page
 $driver->title_is("openQA", "back on main page");
 
-# disable tour
-$driver->find_element_by_class_name('shepherd-cancel-icon')->click();
-
 sub goto_admin_needle_table {
     my $login_link = $driver->find_element('#user-action > a');
     is($login_link->get_text(), 'Logged in as Demo', 'logged in as demo');
--- openqa-4.6.1653336570.10bff0d.orig/templates/webapi/comments/add_comment_form_groups.html.ep
+++ openqa-4.6.1653336570.10bff0d/templates/webapi/comments/add_comment_form_groups.html.ep
@@ -5,7 +5,7 @@
     </p>
     <ul>
         <li>
-            For bugreferences write <code><i>bugtracker_shortname</i>#<i>bug_nr</i></code> in a comment, e.g. <code>bsc#1234</code>.
+            For bugreferences write <code><i>bugtracker_shortname</i>#<i>bug_nr</i></code> in a comment, e.g. <code>deb#123456</code>.
         </li>
         <li>
             For generic labels use <code>label:<i>keyword</i></code> where <i>keyword</i> can be any valid character up to the next whitespace, e.g. "false_positive".
--- openqa-4.6.1653336570.10bff0d.orig/tools/generate-packed-assets
+++ openqa-4.6.1653336570.10bff0d/tools/generate-packed-assets
@@ -35,6 +35,8 @@ ASSETPACK_PLUGINS=$(grep 'AssetPack' lib
 BUILD_CACHE="plugin AssetPack => { pipes => [qw(${ASSETPACK_PLUGINS})]} and app->asset->process()"
 BUILD_CACHE_OPTS='-Ilib/ -MMojolicious::Lite'
 
+MISSING=0
+
 generate() {
     # shellcheck disable=SC2039
     for _ in {1..3}; do
@@ -42,8 +44,15 @@ generate() {
         env MOJO_MODE="$1" perl $BUILD_CACHE_OPTS -e "$BUILD_CACHE" > /dev/null && return 0
         sleep 1
     done
+    MISSING=1
 }
 
 # Possibly requires a retry in case of CDN failures
 generate "test"
 generate "development"
+
+if [ "$GENERATE_PACKED_ASSETS_FAILS_ON_MISSING_ASSETS" ]; then
+    # for Debian packaging, fail at this point if any assets are missing
+    exit $MISSING
+fi
+exit 0
