committing changes in /etc made by "/usr/bin/apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold upgrade --with-new-pkgs"

Packages with configuration changes:
-thunderbird 1:102.4.0-1~deb11u1 amd64
+thunderbird 1:102.5.0-1~deb11u1 amd64

Package changes:
-containerd.io 1.6.9-1 amd64
+containerd.io 1.6.10-1 amd64
-firefox-esr 102.4.0esr-1~deb11u1 amd64
-firefox-esr-l10n-de 102.4.0esr-1~deb11u1 all
+firefox-esr 102.5.0esr-1~deb11u1 amd64
+firefox-esr-l10n-de 102.5.0esr-1~deb11u1 all
-grub-common 2.06-3~deb11u2 amd64
-grub-efi-amd64 2.06-3~deb11u2 amd64
-grub-efi-amd64-bin 2.06-3~deb11u2 amd64
-grub-efi-amd64-signed 1+2.06+3~deb11u2 amd64
-grub2-common 2.06-3~deb11u2 amd64
+grub-common 2.06-3~deb11u4 amd64
+grub-efi-amd64 2.06-3~deb11u4 amd64
+grub-efi-amd64-bin 2.06-3~deb11u4 amd64
+grub-efi-amd64-signed 1+2.06+3~deb11u4 amd64
+grub2-common 2.06-3~deb11u4 amd64
-krb5-locales 1.18.3-6+deb11u2 all
+krb5-locales 1.18.3-6+deb11u3 all
-libgssapi-krb5-2 1.18.3-6+deb11u2 amd64
-libgssapi-krb5-2 1.18.3-6+deb11u2 i386
+libgssapi-krb5-2 1.18.3-6+deb11u3 amd64
+libgssapi-krb5-2 1.18.3-6+deb11u3 i386
-libk5crypto3 1.18.3-6+deb11u2 amd64
-libk5crypto3 1.18.3-6+deb11u2 i386
+libk5crypto3 1.18.3-6+deb11u3 amd64
+libk5crypto3 1.18.3-6+deb11u3 i386
-libkrb5-3 1.18.3-6+deb11u2 amd64
-libkrb5-3 1.18.3-6+deb11u2 i386
-libkrb5support0 1.18.3-6+deb11u2 amd64
-libkrb5support0 1.18.3-6+deb11u2 i386
+libkrb5-3 1.18.3-6+deb11u3 amd64
+libkrb5-3 1.18.3-6+deb11u3 i386
+libkrb5support0 1.18.3-6+deb11u3 amd64
+libkrb5support0 1.18.3-6+deb11u3 i386
-spotify-client 1:1.1.84.716.gc5f8b819 amd64
+spotify-client 1:1.1.84.716.gc5f8b819-2 amd64
-thunderbird 1:102.4.0-1~deb11u1 amd64
+thunderbird 1:102.5.0-1~deb11u1 amd64
-wine-staging 7.20~bullseye-1 amd64
-wine-staging-amd64 7.20~bullseye-1 amd64
-wine-staging-i386 7.20~bullseye-1 i386
+wine-staging 7.21~bullseye-1 amd64
+wine-staging-amd64 7.21~bullseye-1 amd64
+wine-staging-i386 7.21~bullseye-1 i386
-winehq-staging 7.20~bullseye-1 amd64
+winehq-staging 7.21~bullseye-1 amd64

.etckeeper

@@ -590,6 +590,7 @@ maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-stable.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/google-chrome.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/lutris.asc'
 maybe chmod 0644 'apt/trusted.gpg.d/spotify-2021-10-27-5E3C45D7B312C643.gpg'
+maybe chmod 0644 'apt/trusted.gpg.d/spotify-2022-11-14-7A3A762FAFD4A51F.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/steam.gpg'
 maybe chmod 0755 'avahi'
 maybe chmod 0755 'avahi/avahi-autoipd.action'

apparmor.d/usr.bin.thunderbird

@@ -17,8 +17,10 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
   #include <abstractions/dbus-accessibility>
   #include <abstractions/dbus-session>
   #include <abstractions/dconf>
+  #include <abstractions/dri-enumerate>
   #include <abstractions/gnome>
   #include <abstractions/ibus>
+  #include <abstractions/mesa>
   #include <abstractions/nameservice>
   #include <abstractions/nvidia>
   #include <abstractions/p11-kit>
@@ -43,6 +45,10 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
   # Backported from the dri-enumerate abstraction, available in AppArmor 2.13
   /sys/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
 
+  # Imported from the opencl abstraction, which we cannot include
+  # due to conflicting "x"
+  @{sys}/devices/pci[0-9]*/**/{class,config,resource,revision} r,
+
   # Allow opening attachments
   # TODO: create and use abstractions for opening various file formats
   /{usr/local/,usr/,}bin/* Cx -> sanitized_helper,
@@ -334,6 +340,9 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
   # TB tries to create this file but has no business doing so
   deny @{HOME}/.gnupg/gpg-agent.conf w,
 
+  # Required for Wayland display protocol support
+  owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
+
   profile gpg {
     #include <abstractions/base>
 
@@ -425,6 +434,8 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
     owner /tmp/gpg-[a-zA-Z0-9]*/S.gpg-agent rw,
 
     /usr/share/sounds/** r,
+
+    deny /dev/shm/org.chromium.* rw, # file_inherit only
   }
 
   # Site-specific additions and overrides. See local/README for details.

mailcap

@@ -298,6 +298,7 @@ x-scheme-handler/snap; gnome-software %s; test=test -n "$DISPLAY"
 text/plain; pluma %s; test=test -n "$DISPLAY"
 text/x-apt-sources-list; software-properties-gtk %s; test=test -n "$DISPLAY"
 text/x-apt-sources-list; software-properties-gtk %s; test=test -n "$DISPLAY"
+x-scheme-handler/spotify; spotify %s; test=test -n "$DISPLAY"
 x-scheme-handler/steam; steam steam://open/friends %s; test=test -n "$DISPLAY"
 x-scheme-handler/steamlink; steam steam://open/friends %s; test=test -n "$DISPLAY"
 message/rfc822; /usr/bin/thunderbird %s; test=test -n "$DISPLAY"