Merge ~ahasenack/ubuntu/+source/squid:squid-4-merge into ubuntu/+source/squid:debian/sid

[Andreas Hasenack]

This is the merge of the new major upstream squid version from debian into ubuntu.

To work with this, I created logical/3.5.27-1ubuntu1 based on the pkg squid3 repository, and applied it on top of the pkg squid repository, which so far only contains debian uploads.

Therefore this will be the first ubuntu changelog entry in the squid repository. This looks a bit odd, as there are ancient squid-3.0.X changelogs in there from debian, and we had such releases in ubuntu, but the ubuntu ones are in the squid3 repository. I don't know how to recover that, or if that is even important since this is a new source package after all.

Noteworthy changes:
- dropped a good part of our delta, I hope the commit messages and d/changelog are enough.

Added changes:
 * These were all accepted by debian already via salsa MPs, so they can be dropped in the next update:
  - dep8 fixes: https://salsa.debian.org/squid-team/squid/merge_requests/4/
    - d/t/test-squid.py: fix apparmor profile filename
    - d/t/test-squid.py: fix the process name. The PID points at the parent.
    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
  - parallel build: https://salsa.debian.org/squid-team/squid/merge_requests/3
    - d/rules: enable cdbs parallel build
 * This is in debian salsa already and will be part of debian's 4.2 package update:
    - d/t/0003-installed-binary-for-debian-ci.patch: use the squid
      binary from the system, instead of the one from the source tree.
 * These two I had to add to workaround the PPC64EL build failures:
    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
      error in parse_time_t.
    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
      -O2 and that triggers a format-truncation error on pcon.cc. See
      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
The first one is part of an open PR at https://github.com/squid-cache/squid/pull/270. Upstream asked for a better fix, but is ok to take the workaround. The fix in the PR for the second issue was deemed unfit, so I worked around it by disabling the gcc check for just ppc64el builds for now. I preferred that to switching to -O2 because -O3 was a request from the ppc64el port partner.

DEP8 tests for all architectures passed: https://bileto.ubuntu.com/excuses/3351/cosmic.html

I think I can fix some of the "always failed" tests, one at least seems a silly path expansion error, but I won't block this upload on that.

PPA used by bileto: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3351/+packages

Other manual tests I did:
- release upgrade all the way from xenial to these packages in cosmic
- squid as an ssl reverse proxy (not possible with previous builds in ubuntu or debian)

Remaining delta bits we could perhaps drop, as they are about squid3 and that has been a transitional package for some time already:
  * only affects squid3.{post,pre}inst
        - Drop wrong short-circuiting of various invocations; we always want to call the debhelper block.

  * what was this one about? We are no longer using sysv anyway:
        - Revert "Set pidfile for systemd's sysv-generator" from Debian.

I could use some help with the above.

Finally, these two I can probably submit to debian, I just didn't want to block this upload on that, as they are easy to carry for now:
    - Add an example refresh pattern for debs.
    - Add disabled by default AppArmor profile.

[Christian Ehrhardt  (paelzer)]

## Drop/Remaining Changes ##

I went through the old and new Delta one by one and side by side, I'll only mention the ones worth to talk about (Thanks for the changelog entries explaining drops/adds).

#1 on the "refresh patterns" I wonder, this carried over as it was.
But it also adds a pattern for (Release|Packages(.gz)*) - probably worth to improve the changelog wording at least.
I'd have expected this to be commented out as well - do we want to change that?

#2 The "Correct attribution and add explanatory note in d/NEWS.debian" also is nor more relevant due to no related upgrade path being left. This can be Dropped IMHO.
Would you agree?

#3 "Set pidfile for systemd's sysv-generator" is no more needed. We have a native service which will be used (not the generator). This was from early Xenial and back then we had no service, so it made sense in the past, but no more.

#4 "short-circuiting"
It is important to note that this is in the maintscripts of the squid3 transitional package.
That transition already happened.
There is nothing generated after the removed short-circuit
The package is empty transitional now.
While in theory there could be something, there is in real life nothing in there.
The combination of "nothing is there" and "transition already happened" and "empty" makes me think we can drop this Delta - it isn't perfect in Debian, but also has no effect.
Turn it around, how would you explain Debian they need this Delta - see, there is no compelling reason I can think of.

Ack to all other Drops/Keep entries

## Added Changes ##
I checked debian/master - ack on the new changes themselve AND that are already in Debian and later to be dropped.

On the others:

#5 "d/t/0003-installed-binary-for-debian-ci.patch: use the squid binary from the system"
I see what you are doing, why are we doing that?
Bug or minimal in changelog reasoning would be nice

#6 "Workaround gcc's maybe-unitialized" I know since I remember our discussion, but maybe add "ppc64el build issue" to the changelog for this?

I was confused why Debian has taken "fix apparmor profile filename" if we are the only ones adding the disabled profile?! I found there is an upstream profile in tools/apparmor/usr.sbin.squid but it is not installed.
Maybe as you said, just submit the disabled profile to Debian as well and be good with it.
Maybe OTOH a merge of our profile with the one from upstream would be better (submit our things upstream).
And finally I think best would be
a) bring our apparmor Delta to upstream
b) change Debian packaging to install that profile
That way we can actually benefit from what upstream is maintaining there - we can always add pacthes that extend it if needed.
This won't stall the upload, but being curious, is there more background to it already?

Ack on the other new changes.

## Fin ##
From a testing POV I haven't found anything that breaks - so good to go from that as well.
I tested manual upgrades, start/stop and the qa-regression tests.
The qa tests showed one issue, but I'll debug first if it is an issue in the test due to the rename.

Already great work and if you follow my reasoning even more cleanup will happen.
Eager to hear your opini...

review: Needs Fixing

[Christian Ehrhardt  (paelzer)]

Yeah, the test Fail was an artifact of squid4 behaving slightly different - i'll submit an MP to the tests and set you to CC there.

[Christian Ehrhardt  (paelzer)]

MP for the test: https://code.launchpad.net/~paelzer/qa-regression-testing/+git/qa-regression-testing/+merge/353164

6f7ebb2... by Andreas Hasenack on 2018-08-15

    - Revert "Set pidfile for systemd's sysv-generator" from Debian.
      [Not needed anymore since we have a native systemd service file
       and no longer rely on the generator.]

c4a2ca9... by Andreas Hasenack on 2018-08-15

    - Drop wrong short-circuiting of various invocations; we always want to
      call the debhelper block.
      [This was for the transitional squid3 package, and that transition has
       already happened.]

[Andreas Hasenack (ahasenack)]

1) I updated the refresh patterns, taking the more complete config from the squid-deb-proxy package. I left the caching of debs as a commented example, though, like it was before. I could be convinced otherwise. It would help to know why it was a comment in the first place, instead of enabled by default.

2) The attribution in d/NEWS.debian was added to a specific section in that file, namely under version "quid3 (3.5.6-1)". In that context, I think it's like a changelog entry, describing what happened at or around that version, so it makes sense to keep it. What do you think?

3) dropped

4) dropped

[Andreas Hasenack (ahasenack)]

5) That patch is from the upcoming debian squid package (4.2) and is committed in salsa already. It's the reason we were able to drop two bits of delta: a) enable autoreconf; b) "Adjust seddery (...)". I added respective notes under each individual delta drop message that the drop was possible because of this patch. So essentially we are replacing two bits of delta we have with an upcoming debian patch, and this "new" delta will be dropped with the next debian release. I added a proper DEP3 header to this patch.

[Andreas Hasenack (ahasenack)]

6) updated d/changelog entry. Note that the DEP3 headers in that patch explain the situation in much more detail.

4f4f33e... by Andreas Hasenack on 2018-08-15

    - d/t/upstream-test-suite: drop the sed line, since patch
      0003-installed-binary-for-debian-ci.patch is doing this work now.
      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)

[Andreas Hasenack (ahasenack)]

I added one more change, which can be dropped in the next merge since Debian adopted it:
    - d/t/upstream-test-suite: drop the sed line, since patch
      0003-installed-binary-for-debian-ci.patch is doing this work now.
      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)

[Andreas Hasenack (ahasenack)]

I'm looking at apparmor now, this might be a bit of work.

[Andreas Hasenack (ahasenack)]

I don't know of any history regarding the apparmor profile.

What I found out so far is that our profile has 4 additions that don't make sense for upstream, but might make sense for debian:
 - squid-langpack entries
 - maas-proxy entries
 - squid-deb-proxy entries
 - squidguard entries

The MAAS one probably wouldn't be taken, since there is no MAAS for debian. The others might make sense for debian.

In the meantime, I pushed another build to https://bileto.ubuntu.com/#/ticket/3351 with the changes done so far addressing review comments, just to be sure.

[Christian Ehrhardt  (paelzer)]

We can postpone the apparmor unification in this project until after this merge.
Thanks for working on all the other concerns I had.

Assuming that we split the apparmor work in a delayed extra task I think we are good with all but #2 now.

On #2 - yes it is like a changelog, but with the bonus that if you are switching "through" this particular set of versions you will get it prompted on the update screen.
See: https://www.debian.org/doc/manuals/developers-reference/ch06.en.html#bpp-news-debian
These were important NEWS somewhen in the past, but lacking a upgrade path that hits it we can drop this.
The alternative would be to keep it forever without ever showing it to a user, that feels wrong and useless maintenance effort to me.

My call would be drop, if we need a more high level discussion and qorum on this lets discuss in the standup.

Again - thanks for all the other changes.
If tests are good and we have decided on #2 you'll have my +1 on this Merge.

37d441a... by Andreas Hasenack on 2018-08-16

    - Correct attribution and add explanatory note in d/NEWS.debian.
      [That particular upgrade path has happened long ago.]

[Andreas Hasenack (ahasenack)]

I added a card (https://trello.com/c/u07CzGb1) about pushing the apparmor delta to debian, thanks.

2) Dropped, thanks for the explanation.

Yesterday I also did some additional testing:
- enabled our (disabled by default) apparmor profile, confirming it still works
- with the apparmor profile enabled, I also confirmed squid-deb-proxy still works
- pinged the #maas team about this new upcoming release, since maas relies on squid as its proxy/cache. roaksoax said he would test it with the packages from the bileto ppa.

I still want to test these, should be done momentarily:
- squidguard
- apparmor profile with squid as an ssl accelerator (new feature in this squid package)

[Andreas Hasenack (ahasenack)]

squidguard fails with apparmor enabled:
[ 477.494576] audit: type=1400 audit(1534426533.919:2436): apparmor="DENIED" operation="file_inherit" profile="/usr/sbin/squid" pid=8122 comm="squidGuard" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive" addr=none peer_addr=none peer="/usr/sbin/squid//squidguard"

This happens with both squid-3 that is currently in cosmic, and squid-4 from this MP, therefore an already existing bug.

I filed this to be fixed later: https://bugs.launchpad.net/ubuntu/+source/squid3/+bug/1787409

[Christian Ehrhardt  (paelzer)]

Thanks for breaking those out into other bugs.
And for integrating my suggestion with the NEWS file, I think we are good here.

Under the constraint that your and maas further testing does not reveal anything broken, from a packaging POV +1 on this.

review: Approve

e4f96de... by Andreas Hasenack on 2018-08-16

changelog

[Andreas Hasenack (ahasenack)]

I pushed a change to the apparmor profile to cope with the snakeoil certificates, as discussed in #ubuntu-hardened.

[Andreas Hasenack (ahasenack)]

Testing with maas on cosmic, looks fine so far:

access log while a new machine is enlisting:

==> /var/log/maas/proxy/access.log <==
1534448951.246 232 192.168.100.190 TCP_MISS/200 89048 GET http://br.archive.ubuntu.com/ubuntu/dists/bionic-updates/InRelease - HIER_DIRECT/200.236.31.4 -

packages:

root@maas-squid4:~# apt-cache policy maas squid
maas:
  Installed: 2.4.1-7032-g11e4fa330-0ubuntu1
  Candidate: 2.4.1-7032-g11e4fa330-0ubuntu1
  Version table:
 *** 2.4.1-7032-g11e4fa330-0ubuntu1 500
        500 http://br.archive.ubuntu.com/ubuntu cosmic/main amd64 Packages
        100 /var/lib/dpkg/status
squid:
  Installed: 4.1-1ubuntu1~ppa8
  Candidate: 4.1-1ubuntu1~ppa8
  Version table:
 *** 4.1-1ubuntu1~ppa8 500
        500 http://ppa.launchpad.net/ci-train-ppa-service/3351/ubuntu cosmic/main amd64 Packages
        100 /var/lib/dpkg/status
     3.5.27-1ubuntu1 500
        500 http://br.archive.ubuntu.com/ubuntu cosmic/main amd64 Packages

[Andreas Hasenack (ahasenack)]

roaksoax will take a while to test this I think, I pinged him today and he hasn't gotten to it yet. Would you mind sponsoring it anyway, so maybe I can get an AA to look at it soon since it's a new package? If not that's fine too.

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/squid
 * [new tag] upload/4.1-1ubuntu1 -> upload/4.1-1ubuntu1

[Christian Ehrhardt  (paelzer)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading squid_4.1-1ubuntu1.dsc: done.
  Uploading squid_4.1.orig.tar.gz: done.
  Uploading squid_4.1-1ubuntu1.debian.tar.xz: done.
  Uploading squid_4.1-1ubuntu1_source.buildinfo: done.
  Uploading squid_4.1-1ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 7ec4ae4..e957d13 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,68 @@
+squid (4.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merged with Debian unstable (LP: #1780944, LP: #1097032, LP: #16669).
+    Remaining changes:
+    - Use snakeoil certificates.
+      [Updated to use the correct config setting names]
+    - Add an example refresh pattern for debs.
+      [Improved the refresh patterns based on the configuration from
+       squid-deb-proxy package]
+    - Add disabled by default AppArmor profile.
+      [Updated to include the ssl_certs abstraction and suggestions on how to
+       deal with the snakeoil private key and other keys in /etc/ssl.]
+  * Dropped changes:
+    - Add additional dep8 tests.
+      [Adopted in 4.0.21-1~exp5, albeit a stripped down version]
+    - Correct attribution and add explanatory note in d/NEWS.debian.
+      [That particular upgrade path has happened long ago.]
+    - Drop wrong short-circuiting of various invocations; we always want to
+      call the debhelper block.
+      [This was for the transitional squid3 package, and that transition has
+       already happened.]
+    - Revert "Set pidfile for systemd's sysv-generator" from Debian.
+      [Not needed anymore since we have a native systemd service file
+       and no longer rely on the generator.]
+    - Enable autoreconf. This is no longer required for the security updates,
+      but is needed for the seddery of test-suite/Makefile.am in
+      d/t/upstream-test-suite.
+      [Replaced by patch 0003-installed-binary-for-debian-ci.patch]
+    - Adjust seddery for upstream test squid binary location.
+      [sed no longer necessary since patch,
+       0003-installed-binary-for-debian-ci.patch, will be dropped
+       entirely.]
+    - Drop Conflicts/Replaces of squid against squid3. In Ubuntu, the migration
+      happened in Xenial, so no upgrade path still requires this code. This
+      reduces upgrade ordering difficulty.
+      [Again we have a migration, but this time from squid3 to squid, so we
+      need this].
+    - GCC7 FTBFS fixes (LP: #1712668):
+      + d/rules: don't error when hitting the "deprecated" and
+      "format-truncation" gcc7 warnings. Upstream 3.5.27 has fixes for these,
+      but one in Format.cc that affects 32bit builds was deemed too intrusive
+      for the 3.5 stable series and is only in squid 4.x
+      [No longer needed with squid 4.x]
+    - Do not force gcc-6
+      [It was a temporary workaround in Debian that got dropped]
+  * Added changes:
+    - d/rules: enable cdbs parallel build
+    - d/t/test-squid.py: fix apparmor profile filename
+    - d/t/test-squid.py: fix the process name. The PID points at the parent.
+    - d/t/upstream-test-suite: also make libmem.la, needed by the tests.
+    - d/t/0003-installed-binary-for-debian-ci.patch:  use the squid
+      binary from the system, instead of the one from the source tree.
+    - d/p/fix-uninitialized-var.patch: Workaround gcc's maybe-unitialized
+      error in parse_time_t, triggered on ppc64el due to the build using -O3
+      in that architecture.
+    - d/rules: Add -Wno-format-truncation to CXXFLAGS as a workaround if
+      building for ppc64el. On that arch, dpkg-buildflags sets -O3 instead of
+      -O2 and that triggers a format-truncation error on pcon.cc. See
+      See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+    - d/t/upstream-test-suite: drop the sed line, since patch
+      0003-installed-binary-for-debian-ci.patch is doing this work now.
+      (https://salsa.debian.org/squid-team/squid/commit/ad4372b444ba8b1587839)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 16 Aug 2018 12:33:17 -0300
+
 squid (4.1-1) unstable; urgency=high
 
   * New Upstream Release (Closes: #896120)
diff --git a/debian/control b/debian/control
index c59d487..bdd9c4f 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: squid
 Section: web
 Priority: optional
-Maintainer: Luigi Gangitano <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Luigi Gangitano <[e-mail]>
 Uploaders: Santiago Garcia Mantinan <[e-mail]>
 Homepage: http://www.squid-cache.org
 Standards-Version: 4.1.4
@@ -24,6 +25,7 @@ Build-Depends: ed, libltdl-dev, pkg-config
 	, libsasl2-dev
 	, libxml2-dev
 	, nettle-dev
+	, dh-apparmor
 
 Package: squid3
 Architecture: all
@@ -40,8 +42,8 @@ Description: Transitional package
 Package: squid
 Architecture: any
 Pre-Depends: adduser
-Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl
-Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbindd
+Depends: ${shlibs:Depends}, ${misc:Depends}, netbase, logrotate (>= 3.5.4-1), squid-common (>= ${source:Version}), lsb-base, libdbi-perl, ssl-cert
+Suggests: squidclient, squid-cgi, squid-purge, resolvconf (>= 0.40), smbclient, ufw, winbindd, apparmor
 Recommends: libcap2-bin [linux-any], ca-certificates
 Conflicts: squid3 (<< ${binary:Version})
 Replaces: squid3
diff --git a/debian/patches/0003-installed-binary-for-debian-ci.patch b/debian/patches/0003-installed-binary-for-debian-ci.patch
new file mode 100644
index 0000000..abbe089
--- /dev/null
+++ b/debian/patches/0003-installed-binary-for-debian-ci.patch
@@ -0,0 +1,37 @@
+Description: Use installed squid binary for Debian CI testing
+ Upstream config tests are designed for use during builds. Debian CI uses a
+ pre-built binary installation.
+ .
+ Ubuntu specific note:
+ This patch replaces two bits of Ubuntu delta:
+ - Adjust seddery for upstream test squid binary location.
+ - Enable autoreconf
+Author: Amos Jeffries <[e-mail]>
+Origin: vendor, https://salsa.debian.org/squid-team/squid/commit/fe6be5764611e9d7294b6bd97d97d1b23ffa4ce9
+Last-Update: 2018-08-15
+diff --git a/test-suite/Makefile.am b/test-suite/Makefile.am
+index c8ff455d..bb7aef46 100644
+--- a/test-suite/Makefile.am
++++ b/test-suite/Makefile.am
+@@ -150,7 +150,7 @@ VirtualDeleteOperator_SOURCES = VirtualDeleteOperator.cc stub_libmem.cc $(DEBUG_
+ squid-conf-tests: $(top_builddir)/src/squid.conf.default $(srcdir)/squidconf/*
+ 	@failed=0; cfglist="$?"; rm -f $@ || $(TRUE); \
+ 	for cfg in $$cfglist ; do \
+-		$(top_builddir)/src/squid -k parse -f $$cfg || \
++		/usr/sbin/squid -k parse -f $$cfg || \
+ 			{ echo "FAIL: squid.conf test: $$cfg" | \
+ 				sed s%$(top_builddir)/src/%% | \
+ 				sed s%$(srcdir)/squidconf/%% ; \
+diff --git a/test-suite/Makefile.in b/test-suite/Makefile.in
+index 5e7cd5fa..15f78635 100644
+--- a/test-suite/Makefile.in
++++ b/test-suite/Makefile.in
+@@ -1477,7 +1477,7 @@ STUB.h: $(top_srcdir)/src/tests/STUB.h
+ squid-conf-tests: $(top_builddir)/src/squid.conf.default $(srcdir)/squidconf/*
+ 	@failed=0; cfglist="$?"; rm -f $@ || $(TRUE); \
+ 	for cfg in $$cfglist ; do \
+-		$(top_builddir)/src/squid -k parse -f $$cfg || \
++		/usr/sbin/squid -k parse -f $$cfg || \
+ 			{ echo "FAIL: squid.conf test: $$cfg" | \
+ 				sed s%$(top_builddir)/src/%% | \
+ 				sed s%$(srcdir)/squidconf/%% ; \
diff --git a/debian/patches/90-cf.data.ubuntu.patch b/debian/patches/90-cf.data.ubuntu.patch
new file mode 100644
index 0000000..9dfa5b4
--- /dev/null
+++ b/debian/patches/90-cf.data.ubuntu.patch
@@ -0,0 +1,16 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -5859,6 +5862,12 @@ NOCOMMENT_START
+ refresh_pattern ^ftp:		1440	20%	10080
+ refresh_pattern ^gopher:	1440	0%	1440
+ refresh_pattern -i (/cgi-bin/|\?) 0	0%	0
++refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
++refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
++refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
++# example pattern for deb packages
++#refresh_pattern (\.deb|\.udeb)$   129600 100% 129600
+ refresh_pattern .		0	20%	4320
+ NOCOMMENT_END
+ DOC_END
+
diff --git a/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
new file mode 100644
index 0000000..40b5306
--- /dev/null
+++ b/debian/patches/99-ubuntu-ssl-cert-snakeoil.patch
@@ -0,0 +1,22 @@
+--- a/src/cf.data.pre
++++ b/src/cf.data.pre
+@@ -3516,6 +3516,19 @@
+ 			reference a PEM file containing both the certificate
+ 			and private key.
+ 	
++	Notes:
++
++	On Debian/Ubuntu systems a default snakeoil certificate is
++	available in /etc/ssl and users can set:
++
++		sslcert=/etc/ssl/certs/ssl-cert-snakeoil.pem
++
++	and
++
++		sslkey=/etc/ssl/private/ssl-cert-snakeoil.key
++
++	for testing.
++
+ 	sslcipher=...	The list of valid SSL ciphers to use when connecting
+ 			to this peer.
+ 
diff --git a/debian/patches/fix-uninitialized-var.patch b/debian/patches/fix-uninitialized-var.patch
new file mode 100644
index 0000000..a682703
--- /dev/null
+++ b/debian/patches/fix-uninitialized-var.patch
@@ -0,0 +1,25 @@
+Description: Workaround gcc's maybe-uninitialized error in parse_time_t
+ Function parse_time_t() passes an unitialized variable to parseTimeLine(),
+ which will fill it in as the return value. gcc's -Wmaybe-unitialized setting
+ trips over this when the build is done with -O3, as is the case in ppc64el.
+ This fix is suggested in https://github.com/squid-cache/squid/pull/270, but
+ not accepted yet. It was remarked that a better fix can be done, instead of
+ just working around the gcc misfire.
+Origin: other, https://github.com/squid-cache/squid/pull/270
+Bug: https://bugs.squid-cache.org/show_bug.cgi?id=4875
+Last-Update: 2018-08-14
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+diff --git a/src/cache_cf.cc b/src/cache_cf.cc
+index 006a42d..96fe36f 100644
+--- a/src/cache_cf.cc
++++ b/src/cache_cf.cc
+@@ -2925,7 +2925,7 @@ dump_time_t(StoreEntry * entry, const char *name, time_t var)
+ void
+ parse_time_t(time_t * var)
+ {
+-    time_msec_t tval;
++    time_msec_t tval = 0;
+     parseTimeLine(&tval, T_SECOND_STR, false);
+     *var = static_cast<time_t>(tval/1000);
+ }
diff --git a/debian/patches/series b/debian/patches/series
index 9c85ddd..12952d3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,7 @@
 0001-Default-configuration-file-for-debian.patch
 0002-Change-default-file-locations-for-debian.patch
 0011-upstream-pr172.patch
+90-cf.data.ubuntu.patch
+99-ubuntu-ssl-cert-snakeoil.patch
+0003-installed-binary-for-debian-ci.patch
+fix-uninitialized-var.patch
diff --git a/debian/rules b/debian/rules
index 48211db..9b7b98c 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,6 +3,13 @@
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 export DEB_CFLAGS_MAINT_APPEND = -Wall
 export DEB_LDFLAGS_MAINT_APPEND = -Wl,--as-needed
+# On ppc64el, dpkg-buildflags sets -O3 instead of the usual
+# -O2. This makes gcc emit a format-truncation error on
+# pconn.cc. See https://bugs.squid-cache.org/show_bug.cgi?id=4875
+ifeq ($(shell dpkg-architecture -qDEB_HOST_ARCH),ppc64el)
+  export DEB_CXXFLAGS_MAINT_APPEND = -Wno-format-truncation
+endif
+export DEB_BUILD_PARALLEL = yes
 include /usr/share/dpkg/buildflags.mk
 
 include /usr/share/cdbs/1/rules/debhelper.mk
@@ -88,3 +95,7 @@ install/squid::
 	install -m 755 -g root -d $(INSTALLDIR)/usr/share/man/man1
 	mv $(INSTALLDIR)/usr/bin/purge $(INSTALLDIR)/usr/bin/squid-purge
 	mv $(INSTALLDIR)/usr/share/man/man1/purge.1 $(INSTALLDIR)/usr/share/man/man1/squid-purge.1
+	install -m 755 -g root -d $(INSTALLDIR)/etc/apparmor.d/force-complain
+	install -m 755 -g root -d $(INSTALLDIR)/etc/apparmor.d/disable
+	install -m 644 -g root debian/usr.sbin.squid $(INSTALLDIR)/etc/apparmor.d
+	dh_apparmor --profile-name=usr.sbin.squid -psquid
diff --git a/debian/squid.install b/debian/squid.install
index 95ebe1a..d13050d 100644
--- a/debian/squid.install
+++ b/debian/squid.install
@@ -28,3 +28,6 @@ usr/share/man/man8/negotiate_kerberos_auth.8
 usr/share/man/man8/security_fake_certverify.8
 usr/share/man/man8/storeid_file_rewrite.8
 usr/share/man/man8/squid.8
+etc/apparmor.d/disable
+etc/apparmor.d/force-complain
+etc/apparmor.d/usr.sbin.squid
diff --git a/debian/squid.preinst b/debian/squid.preinst
index 6b490e0..593ffa9 100644
--- a/debian/squid.preinst
+++ b/debian/squid.preinst
@@ -63,6 +63,21 @@ then
 	chsh -s /bin/sh proxy
 fi
 
+disable_profile() {
+    APP_CONFFILE="/etc/apparmor.d/usr.sbin.squid"
+    APP_DISABLE="/etc/apparmor.d/disable/usr.sbin.squid"
+    # Create a symlink to the yet-to-be-unpacked profile
+    if [ ! -e "$APP_CONFFILE" ]; then
+        mkdir -p `dirname $APP_DISABLE` 2>/dev/null || true
+        ln -sf $APP_CONFFILE $APP_DISABLE
+    fi
+}
+
+if [ "$1" = "install" ]; then
+    # Disable AppArmor profile on install
+    disable_profile
+fi
+
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.
 
diff --git a/debian/tests/test-squid.py b/debian/tests/test-squid.py
index 11c630a..bc5c172 100644
--- a/debian/tests/test-squid.py
+++ b/debian/tests/test-squid.py
@@ -106,7 +106,7 @@ class BasicTest(HttpdCommon):
 
         self.gophermap = "/var/gopher/gophermap"
 
-        self.aa_profile = "usr.sbin.squid3"
+        self.aa_profile = "usr.sbin.squid"
         self.aa_abs_profile = "/etc/apparmor.d/%s" % self.aa_profile
 
     def tearDown(self):
@@ -118,7 +118,7 @@ class BasicTest(HttpdCommon):
         '''Test daemon'''
 
         pidfile = "/run/squid.pid"
-        exe = "(squid-1)"
+        exe = "squid"
 
         self.assertTrue(check_pidfile(exe, pidfile))
 
diff --git a/debian/tests/upstream-test-suite b/debian/tests/upstream-test-suite
index 4f6b332..bdb0e06 100644
--- a/debian/tests/upstream-test-suite
+++ b/debian/tests/upstream-test-suite
@@ -2,10 +2,10 @@
 set -e
 
 dpkg-source --before-build `pwd`
-sed -i -e 's/\$(top_builddir)\/src\/squid/\/usr\/sbin\/squid/' test-suite/Makefile.am
 dpkg-buildpackage -rfakeroot --target=pre-build
 dpkg-buildpackage -rfakeroot --target=common-configure-arch 2>/dev/null
 make -C src/base libbase.la
+make -C src/mem libmem.la
 make -C src globals.o
 make -C lib all
 make -C compat
diff --git a/debian/usr.sbin.squid b/debian/usr.sbin.squid
new file mode 100644
index 0000000..d80c8ea
--- /dev/null
+++ b/debian/usr.sbin.squid
@@ -0,0 +1,85 @@
+# Author: Simon Deziel
+#         Jamie Strandboge
+# vim:syntax=apparmor
+#include <tunables/global>
+
+/usr/sbin/squid {
+  #include <abstractions/base>
+  #include <abstractions/kerberosclient>
+  #include <abstractions/nameservice>
+  #include <abstractions/ssl_certs>
+
+  # If you are using squid with the default snakeoil certificates, you will
+  # probably have to uncomment the line below so that squid can read the
+  # private key:
+  #/etc/ssl/private/ssl-cert-snakeoil.key r,
+
+  # For a more generous permission, but also less secure, you could
+  # alternatively include the <abstractions/ssl_keys> abstraction, which
+  # gives read access to the entire contents of /etc/ssl
+
+  capability net_raw,
+  capability setuid,
+  capability setgid,
+  capability sys_chroot,
+
+  # allow child processes to run execvp(argv[0], [kidname, ...])
+  /usr/sbin/squid ix,
+
+  # pinger
+  network inet raw,
+  network inet6 raw,
+
+  /etc/mtab r,
+  @{PROC}/[0-9]*/mounts r,
+  @{PROC}/mounts r,
+
+  # squid3 configuration
+  /etc/squid/** r,
+  /{,var/}run/squid.pid rwk,
+  /var/spool/squid/ r,
+  /var/spool/squid/** rwk,
+  /usr/lib/squid{,3}/* rmix,
+  /usr/share/squid/** r,
+  /var/log/squid/* rw,
+
+  # squid-langpack
+  /usr/share/squid-langpack/** r,
+
+  # maas-proxy
+  /var/lib/maas/maas-proxy.conf r,
+  /var/log/maas/proxy/** rw,
+  /var/spool/maas-proxy/ r,
+  /var/spool/maas-proxy/** rwk,
+
+  # squid-deb-proxy
+  /etc/squid-deb-proxy/** r,
+  /{,var/}run/squid-deb-proxy.pid rwk,
+  /var/cache/squid-deb-proxy/ r,
+  /var/cache/squid-deb-proxy/** rwk,
+  /var/log/squid-deb-proxy/* rw,
+  owner /dev/shm/** rmw,
+
+  # squidguard
+  /usr/bin/squidGuard Cx -> squidguard,
+  profile squidguard {
+    #include <abstractions/base>
+
+    /etc/squid/squidGuard.conf r,
+    /var/log/squid{,3}/squidGuard.log w,
+    /var/lib/squidguard/** rw,
+
+    # squidguard by default uses /var/log/squid as its logdir, however, we
+    # don't want it to access squid's logs, only its own. Explicitly deny
+    # access to squid's files but allow all others since the user may specify
+    # anything for the squidGurad 'log' directive.
+    /var/log/squid{,3}/* rw,
+    audit deny /var/log/squid{,3}/{access,cache,store}.log* rw,
+
+    # Site-specific additions and overrides. See local/README for details.
+    #include <local/usr.sbin.squid>
+  }
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.squid>
+}