Deb: Cleanup and document

- Remove unnecessary unused files
- Remove duplicate encryption configuration sample from sources and
  re-use the identical file in RPM directory instead
- Clean away harmful "default-character-set = utf8mb4" from client config
  as it is unnecassary (server enforces utf8mb4 anyway by default) and
  could cause issues with mysqlbinlog and other tools (MDEV-22981).
- Update S3 plugin description to be long enough
- Remove trailing whitespace from support-files and Debian packaging.
- Clean away fixed Lintian issues
- Clean away temporary Salsa-CI fixes now that 10.5.4 is out and is fixed
- Apply wrap-and-sort -a -v

12 files changed, 112 insertions, 165 deletions

diff --git a/debian/additions/Docs__Images__Makefile.in b/debian/additions/Docs__Images__Makefile.in
deleted file mode 100644
index f7316d4e345..00000000000
--- a/debian/additions/Docs__Images__Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-all:
-
-distclean:
-	-rm -f Makefile
-
-.PHONY: all distclean clean install check
diff --git a/debian/additions/Docs__Makefile.in b/debian/additions/Docs__Makefile.in
deleted file mode 100644
index f7316d4e345..00000000000
--- a/debian/additions/Docs__Makefile.in
+++ /dev/null
@@ -1,6 +0,0 @@
-all:
-
-distclean:
-	-rm -f Makefile
-
-.PHONY: all distclean clean install check
diff --git a/debian/additions/debian-start.inc.sh b/debian/additions/debian-start.inc.sh
index dfb756225b0..005aa290866 100755
--- a/debian/additions/debian-start.inc.sh
+++ b/debian/additions/debian-start.inc.sh
@@ -5,7 +5,7 @@
 
 ## Check MyISAM and Aria unclosed tables.
 # - Requires the server to be up.
-# - Is supposed to run silently in background. 
+# - Is supposed to run silently in background.
 function check_for_crashed_tables() {
   set -e
   set -u
@@ -25,7 +25,7 @@ function check_for_crashed_tables() {
 
   LC_ALL=C $MYSQL --skip-column-names --batch -e  '
       select concat('\''select count(*) into @discard from `'\'',
-                    TABLE_SCHEMA, '\''`.`'\'', TABLE_NAME, '\''`'\'') 
+                    TABLE_SCHEMA, '\''`.`'\'', TABLE_NAME, '\''`'\'')
       from information_schema.TABLES where TABLE_SCHEMA<>'\''INFORMATION_SCHEMA'\'' and TABLE_SCHEMA<>'\''PERFORMANCE_SCHEMA'\'' and ( ENGINE='\''MyISAM'\'' or ENGINE='\''Aria'\'' )' | \
     xargs -i $MYSQL --skip-column-names --silent --batch \
                     --force -e "{}" &>$tempfile
@@ -39,8 +39,8 @@ function check_for_crashed_tables() {
        $MYADMIN processlist status
     ) >> $tempfile
     # Check for presence as a dependency on mailx would require an MTA.
-    if [ -x /usr/bin/mailx ]; then 
-      mailx -e -s"$MYCHECK_SUBJECT" $MYCHECK_RCPT < $tempfile 
+    if [ -x /usr/bin/mailx ]; then
+      mailx -e -s"$MYCHECK_SUBJECT" $MYCHECK_RCPT < $tempfile
     fi
     (echo "$MYCHECK_SUBJECT"; cat $tempfile) | logger -p daemon.warn -i -t$0
   fi
@@ -49,7 +49,7 @@ function check_for_crashed_tables() {
 
 ## Check for tables needing an upgrade.
 # - Requires the server to be up.
-# - Is supposed to run silently in background. 
+# - Is supposed to run silently in background.
 function upgrade_system_tables_if_necessary() {
   set -e
   set -u
@@ -69,7 +69,7 @@ function upgrade_system_tables_if_necessary() {
 function check_root_accounts() {
   set -e
   set -u
-  
+
   logger -p daemon.info -i -t$0 "Checking for insecure root accounts."
 
   ret=$( echo "SELECT count(*) FROM mysql.user WHERE user='root' and password='' and plugin in ('', 'mysql_native_password', 'mysql_old_password');" | $MYSQL --skip-column-names )
diff --git a/debian/additions/enable_encryption.preset b/debian/additions/enable_encryption.preset
deleted file mode 100644
index 287bc03413a..00000000000
--- a/debian/additions/enable_encryption.preset
+++ /dev/null
@@ -1,20 +0,0 @@
-#
-# !include this file into your my.cnf (or any of *.cnf files in /etc/mysql/conf.d)
-# and it will enable data at rest encryption. This is a simple way to
-# ensure that everything that can be encrypted will be and your
-# data will not leak unencrypted.
-#
-# DO NOT EDIT THIS FILE! On MariaDB upgrades it might be replaced with a
-# newer version and your edits will be lost. Instead, add your edits
-# to the .cnf file after the !include directive.
-#
-# NOTE that you also need to install an encryption plugin for the encryption
-# to work. See https://mariadb.com/kb/en/mariadb/data-at-rest-encryption/#encryption-key-management
-#
-[mariadb]
-aria-encrypt-tables
-encrypt-binlog
-encrypt-tmp-disk-tables
-encrypt-tmp-files
-loose-innodb-encrypt-log
-loose-innodb-encrypt-tables
diff --git a/debian/additions/innotop/innotop b/debian/additions/innotop/innotop
index 941d3c901cb..19229a57a82 100644
--- a/debian/additions/innotop/innotop
+++ b/debian/additions/innotop/innotop
@@ -3,7 +3,7 @@
 # vim: tw=160:nowrap:expandtab:tabstop=3:shiftwidth=3:softtabstop=3
 
 # This program is copyright (c) 2006 Baron Schwartz, baron at xaprb dot com.
-# Maintainers since 2013 : Kenny Gryp - Frédéric Descamps 
+# Maintainers since 2013 : Kenny Gryp - Frédéric Descamps
 # Feedback and improvements are gratefully received.
 #
 # THIS PROGRAM IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR IMPLIED
@@ -640,7 +640,7 @@ sub parse_fk_section {
    } else {
       ( $ts, $type ) = $fulltext =~ m/^$s\s+(\w+)/m;
       $section->{'ts'} = [ parse_innodb_timestamp( $ts ) ];
-   } 
+   }
 
    $section->{'timestring'} = ts_to_string($section->{'ts'});
    $section->{'type'} = $type;
@@ -715,7 +715,7 @@ sub parse_fk_bad_constraint_error {
    @{$section}{ qw(reason) } = $fulltext =~ m/:\s*([^:]+)(?= Constraint:|$)/ms;
    $section->{'reason'} =~ s/\s+/ /g
       if $section->{'reason'};
-   
+
    # Certain data may not be present.  Make them '' if not present.
    map { $section->{$_} ||= "" }
       qw(child_index fk_name col_name parent_table parent_col);
@@ -1042,7 +1042,7 @@ sub parse_tx_text {
    if ( $txn =~ m/^TABLE LOCK|RECORD LOCKS/ ) {
       $locks = [parse_innodb_record_locks($txn, $complete, $debug, $full)];
    }
-   
+
    my ( $tables_in_use, $tables_locked )
       = $txn
       =~ m/^mysql tables in use $d, locked $d$/m;
@@ -1544,7 +1544,7 @@ innotop is a MySQL and InnoDB transaction/status monitor, like 'top' for
 MySQL.  It displays queries, InnoDB transactions, lock waits, deadlocks,
 foreign key errors, open tables, replication status, buffer information,
 row operations, logs, I/O operations, load graph, and more.  You can
-monitor many servers at once with innotop. 
+monitor many servers at once with innotop.
 
 USAGE
    exit(1);
@@ -4695,23 +4695,23 @@ sub main {
    if ( !$windows ) {
       delete $config{max_height};
    }
-   
+
    # Try to lower my priority.
    eval { setpriority(0, 0, getpriority(0, 0) + 10); };
-   
+
    # Print stuff to the screen immediately, don't wait for a newline.
    $OUTPUT_AUTOFLUSH = 1;
-   
+
    # Clear the screen and load the configuration.
    $clear_screen_sub->();
    load_config();
-   
+
    # Override config variables with command-line options
    my %cmdline =
       map  { $_->{c} => $opts{$_->{k}} }
       grep { exists $_->{c} && exists $opts{$_->{k}} }
       @opt_spec;
-   
+
    foreach my $name (keys %cmdline) {
       next if not defined $cmdline{$name};
       my $val = $cmdline{$name};
@@ -4719,23 +4719,23 @@ sub main {
          $config{$name}->{val} = $val;
       }
    }
-   
+
    post_process_tbl_meta();
-   
+
    # Make sure no changes are written to config file in non-interactive mode.
    if ( $opts{n} ) {
       $config{readonly}->{val} = 1;
    }
-   
+
    eval {
-   
+
       # Open the file for InnoDB status
       if ( @ARGV ) {
          my $filename = shift @ARGV;
          open $file, "<", $filename
             or die "Cannot open '$filename': $OS_ERROR";
       }
-   
+
       # In certain modes we might have to collect data for two cycles
       # before printing anything out, so we need to bump up the count one.
       if ( $opts{n} && $opts{count} && $config{status_inc}->{val}
@@ -4743,16 +4743,16 @@ sub main {
       {
          $opts{count}++;
       }
-   
+
       while (++$clock) {
-   
+
          my $mode = $config{mode}->{val} || 'Q';
          if ( !$modes{$mode} ) {
             die "Mode '$mode' doesn't exist; try one of these:\n"
                . join("\n", map { "  $_ $modes{$_}->{hdr}" }  sort keys %modes)
                . "\n";
          }
-   
+
          if ( !$opts{n} ) {
             @last_term_size = @this_term_size;
             @this_term_size = Term::ReadKey::GetTerminalSize(\*STDOUT);
@@ -4763,13 +4763,13 @@ sub main {
             }
             die("Can't read terminal size") unless @this_term_size;
          }
-   
+
          # If there's no connection to a database server, we need to fix that...
          if ( !%connections ) {
             print "You have not defined any database connections.\n\n";
             add_new_dsn();
          }
-   
+
          # See whether there are any connections defined for this mode.  If there's only one
          # connection total, assume the user wants to just use innotop for a single server
          # and don't ask which server to connect to.  Also, if we're monitoring from a file,
@@ -4782,20 +4782,20 @@ sub main {
                choose_connections();
             }
          }
-   
+
          # Term::ReadLine might have re-set $OUTPUT_AUTOFLUSH.
          $OUTPUT_AUTOFLUSH = 1;
-   
+
          # Prune old data
          my $sets = $config{num_status_sets}->{val};
          foreach my $store ( values %vars ) {
             delete @{$store}{ grep { $_ < $clock - $sets } keys %$store };
          }
          %info_gotten = ();
-   
+
          # Call the subroutine to display this mode.
          $modes{$mode}->{display_sub}->();
-   
+
          # It may be time to quit now.
          if ( $opts{count} && $clock >= $opts{count} ) {
             finish();
@@ -4805,7 +4805,7 @@ sub main {
          foreach my $cxn ( grep { $dbhs{$_}->{failed} } keys %dbhs ) {
             eval { connect_to_db($cxn); }; # Ignore errors entirely here.
          }
-   
+
          # Wait for a bit.
          if ( $opts{n} ) {
             sleep($config{interval}->{val});
@@ -4815,10 +4815,10 @@ sub main {
             $char = ReadKey($config{interval}->{val});
             ReadMode('normal');
          }
-   
+
          # Handle whatever action the key indicates.
          do_key_action();
-   
+
       }
    };
    if ( $EVAL_ERROR ) {
@@ -5620,7 +5620,7 @@ sub display_M {
 				push @slave_io_status, extract_values($set, $set, $pre, 'slave_io_status');
 			}
 		 }
-		 if ( $linecount < 1 ) { 
+		 if ( $linecount < 1 ) {
 			$channel = 'no_channels';
 			my $chcxn = $channel . '=' . $cxn;
 			get_slave_status($cxn,$channel);
@@ -6546,7 +6546,7 @@ sub set_to_tbl {
       map { push @group_by, $_ if $_ !~ /^cxn$/ } @{$meta->{group_by}};
       $meta->{group_by} = \@group_by;
    }
-   # if cxn is not visible and there is now more than one connection, 
+   # if cxn is not visible and there is now more than one connection,
    # make cxn visible again.  assume it's not in group_by if it's not
    # visible
    else {
@@ -7187,7 +7187,7 @@ sub distill {
          }
          $query .= " " . $t;
       }
-   } 
+   }
 
    # die $orig_query if $query eq 'LOCK lock';
    return $query;
@@ -7524,7 +7524,7 @@ sub do_stmt {
 
    # Test if the cxn should not even be tried
    return undef if $dbhs{$cxn}
-      && $dbhs{$cxn}->{failed} 
+      && $dbhs{$cxn}->{failed}
       && ( !$dbhs{$cxn}->{dbh} || !$dbhs{$cxn}->{dbh}->{Active} || $dbhs{$cxn}->{mode} eq $config{mode}->{val} );
 
    my $sth;
@@ -7599,7 +7599,7 @@ sub do_query {
 
    # Test if the cxn should not even be tried
    return undef if $dbhs{$cxn}
-      && $dbhs{$cxn}->{failed} 
+      && $dbhs{$cxn}->{failed}
       && ( !$dbhs{$cxn}->{dbh} || !$dbhs{$cxn}->{dbh}->{Active} || $dbhs{$cxn}->{mode} eq $config{mode}->{val} );
 
    my $sth;
@@ -7627,7 +7627,7 @@ sub do_query {
          }
       }
    }
- 
+
    return $sth;
 }
 
@@ -7892,17 +7892,17 @@ sub migrate_config {
 
 # load_config {{{3
 sub load_config {
-    
+
    my ($old_filename, $answer);
 
    if ( $opts{u} or $opts{p} or $opts{h} or $opts{P} or $opts{S} ) {
      my @params = $dsn_parser->get_cxn_params(\%opts); # dsn=$params[0]
-     add_new_dsn($opts{h} || 'localhost', $params[0], 'test.innotop_dl', 
+     add_new_dsn($opts{h} || 'localhost', $params[0], 'test.innotop_dl',
                  $opts{u} ? 1 : 0, $opts{u}, $opts{p} ? 1 : 0, $opts{p});
    }
    if ($opts{c}) {
       $conf_file = $opts{c};
-   }  
+   }
    # If we don't have a new config file but we do have an old one,
    # innotop got upgraded and this is an old config file. Convert it, but
    # don't overwrite something existing.
@@ -7930,14 +7930,14 @@ sub load_config {
       $conf_file = $default_central_conf;
    }
    else {
-      # If no config file was loaded, set readonly to 0 if the user wants to 
+      # If no config file was loaded, set readonly to 0 if the user wants to
       # write a config
       $config{readonly}->{val} = 0 if $opts{w};
-      # If no connections have been defined, connect to a MySQL database 
+      # If no connections have been defined, connect to a MySQL database
       # on localhost using mariadb_read_default_group=client
       if (!%connections) {
-         add_new_dsn('localhost', 
-                     'DBI:MariaDB:;host=localhost;mariadb_read_default_group=client', 
+         add_new_dsn('localhost',
+                     'DBI:MariaDB:;host=localhost;mariadb_read_default_group=client',
                      'test.innotop_dl');
       }
    }
@@ -8476,7 +8476,7 @@ sub save_config {
    elsif ($conf_file and $opts{w}) {
      print "Loaded config file on start-up, so ignoring -w (see --help)\n"
    }
-   
+
    my $dirname  = dirname($conf_file);
 
    # if directories don't exist, create them.  This could cause errors
@@ -9819,7 +9819,7 @@ sub get_slave_status {
          	}
 	  	 } else {
 				 my $dbh = connect_to_db($cxn);
-				 my $sql = 'SHOW SLAVE STATUS FOR CHANNEL \'' . $channel . '\''; 
+				 my $sql = 'SHOW SLAVE STATUS FOR CHANNEL \'' . $channel . '\'';
 				 my $stmt = $dbh->prepare($sql ) ;
 				 $stmt->execute();
          		 my $res = $stmt->fetchall_arrayref({});
@@ -9835,8 +9835,8 @@ sub get_slave_status {
         		 }
 			}
       	}
-	
-   
+
+
 
 
 sub is_func {
@@ -9902,8 +9902,8 @@ host, use the -h option.
 After you've connected, innotop should show you something like the following:
 
  [RO] Query List (? for help) localhost, 01:11:19, 449.44 QPS, 14/7/163 con/run
- 
- CXN        When   Load  QPS    Slow  QCacheHit  KCacheHit  BpsIn    BpsOut 
+
+ CXN        When   Load  QPS    Slow  QCacheHit  KCacheHit  BpsIn    BpsOut
  localhost  Total  0.00  1.07k   697      0.00%     98.17%  476.83k  242.83k
 
  CXN        Cmd    ID         User  Host      DB   Time   Query
@@ -10070,7 +10070,7 @@ L<"cmd_summary"> table, which looks something like the following:
 
  Command Summary (? for help) localhost, 25+07:16:43, 2.45 QPS, 3 thd, 5.0.40
  _____________________ Command Summary _____________________
- Name                    Value    Pct     Last Incr  Pct    
+ Name                    Value    Pct     Last Incr  Pct
  Select_scan             3244858  69.89%          2  100.00%
  Select_range            1354177  29.17%          0    0.00%
  Select_full_join          39479   0.85%          0    0.00%
@@ -11189,7 +11189,7 @@ L<"STATUS_VARIABLES">.
 
 =item slave_io_status
 
-Displays data about the slave I/O thread.  Data source: 
+Displays data about the slave I/O thread.  Data source:
 L<"STATUS_VARIABLES">.
 
 =item slave_sql_status
@@ -11438,8 +11438,8 @@ L<"processlist"> table when prompted).
 Your display might now look like the following:
 
  Query List (? for help) localhost, 32:33, 0.11 QPS, 1 thd, 5.0.38-log
- 
- CXN        Cmd        Cnt  ID      User   Host           Time   Query       
+
+ CXN        Cmd        Cnt  ID      User   Host           Time   Query
  localhost  Query      49    12933  webusr localhost      19:38  SELECT * FROM
  localhost  Sending Da 23     2383  webusr localhost      12:43  SELECT col1,
  localhost  Sleep      120     140  webusr localhost    5:18:12
@@ -11488,14 +11488,14 @@ matches the row; if it does, the row gets the specified color, and no further
 rules are evaluated.  The rules look like the following:
 
  state  eq  Locked       black on_red
- cmd    eq  Sleep        white       
- user   eq  system user  white       
- cmd    eq  Connect      white       
- cmd    eq  Binlog Dump  white       
- time   >   600          red         
- time   >   120          yellow      
- time   >   60           green       
- time   >   30           cyan        
+ cmd    eq  Sleep        white
+ user   eq  system user  white
+ cmd    eq  Connect      white
+ cmd    eq  Binlog Dump  white
+ time   >   600          red
+ time   >   120          yellow
+ time   >   60           green
+ time   >   30           cyan
 
 This is the default rule set for the L<"processlist"> table.  In order of
 priority, these rules make locked queries black on a red background, "gray out"
@@ -11639,9 +11639,9 @@ screen, it will prompt you to choose one of them.  Once you do, innotop will
 show you something like this:
 
  Editing table definition for Buffer Pool.  Press ? for help, q to quit.
- 
- name               hdr          label                  src          
- cxn                CXN          Connection from which  cxn          
+
+ name               hdr          label                  src
+ cxn                CXN          Connection from which  cxn
  buf_pool_size      Size         Buffer pool size       IB_bp_buf_poo
  buf_free           Free Bufs    Buffers free in the b  IB_bp_buf_fre
  pages_total        Pages        Pages total            IB_bp_pages_t
@@ -11931,15 +11931,15 @@ whitespace).
 
  use strict;
  use warnings FATAL => 'all';
- 
+
  package Innotop::Plugin::Example;
  # description: Adds an 'example' column to every table
- 
+
  sub new {
     my ( $class, %vars ) = @_;
     # Store reference to innotop's variables in $self
     my $self = bless { %vars }, $class;
- 
+
     # Design the example column
     my $col = {
        hdr   => 'Example',
@@ -11951,7 +11951,7 @@ whitespace).
        tbl   => '',
        trans => [],
     };
- 
+
     # Add the column to every table.
     my $tbl_meta = $vars{tbl_meta};
     foreach my $tbl ( values %$tbl_meta ) {
@@ -11960,17 +11960,17 @@ whitespace).
        # Add the column to the list of visible columns
        unshift @{$tbl->{visible}}, 'example';
     }
- 
+
     # Be sure to return a reference to the object.
     return $self;
  }
- 
+
  # I'd like to be called when a data set is being rendered into a table, please.
  sub register_for_events {
     my ( $self ) = @_;
     return qw(set_to_tbl_pre_filter);
  }
- 
+
  # This method will be called when the event fires.
  sub set_to_tbl_pre_filter {
     my ( $self, $rows, $tbl ) = @_;
@@ -11979,7 +11979,7 @@ whitespace).
        $row->{example} = 1;
     }
  }
- 
+
  1;
 
 =head2 Plugin Editor
@@ -12181,7 +12181,7 @@ Allen K. Smith,
 Aurimas Mikalauskas,
 Bartosz Fenski,
 Brian Miezejewski,
-Christian Hammers, 
+Christian Hammers,
 Cyril Scetbon,
 Dane Miller,
 David Multer,
diff --git a/debian/additions/innotop/innotop.1 b/debian/additions/innotop/innotop.1
index fefea717cd6..65da5dc0dfb 100644
--- a/debian/additions/innotop/innotop.1
+++ b/debian/additions/innotop/innotop.1
@@ -193,8 +193,8 @@ After you've connected, innotop should show you something like the following:
 .PP
 .Vb 1
 \& [RO] Query List (? for help) localhost, 01:11:19, 449.44 QPS, 14/7/163 con/run
-\& 
-\& CXN        When   Load  QPS    Slow  QCacheHit  KCacheHit  BpsIn    BpsOut 
+\&
+\& CXN        When   Load  QPS    Slow  QCacheHit  KCacheHit  BpsIn    BpsOut
 \& localhost  Total  0.00  1.07k   697      0.00%     98.17%  476.83k  242.83k
 \&
 \& CXN        Cmd    ID         User  Host      DB   Time   Query
@@ -324,7 +324,7 @@ This mode is similar to mytop's Command Summary mode.  It shows the
 .Vb 8
 \& Command Summary (? for help) localhost, 25+07:16:43, 2.45 QPS, 3 thd, 5.0.40
 \& _\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_ Command Summary _\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_\|_
-\& Name                    Value    Pct     Last Incr  Pct    
+\& Name                    Value    Pct     Last Incr  Pct
 \& Select_scan             3244858  69.89%          2  100.00%
 \& Select_range            1354177  29.17%          0    0.00%
 \& Select_full_join          39479   0.85%          0    0.00%
@@ -1261,7 +1261,7 @@ Displays data about InnoDB's semaphores and mutexes.  Data source:
 \&\*(L"\s-1STATUS_VARIABLES\*(R"\s0.
 .IP "slave_io_status" 4
 .IX Item "slave_io_status"
-Displays data about the slave I/O thread.  Data source: 
+Displays data about the slave I/O thread.  Data source:
 \&\*(L"\s-1STATUS_VARIABLES\*(R"\s0.
 .IP "slave_sql_status" 4
 .IX Item "slave_sql_status"
@@ -1472,8 +1472,8 @@ Your display might now look like the following:
 .PP
 .Vb 1
 \& Query List (? for help) localhost, 32:33, 0.11 QPS, 1 thd, 5.0.38\-log
-\& 
-\& CXN        Cmd        Cnt  ID      User   Host           Time   Query       
+\&
+\& CXN        Cmd        Cnt  ID      User   Host           Time   Query
 \& localhost  Query      49    12933  webusr localhost      19:38  SELECT * FROM
 \& localhost  Sending Da 23     2383  webusr localhost      12:43  SELECT col1,
 \& localhost  Sleep      120     140  webusr localhost    5:18:12
@@ -1526,13 +1526,13 @@ rules are evaluated.  The rules look like the following:
 .PP
 .Vb 9
 \& state  eq  Locked       black on_red
-\& cmd    eq  Sleep        white       
-\& user   eq  system user  white       
-\& cmd    eq  Connect      white       
-\& cmd    eq  Binlog Dump  white       
-\& time   >   600          red         
-\& time   >   120          yellow      
-\& time   >   60           green       
+\& cmd    eq  Sleep        white
+\& user   eq  system user  white
+\& cmd    eq  Connect      white
+\& cmd    eq  Binlog Dump  white
+\& time   >   600          red
+\& time   >   120          yellow
+\& time   >   60           green
 \& time   >   30           cyan
 .Ve
 .PP
@@ -1669,9 +1669,9 @@ show you something like this:
 .PP
 .Vb 1
 \& Editing table definition for Buffer Pool.  Press ? for help, q to quit.
-\& 
-\& name               hdr          label                  src          
-\& cxn                CXN          Connection from which  cxn          
+\&
+\& name               hdr          label                  src
+\& cxn                CXN          Connection from which  cxn
 \& buf_pool_size      Size         Buffer pool size       IB_bp_buf_poo
 \& buf_free           Free Bufs    Buffers free in the b  IB_bp_buf_fre
 \& pages_total        Pages        Pages total            IB_bp_pages_t
@@ -1924,15 +1924,15 @@ whitespace).
 .Vb 2
 \& use strict;
 \& use warnings FATAL => \*(Aqall\*(Aq;
-\& 
+\&
 \& package Innotop::Plugin::Example;
 \& # description: Adds an \*(Aqexample\*(Aq column to every table
-\& 
+\&
 \& sub new {
 \&    my ( $class, %vars ) = @_;
 \&    # Store reference to innotop\*(Aqs variables in $self
 \&    my $self = bless { %vars }, $class;
-\& 
+\&
 \&    # Design the example column
 \&    my $col = {
 \&       hdr   => \*(AqExample\*(Aq,
@@ -1944,7 +1944,7 @@ whitespace).
 \&       tbl   => \*(Aq\*(Aq,
 \&       trans => [],
 \&    };
-\& 
+\&
 \&    # Add the column to every table.
 \&    my $tbl_meta = $vars{tbl_meta};
 \&    foreach my $tbl ( values %$tbl_meta ) {
@@ -1953,17 +1953,17 @@ whitespace).
 \&       # Add the column to the list of visible columns
 \&       unshift @{$tbl\->{visible}}, \*(Aqexample\*(Aq;
 \&    }
-\& 
+\&
 \&    # Be sure to return a reference to the object.
 \&    return $self;
 \& }
-\& 
+\&
 \& # I\*(Aqd like to be called when a data set is being rendered into a table, please.
 \& sub register_for_events {
 \&    my ( $self ) = @_;
 \&    return qw(set_to_tbl_pre_filter);
 \& }
-\& 
+\&
 \& # This method will be called when the event fires.
 \& sub set_to_tbl_pre_filter {
 \&    my ( $self, $rows, $tbl ) = @_;
@@ -1972,7 +1972,7 @@ whitespace).
 \&       $row\->{example} = 1;
 \&    }
 \& }
-\& 
+\&
 \& 1;
 .Ve
 .SS "Plugin Editor"
@@ -2137,7 +2137,7 @@ Allen K. Smith,
 Aurimas Mikalauskas,
 Bartosz Fenski,
 Brian Miezejewski,
-Christian Hammers, 
+Christian Hammers,
 Cyril Scetbon,
 Dane Miller,
 David Multer,
diff --git a/debian/additions/mariadb.cnf b/debian/additions/mariadb.cnf
index 8b283e21d3f..d40cdfe33d7 100644
--- a/debian/additions/mariadb.cnf
+++ b/debian/additions/mariadb.cnf
@@ -1,6 +1,7 @@
 # The MariaDB configuration file
 #
 # The MariaDB/MySQL tools read configuration files in the following order:
+# 0. "/etc/mysql/my.cnf" symlinks to this file, reason why all the rest is read.
 # 1. "/etc/mysql/mariadb.cnf" (this file) to set global defaults,
 # 2. "/etc/mysql/conf.d/*.cnf" to set global options.
 # 3. "/etc/mysql/mariadb.conf.d/*.cnf" to set MariaDB-only options.
@@ -17,9 +18,9 @@
 # use it for options that affect everything
 #
 [client-server]
-
-socket                  = /run/mysqld/mysqld.sock
-#port                   = 3306
+# Port or socket location where to connect
+# port = 3306
+socket = /run/mysqld/mysqld.sock
 
 # Import all .cnf files from configuration directory
 !includedir /etc/mysql/conf.d/
diff --git a/debian/additions/mariadb.conf.d/50-client.cnf b/debian/additions/mariadb.conf.d/50-client.cnf
index 4b9bcf78089..fe8f2f3b788 100644
--- a/debian/additions/mariadb.conf.d/50-client.cnf
+++ b/debian/additions/mariadb.conf.d/50-client.cnf
@@ -4,9 +4,6 @@
 #
 
 [client]
-# Default is Latin1, if you need UTF-8 set this (also in server section)
-# default-character-set = utf8mb4
-
 # Example of client certificate usage
 # ssl-cert=/etc/mysql/client-cert.pem
 # ssl-key=/etc/mysql/client-key.pem
diff --git a/debian/additions/mariadb.conf.d/99-enable-encryption.cnf.preset b/debian/additions/mariadb.conf.d/99-enable-encryption.cnf.preset
new file mode 120000
index 00000000000..53e8f5c645c
--- /dev/null
+++ b/debian/additions/mariadb.conf.d/99-enable-encryption.cnf.preset
@@ -0,0 +1 @@
+../../../support-files/rpm/enable_encryption.preset
\ No newline at end of file
diff --git a/debian/control b/debian/control
index 75a50a9b133..0644cd20d09 100644
--- a/debian/control
+++ b/debian/control
@@ -637,8 +637,10 @@ Depends: libcurl4,
          mariadb-server-10.5 (= ${binary:Version}),
          ${misc:Depends},
          ${shlibs:Depends}
-Description: S3 storage engine for MariaDB
- Read only table stored in S3.
+Description: Amazon S3 archival storage engine for MariaDB
+ The S3 storage engine allows one to archive MariaDB tables in Amazon S3 (or any
+ third-party public or private cloud that implements S3 API), but still have
+ them accessible in MariaDB in read-only mode.
 
 Package: mariadb-plugin-rocksdb
 Architecture: amd64 arm64 mips64el ppc64el
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
index bd49f864562..1c10d984942 100644
--- a/debian/salsa-ci.yml
+++ b/debian/salsa-ci.yml
@@ -73,7 +73,6 @@ autopkgtest:
 piuparts:
   extends: .test-piuparts
   stage: test extras
-  allow_failure: true
 
 blhc:
   extends: .test-blhc
@@ -84,11 +83,9 @@ blhc:
 
 lintian:
   extends: .test-lintian
-  allow_failure: true
 
 missing-breaks:
   extends: .test-missing-breaks
-  allow_failure: true
 
 # In addition to Salsa-CI, also run these fully MariaDB specific build jobs
 
@@ -124,7 +121,6 @@ fresh install:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 mariadb-10.3.x to mariadb-10.5.y upgrade:
   stage: upgrade in Sid
@@ -165,7 +161,6 @@ mariadb-10.3.x to mariadb-10.5.y upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 mariadb-10.3.x buster to mariadb-10.5 upgrade:
   stage: upgrade from Buster/Stretch/Jessie
@@ -210,7 +205,6 @@ mariadb-10.3.x buster to mariadb-10.5 upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 mariadb-10.1 to mariadb-10.5 upgrade:
   stage: upgrade from Buster/Stretch/Jessie
@@ -255,7 +249,6 @@ mariadb-10.1 to mariadb-10.5 upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 test basic features:
   stage: test
@@ -311,7 +304,6 @@ test basic features:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 # Build a piece of software that was designed for libmysqlclient-dev but using the
 # libmariadb-dev-compat layer. Should always end up using libmariadb.so.3 run-time.
@@ -335,7 +327,6 @@ build mariadbclient consumer Python-MySQLdb:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 libmysql* to libmariadb* upgrade:
   stage: test extras
@@ -375,7 +366,6 @@ libmysql* to libmariadb* upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 default-libmysqlclient-dev upgrade:
   stage: upgrade in Sid
@@ -402,7 +392,6 @@ default-libmysqlclient-dev upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 default-libmysqlclient-dev on buster upgrade:
   stage: upgrade from Buster/Stretch/Jessie
@@ -431,7 +420,6 @@ default-libmysqlclient-dev on buster upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 default-libmysqlclient-dev on stretch upgrade:
   stage: upgrade from Buster/Stretch/Jessie
@@ -460,7 +448,6 @@ default-libmysqlclient-dev on stretch upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 mariadb-connector-c on stretch upgrade:
   stage: upgrade from Buster/Stretch/Jessie
@@ -489,7 +476,6 @@ mariadb-connector-c on stretch upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 mysql-5.5 to mariadb-10.5 upgrade:
   stage: upgrade from Buster/Stretch/Jessie
@@ -534,7 +520,6 @@ mysql-5.5 to mariadb-10.5 upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 # Upgrading from MySQL 5.7 involves automatic renaming of auth_socket plugin
 # to unix_socket and automaticly re-adding Password column in user table.
@@ -581,7 +566,6 @@ mysql-5.7 to mariadb-10.5 upgrade:
   except:
     variables:
       - $CI_COMMIT_TAG != null && $SALSA_CI_ENABLE_PIPELINE_ON_TAGS !~ /^(1|yes|true)$/
-  allow_failure: true
 
 # Upgrading from MySQL 8.0 with datadir in place is not possible. Users need to do a data dump.
 # The Debian maintainer scripts detect this situation and simply moves old datadir aside and start fresh.
@@ -648,17 +632,14 @@ mariadb.org-10.5.x to mariadb-10.5 upgrade:
     - sed -i "s/101/0/g" -i /usr/sbin/policy-rc.d # Enable automatic restarts from maint scripts
     - cd ${WORKING_DIR} # Don't repeat this step, it's just cd ./debian/output
     - apt-get update
-    - apt install -y curl systemctl # systemctl shim needed on platforms that don't have systemd
+    - apt install -y curl
     - curl -sS https://mariadb.org/mariadb_release_signing_key.asc -o /etc/apt/trusted.gpg.d/mariadb.asc
     - echo 'deb [arch=amd64,i386] http://mirror.one.com/mariadb/repo/10.5/debian sid main' > /etc/apt/sources.list.d/mariadb.list
     - apt-get update
     - apt-get install -y mariadb-server-10.5
     # Verify installation of MySQL from Sid
     - dpkg -l | grep -iE 'maria|mysql|galera' || true # List installed
-    # MariaDB.org version of 10.4 and early 10.5 do not install an init file, so
-    # it must be installed here manually
-    - cp /usr/share/mysql/mysql.init /etc/init.d/mysql; chmod +x /etc/init.d/mysql; service mysql start; sleep 5
-    - service mysql status
+    - service mariadb status
     - mysql --skip-column-names -e "SELECT @@version, @@version_comment"
     - mysql -e "SELECT Host,User,plugin,authentication_string FROM user;" mysql
     - mysql -e "SELECT * FROM plugin;" mysql
@@ -668,7 +649,6 @@ mariadb.org-10.5.x to mariadb-10.5 upgrade:
     # Verify installation of MariaDB built in this commit
     - dpkg -l | grep -iE 'maria|mysql|galera' || true # List installed
     - mariadb --version # Client version
-    - service mysql status
     - service mariadb status
     - mkdir -p debug # Ensure dir exists before using it
     - find /var/lib/mysql -ls > debug/var-lib-mysql.list || true # Ignore errors about "no such file or directory"
diff --git a/debian/source/lintian-overrides b/debian/source/lintian-overrides
index a6c3a616ed8..3ce34a6d83a 100644
--- a/debian/source/lintian-overrides
+++ b/debian/source/lintian-overrides
@@ -1,5 +1,3 @@
-# Upstream fix pending: https://github.com/wolfSSL/wolfssl/pull/2785
-source-is-missing extra/wolfssl/wolfssl/doc/formats/html/html_changes/menu.js line length is 679 characters (>512)
 # Necessary for drop-in-place-replacement upgrades on mysql-server/-client
 # since package breaks/replaces these but at the same time also provides them
 version-substvar-for-external-package mariadb-client-core-10.5 -> mysql-client-5.5