Port Foswiki appliance to TurnKey 19

README.rst

@@ -11,9 +11,10 @@ and on top of that:
 
 - Foswiki configurations:
 
-   - Installed from upstream source code to /var/www/foswiki.
-   - Configured cron jobs (daily maintenance, hourly stats, 15min
-     notifications).
+   - Foswiki 2.1.11 is installed from the official release archive to
+     /var/www/foswiki. The archive SHA-256 published in the upstream release
+     metadata is verified during the build.
+   - Configured nightly maintenance, notifications and statistics jobs.
    - Preconfigured mail settings.
 
      **Security note**: Updates to Foswiki may require supervision so
@@ -28,12 +29,12 @@ and on top of that:
   password recovery).
 - Webmin modules for configuring Apache2 and Postfix.
 
-WebMasterEmail is configured in */etc/foswiki/LocalSite.cfg*
+WebMasterEmail is configured in */var/www/foswiki/lib/LocalSite.cfg*
 
 Credentials *(passwords set at first boot)*
 -------------------------------------------
 
--  Webmin, Webshell, SSH: username **root**
+-  Webmin, SSH: username **root**
 -  Foswiki: username **admin**
 
 .. _Foswiki: https://foswiki.org

changelog

@@ -1,3 +1,19 @@
+turnkey-foswiki-19.0 (1) turnkey; urgency=low
+
+  * Upgrade the appliance base to Debian 13 Trixie and Perl 5.40.
+
+  * Install the current Foswiki 2.1.11 security release and verify its
+    upstream release archive digest during the build.
+
+  * Generate the Foswiki configuration from the current release schema,
+    remove an obsolete jQuery setting and preserve web-server ownership of
+    the firstboot password file.
+
+  * Add nightly maintenance, notification and statistics jobs plus focused
+    runtime acceptance for administrator login and wiki topic persistence.
+
+ -- TurnKey GNU/Linux <admin@turnkeylinux.org>  Tue, 25 Aug 2026 05:55:00 +0000
+
 turnkey-foswiki-18.0 (1) turnkey; urgency=low
 
   * Install latest version of foswiki: 2.1.8

conf.d/downloads

@@ -6,13 +6,11 @@ dl() {
 }
 
 SRC="/usr/local/src"
-
-TMP_FILE=$(mktemp)
-GH_API=https://api.github.com/repos/foswiki/distro/releases/latest
-curl -s $GH_API > $TMP_FILE
-LATEST_TAG=$(cat $TMP_FILE | grep -oP '"tag_name": "\K(.*)(?=")')
-LATEST_FILE="$(cat $TMP_FILE | grep -oP -m 1 '"name": "\K(.*)(?=")' | tr ' ' '-').tgz"
-rm -f $TMP_FILE
-URL="https://github.com/foswiki/distro/releases/download/$LATEST_TAG/$LATEST_FILE"
+VERSION=2.1.11
+TAG=FoswikiRelease02x01x11
+FILE=Foswiki-$VERSION.tgz
+SHA256=3a490eb460db4ca69d73dfe44c7984889552e5313eff60162760e80e66e5eba6
+URL="https://github.com/foswiki/distro/releases/download/$TAG/$FILE"
 
 dl $URL $SRC
+echo "$SHA256  $SRC/$FILE" | sha256sum --check

conf.d/main

@@ -13,8 +13,7 @@ $CONFIG -noprompt # auto default config (writes config as root)
 $CONFIG -set {EnableEmail}='1' \
         -set {Email}{MailMethod}='MailProgram' \
         -set {MailProgram}='/usr/sbin/sendmail -t -oi -oeq' \
-        -set {SafeEnvPath}='/usr/local/bin:/usr/bin:/bin' \
-        -set {JQueryPlugin}{JQueryVersionForOldIEs}=''
+        -set {SafeEnvPath}='/usr/local/bin:/usr/bin:/bin'
 
 # ensure that configure.log is owned by www-data
 touch $WEBROOT/working/logs/configure.log

docs/v19.0-testing.md

@@ -0,0 +1,61 @@
+# Foswiki 19.0 testing
+
+## Scope and dependency decision
+
+Debian 13 Trixie does not package Foswiki. The appliance installs official
+Foswiki 2.1.11, a maintained upstream security release published in March
+2026. The build pins SHA-256
+`3a490eb460db4ca69d73dfe44c7984889552e5313eff60162760e80e66e5eba6`
+from the official GitHub release metadata. Perl 5.40, Apache, RCS and Perl
+dependencies come from signed Debian Trixie repositories.
+
+## Acceptance command
+
+```sh
+/sandboxed-git/turnkey/tools/test-v19-appliance foswiki \
+    --source /home/agent/.local/worktrees/turnkey-apps/foswiki/fix-foswiki-v19-upgrade-evidence
+```
+
+## README crosswalk
+
+| README contract | Focused check | Required result | Evidence |
+| --- | --- | --- | --- |
+| Foswiki provides a structured wiki | Log in through the real CSRF-protected form, create a topic through the edit/save CGI flow and read its rendered page | The firstboot administrator authenticates and the new content renders | `tests/v19.sh` |
+| Topic history and state are file-backed | Read the new topic file and Foswiki event log | The content persists and Foswiki records the administrator save | `tests/v19.sh` |
+| SSL works out of the box | Exercise login and topic creation through Apache HTTPS | All application requests succeed at the firstboot URL | `tests/v19.sh` |
+| Scheduled maintenance is configured | Validate and invoke session cleanup, mail notification and statistics commands as `www-data` | Every documented cron command exits successfully under the web identity | `tests/v19.sh` |
+| Postfix supports Foswiki mail | Require active service state and inspect its listener | SMTP is bound to loopback | `tests/v19.sh` |
+| Webmin manages Apache | Require the module and request Webmin HTTPS | The module is installed and Webmin answers on port 12321 | `tests/v19.sh` |
+| Foswiki has a maintained update path | Query the official stable release endpoint, install official Foswiki 2.1.10 in the disposable test container, then apply the official 2.1.11 upgrade archive using the published patch-upgrade procedure | Both archive digests match upstream release metadata, the runtime reaches 2.1.11, and the administrator can still authenticate and read a topic created before the upgrade | `tests/v19.sh` |
+| Standard TurnKey administration is inherited from Core | Cite the unchanged Core layer | Core 19 baseline passes | Core run `20260824t010251z-1634-32241`, source `24c82ee3540ce545422742b0e28ba6b687c53ec2`, verdict `PASS` |
+
+## Static and economical preflight checks
+
+```sh
+bash -n conf.d/downloads conf.d/main tests/v19.sh \
+  overlay/usr/lib/inithooks/firstboot.d/20regen-foswiki-secrets \
+  overlay/usr/lib/inithooks/firstboot.d/40foswiki
+python3 -m py_compile overlay/usr/lib/inithooks/bin/foswiki.py
+git diff --check
+```
+
+A disposable Debian Trixie container installed the release on Perl 5.40,
+generated the current configuration, served Foswiki through Apache, logged in
+as the configured administrator and created a topic through the real web
+edit/save flow. The rendered page, underlying topic file and event log all
+confirmed the write. The maintenance and notification commands also ran as
+`www-data`. The same acceptance run also verified the official Foswiki 2.1.10
+full archive and 2.1.11 upgrade archive SHA-256 digests, created a topic as the
+administrator on 2.1.10, applied the documented patch upgrade as `www-data`,
+ran Foswiki's configuration update, and confirmed the 2.1.11 runtime retained
+both the administrator login and topic content.
+
+## Known limitation and deferred issues
+
+- Docker runtime validation does not exercise the installer, appliance
+  kernel, bootloader or physical hardware. Foswiki adds no appliance-specific
+  behavior at those boundaries, so the validated Core 19 baseline supplies
+  inherited evidence.
+- The statistics job runs nightly, but Foswiki only writes a web statistics
+  topic after an administrator creates one or enables automatic creation.
+  This is upstream default behavior and does not affect wiki editing.

overlay/etc/cron.d/foswiki

@@ -0,0 +1,3 @@
+15 0 * * * www-data perl -I /var/www/foswiki/bin /var/www/foswiki/tools/tick_foswiki.pl >/dev/null 2>&1
+30 0 * * * www-data perl -I /var/www/foswiki/bin /var/www/foswiki/tools/mailnotify -q >/dev/null 2>&1
+45 0 * * * www-data cd /var/www/foswiki/bin && ./statistics -subwebs 1 >/dev/null 2>&1

overlay/usr/lib/inithooks/bin/foswiki.py

@@ -10,7 +10,7 @@
 
 import sys
 import getopt
-from subprocess import check_output
+from subprocess import check_output, run
 
 from libinithooks import inithooks_cache
 from libinithooks.dialog_wrapper import Dialog
@@ -85,6 +85,8 @@ def main():
                   '-set', '{Password}=%s' % password,
                   '-set', '{WebMasterEmail}=%s' % email,
                   '-set', '{DefaultUrlHost}=%s' % domain])
+    run(['htpasswd', '-ci', '/var/www/foswiki/data/.htpasswd', 'admin'],
+        input=password + '\n', text=True, check=True)
 
 
 if __name__ == "__main__":

overlay/usr/lib/inithooks/firstboot.d/40foswiki

@@ -5,4 +5,5 @@
 
 [ -e $INITHOOKS_CONF ] && . $INITHOOKS_CONF 
 $INITHOOKS_PATH/bin/foswiki.py --pass="$APP_PASS" --email="$APP_EMAIL" --domain="$APP_DOMAIN"
-
+chmod 600 /var/www/foswiki/data/.htpasswd
+chown www-data:www-data /var/www/foswiki/data/.htpasswd