Profiles:
  * Fix make xfce4-session.xml tweak idempotent
  * Tweak XScreenSaver to enable only unicode-screensaver by default,
    and append "-background black -foreground white"
  * capture and declare preseeding values from install session w/ disk
    wiping not interrupted
  * Create new package for strong Debian branding with rebranding hooks
  * what about addressbooks?
  * Include gpa?
  * Conditionally enable OpenGL dependencies when supported by hardware
  * Install whatever needed for auto-mounting removable media.
    Thanks to Ralf Bendrath.
  * Fix force-remove calendar-timezones when upgrading iceowl-extension.
    Thanks to Erik Josefsson.
  * install apt-listchanges.

Profiles, for Jessie and newer:
  * install xul-ext-y-u-no-validate
  * Update lists of locale-specific packages, adding ones for Iceowl
  * Update desktop/media topic to drop ESounD support
  * Update desktop/media topic to include mpv (and exclude mplayer2)
  * install systemd-shim

Deployment:
  * test that auto-updating security fixes actually works
  * simple mailinglist subscription
  * Create new package for strong Debian branding with rebranding hooks
  * what about addressbooks? Just use gpa?
  * Document maintenance (passwords change, crypto key revocation, etc.)
  * Document simple backup routines (using e.g. 2GB USB stick)
  * Document host rename (and LVM volume too, if safe when encrypted)
  * Document use of certificate-based wifi authentication
  * Document workaround to ugly hostname:
    * When standing on menu option "auto" hit TAB (not ENTER), delete
      "priority=critical", and hit ENTER.

Deployment, for Lenovo Edge E145:
  * Use unofficial firmware installer (to simplify post-install tuning)
  * Document laptop preparation for smoothest possible user install:
    * Disable secure boot
    * use only legacy BIOS mode (avoid UEFI)
    * enable usb boot support
    * disable Wake On LAN
    * disable LAN Option ROM
    * Exclude any boot devices but internal disk and USB HDD
    * Delete any existing UEFI boot devices
    * boot from usb (via F12), install past disk erasure, switch off
  * Document post-install tuning:
    * sudo aptitude install firmware-linux firmware-realtek broadcom-sta-dkms
  * Test (i.e. compare thoroughly differences with) alternate install:
    * install base system (not automated)...
      + hit enter on root passwords (to switch to sudo-base admin)
      + provide manual mirror: http.debian.net
      + enable popcon
      + deselect all tasks
    * manually download, verify, and execute script.sh:
      wget http://parl.debian.net/desktop/script.sh
      wget http://parl.debian.net/SHA512SUMS
      wget http://parl.debian.net/SHA512SUMS.sig
      aptitude install debian-keyring
      gpgv --keyring /usr/share/keyrings/debian-keyring.gpg SHA512SUMS.sig
      ln -s . desktop
      sha512sum -c SHA512SUMS desktop/script.sh
      sudo sh script.sh

Bugs (report to Debian and track here until fixed in stable):
  * Lots of core packages should be apt-mark'ed as auto-installed
  * root shell should use use skel files (with "dmesg n" added?)
  * documented use of TAB at install screen unusable with UEFI
  * documented use of "d-i partman-auto/method string crypto" is ignored
    (or maybe just needs _all_ vars included, from uninterrupted wipe)
  * task-xfce-desktop should recommend xfce4-session (not xfce4)
    - or xfce4 should only recommend (not depend on) packages like orage