tz database, which has a
++model for describing civil time that is more complex than the
++standard and daylight saving times required by POSIX.1-2017.
+ A tz timezone corresponds to a ruleset that can
+ have more than two changes per year, these changes need not merely
+ flip back and forth between two alternatives, and the rules themselves
+@@ -121,8 +123,9 @@
+ locate the user on a timezone map or prioritize names that are
+ geographically close. For an example selection interface, see the
+ tzselect program in the tz code.
+-The Unicode Common Locale Data
+-Repository contains data that may be useful for other selection
++Unicode's Common Locale Data
++Repository (CLDR)
++contains data that may be useful for other selection
+ interfaces; it maps timezone names like Europe/Prague to
+ locale-dependent strings like "Prague", "Praha", "Прага", and "布拉格".
+
+@@ -159,7 +162,7 @@
+
+
+
+-Names normally have the form
++Names normally have the format
+ AREA/LOCATION, where
+ AREA is a continent or ocean, and
+ LOCATION is a specific location within the area.
+@@ -187,7 +190,7 @@
+ href="https://en.wikipedia.org/wiki/ASCII">ASCII letters,
+ '.', '-' and '_'.
+ Do not use digits, as that might create an ambiguity with POSIX.1-2017
++ href="https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_03">POSIX's proleptic
+ TZ strings.
+ A file name component must not exceed 14 characters or start with
+ '-'.
+@@ -198,6 +201,8 @@
+
//', or
+ start or end with '/'.
++ Also, a name must not be 'Etc/Unknown', as
++ CLDR uses that string for an unknown or invalid timezone.
+ Indian/Crozet
++ as a near-duplicate or alias of Asia/Dubai
++ merely because they are different countries or territories,
++ or their clocks disagreed before 1970, or the
++ Crozet Islands
++ are notable in their own right,
++ or the Crozet Islands are not adjacent to other locations
++ that use Asia/Dubai.
+ backward or in some other file.
+ The source file etcetera defines names that may be useful
+-on platforms that do not support POSIX.1-2017-style TZ strings;
++on platforms that do not support proleptic TZ strings
++like <+08>-8;
+ no other source file other than backward
+ contains links to its zones.
+ One of etcetera's names is Etc/UTC,
+@@ -425,8 +439,8 @@
+ In other words, in the C locale the POSIX extended regular
+ expression [-+[:alnum:]]{3,6} should match the
+ abbreviation.
+- This guarantees that all abbreviations could have been specified by a
+- POSIX.1-2017 TZ string.
++ This guarantees that all abbreviations could have been specified
++ explicitly by a POSIX proleptic TZ string.
+
+ -' is a flag that the UT offset is in
+ some sense undefined; this notation is derived
+- from Internet
++ from Internet
+ RFC 3339.
++ (The abbreviation 'Z' that
++ Internet
++ RFC 9557 uses for this concept
++ would violate the POSIX requirement
++ of at least three characters in an abbreviation.)
+ tz code and data, which
+ provide only limited support for date and time localization
+- such as that required by POSIX.1-2017.
++ such as that required by POSIX.
+ If DST is not used a different time zone
+ can often do the trick; for example, in Kenya a TZ setting
+ like <-03>3 or America/Cayenne starts
+@@ -866,29 +885,62 @@
+ part of many platforms, where the
+ primary use of this package is to update obsolete time-related files.
+ To do this, you may need to compile the time zone compiler
+-'zic' supplied with this package instead of using the
+-system 'zic', since the format of zic's
++zic supplied with this package instead of using the
++system zic, since the format of zic's
+ input is occasionally extended, and a platform may still be shipping
+ an older zic.
+
+
+-
++In POSIX, time display in a process is controlled by the
++environment variable TZ, which can have two forms:
++
TZ value
++ like CET-1CEST,M3.5.0,M10.5.0/3 uses a complex
++ notation that specifies a single standard time along with daylight
++ saving rules that apply to all years past, present, and future.
++ TZ value
++ like Europe/Berlin names a location that stands for
++ civil time near that location, which can have more than
++ one standard time and more than one set of daylight saving rules,
++ to record timekeeping practice more accurately.
++ These names are defined by the tz database.
++ ++Some platforms support only the features required by POSIX.1-2017, ++and have not yet upgraded to POSIX.1-2024. ++Code intended to be portable to these platforms must deal ++with problems that were fixed in later POSIX editions. ++
++ ++TZ,
++ and there is no convenient and efficient way to determine
++ the UT offset and time zone abbreviation of arbitrary
++ timestamps, particularly for timezones
++ that do not fit into the POSIX model.
++
+- In POSIX.1-2017, time display in a process is controlled by the
+- environment variable TZ.
+- Unfortunately, the POSIX.1-2017
+- TZ string takes a form that is hard to describe and
+- is error-prone in practice.
+- Also, POSIX.1-2017 TZ strings cannot deal with daylight
++ The proleptic TZ string,
++ which is all that POSIX.1-2017 requires,
++ has a format that is hard to describe and is error-prone in practice.
++ Also, proleptic TZ strings cannot deal with daylight
+ saving time rules not based on the Gregorian calendar (as in
+ Morocco), or with situations where more than two time zone
+ abbreviations or UT offsets are used in an area.
+
+- The POSIX.1-2017 TZ string takes the following form:
++ A proleptic TZ string has the following format:
+
+@@ -955,7 +1007,7 @@ + + +
+- Here is an example POSIX.1-2017 TZ string for New
++ Here is an example proleptic TZ string for New
+ Zealand after 2007.
+ It says that standard time (NZST) is 12 hours ahead
+ of UT, and that daylight saving time
+@@ -966,26 +1018,46 @@
+
TZ='NZST-12NZDT,M9.5.0,M4.1.0/3'
+- This POSIX.1-2017 TZ string is hard to remember, and
++ This proleptic TZ string is hard to remember, and
+ mishandles some timestamps before 2008.
+- With this package you can use this instead:
++ With this package you can use a geographical TZ instead:
+
TZ='Pacific/Auckland'++POSIX.1-2017 also has the limitations of POSIX.1-2024, ++discussed in the next section. ++
++ ++++POSIX.1-2024 extends POSIX.1-2017 in the following significant ways: ++
++TZ values like
+- "EST5EDT".
+- Traditionally the current US DST rules
+- were used to interpret such values, but this meant that the
+- US DST rules were compiled into each
+- time conversion package, and when
+- US time conversion rules changed (as in the United
+- States in 1987 and again in 2007), all packages that
+- interpreted TZ values had to be updated
+- to ensure proper results.
++ POSIX.1-2024 requires support for geographical TZ.
++ Earlier POSIX editions require support only for proleptic TZ.
++ struct tm
++ to have a UT offset member tm_gmtoff
++ and a time zone abbreviation member tm_zone.
++ Earlier POSIX editions lack this requirement.
++ "<-02>2<-01>,M3.5.0/-1,M10.5.0/0"
++ where the transition time −1:00 means 23:00 the previous day.
+ ++However POSIX.1-2024, like earlier POSIX editions, has some limitations: ++
TZ environment variable is process-global, which
+ makes it hard to write efficient, thread-safe applications that
+@@ -1003,16 +1075,34 @@
+ handling daylight saving time shifts – as might be required to
+ limit phone calls to off-peak hours.
+ time_t clock counts exclude leap
+ seconds.
+ TZ values like
++ "EST5EDT".
++ Traditionally the current US DST rules
++ were used to interpret such values, but this meant that the
++ US DST rules were compiled into each
++ time conversion package, and when
++ US time conversion rules changed (as in the United
++ States in 1987 and again in 2007), all packages that
++ interpreted TZ values had to be updated
++ to ensure proper results.
++ tz code
++ The tz code defines some properties
++ left unspecified by POSIX, and attempts to support some
++ extensions to POSIX.
++
tz code attempts to support all the
+ time_t implementations allowed by POSIX.
+@@ -1026,25 +1116,18 @@
+ and 40-bit integers are also used occasionally.
+ Although earlier POSIX versions allowed time_t to be a
+ floating-point type, this was not supported by any practical system,
+- and POSIX.1-2013 and the tz code both
++ and POSIX.1-2013+ and the tz code both
+ require time_t to be an integer type.
+ tz code
+- The TZ environment variable is used in generating
+- the name of a file from which time-related information is read
+- (or is interpreted à la POSIX.1-2017); TZ is no longer
+- constrained to be a string containing abbreviations
+- and numeric data as described above.
++ If the TZ environment variable uses the geographical format,
++ it is used in generating
++ the name of a file from which time-related information is read.
+ The file's format is TZif,
+ a timezone information format that contains binary data; see
+- Internet
+- RFC 8536.
++ Internet
++ RFC 9636.
+ The daylight saving time rules to be used for a
+ particular timezone are encoded in the
+ TZif file; the format of the file allows US,
+@@ -1053,10 +1136,11 @@
+ abbreviations are used.
+
+- It was recognized that allowing the TZ environment
++ When the tz code was developed in the 1980s,
++ it was recognized that allowing the TZ environment
+ variable to take on values such as 'America/New_York'
+ might cause "old" programs (that expect TZ to have a
+- certain form) to operate incorrectly; consideration was given to using
++ certain format) to operate incorrectly; consideration was given to using
+ some other environment variable (for example, TIMEZONE)
+ to hold the string used to generate the TZif file's name.
+ In the end, however, it was decided to continue using
+@@ -1069,15 +1153,6 @@
+ assume pre-POSIX TZ values.
+
struct tm, e.g., tm_gmtoff,
+- or with a time zone abbreviation member in
+- struct tm, e.g., tm_zone. As noted
+- in Austin
+- Group defect 1533, a future version of POSIX is planned to
+- require tm_gmtoff and tm_zone.
+- tzalloc, tzfree,
+ localtime_rz, and mktime_z for
+@@ -1088,7 +1163,7 @@
+ and localtime_rz and mktime_z are
+ like localtime_r and mktime with an
+ extra timezone_t argument.
+- The functions were inspired by NetBSD.
++ The functions were inspired by NetBSD.
+ time_t values are supported, on systems
+@@ -1116,6 +1191,7 @@
+ tzname variable does not suffice and is no
+ longer needed.
++ It is planned to be removed in a future edition of POSIX.
+ To get a timestamp's time zone abbreviation, consult
+ the tm_zone member if available; otherwise,
+ use strftime's "%Z" conversion
+@@ -1124,6 +1200,7 @@
+ daylight and timezone
+ variables do not suffice and are no longer needed.
++ They are planned to be removed in a future edition of POSIX.
+ To get a timestamp's UT offset, consult
+ the tm_gmtoff member if available; otherwise,
+ subtract values returned by localtime
+@@ -1135,12 +1212,15 @@
+ The tm_isdst member is almost never needed and most of
+ its uses should be discouraged in favor of the abovementioned
+ APIs.
++ It was intended as an index into the tzname variable,
++ but as mentioned previously that usage is obsolete.
+ Although it can still be used in arguments to
+ mktime to disambiguate timestamps near
+ a DST transition when the clock jumps back on
+ platforms lacking tm_gmtoff, this
+- disambiguation does not work when standard time itself jumps back,
+- which can occur when a location changes to a time zone with a
++ disambiguation works only for proleptic TZ strings;
++ it does not work in general for geographical timezones,
++ such as when a location changes to a time zone with a
+ lesser UT offset.
+ timezone function
+ may now examine localtime(&clock)->tm_zone
+ (if TM_ZONE is defined) or
+- tzname[localtime(&clock)->tm_isdst]
+- (if HAVE_TZNAME is nonzero) to learn the correct time
++ use strftime with a %Z conversion specification
++ to learn the correct time
+ zone abbreviation to use.
+
+ + Leap seconds were introduced in 1972 to accommodate the + difference between atomic time and the less regular rotation of the earth. +-Unfortunately they caused so many problems with civil +-timekeeping that they +-are planned +-to be discontinued by 2035, with some as-yet-undetermined +-mechanism replacing them, perhaps after the year 2135. +-Despite their impending obsolescence, a record of leap seconds is still +-needed to resolve timestamps from 1972 through 2035. ++Unfortunately they have caused so many problems with civil ++timekeeping that there are ++plans ++to discontinue them by 2035. ++Even if these plans come to fruition, a record of leap seconds will still be ++needed to resolve timestamps from 1972 through 2035, ++and there may also be a need to record whatever mechanism replaces them. +
+ ++@@ -1374,6 +1454,12 @@ + the establishment of a reference timescale for the Moon, which has + days roughly equivalent to 29.5 Earth days, and where relativistic + effects cause clocks to tick slightly faster than on Earth. ++Also, NASA ++has been ordered ++to consider the establishment of Coordinated Lunar Time (LTC). ++It is not yet known whether the US and European efforts will result in ++multiple timescales on the Moon. +
+ +
+--- contrib/tzdata/version.orig
++++ contrib/tzdata/version
+@@ -1 +1 @@
+-2024a
++2025a
+--- contrib/tzdata/ziguard.awk.orig
++++ contrib/tzdata/ziguard.awk
+@@ -5,14 +5,10 @@
+ # This is not a general-purpose converter; it is designed for current tzdata.
+ # It just converts from current source to main, vanguard, and rearguard forms.
+ # Although it might be nice for it to be idempotent, or to be useful
+-# for converting back and forth between vanguard and rearguard formats,
++# for converting back and forth between formats,
+ # it does not do these nonessential tasks now.
+ #
+-# Although main and vanguard forms are currently equivalent,
+-# this need not always be the case. When the two forms differ,
+-# this script can convert either from main to vanguard form (needed then),
+-# or from vanguard to main form (this conversion would be needed later,
+-# after main became rearguard and vanguard became main).
++# This script can convert from main to vanguard form and vice versa.
+ # There is no need to convert rearguard to other forms.
+ #
+ # When converting to vanguard form, the output can use the line
+@@ -145,12 +141,12 @@
+ }
+
+ # If this line should differ due to Portugal benefiting from %z if supported,
+- # uncomment the desired version and comment out the undesired one.
+- if ($0 ~ /^#?[\t ]+-[12]:00[\t ]+Port[\t ]+[%+-]/) {
+- if (($0 ~ /%z/) == (DATAFORM == "vanguard")) {
+- uncomment = in_comment
+- } else {
++ # comment out the undesired version and uncomment the desired one.
++ if ($0 ~ /^#?[\t ]+-[12]:00[\t ]+((Port|W-Eur)[\t ]+[%+-]|-[\t ]+(%z|-01)[\t ]+1982 Mar 28)/) {
++ if (($0 ~ /%z/) == (DATAFORM == "rearguard")) {
+ comment_out = !in_comment
++ } else {
++ uncomment = in_comment
+ }
+ }
+
+@@ -172,13 +168,8 @@
+ sub(/^/, "#")
+ }
+
+- # Prefer %z in vanguard form, explicit abbreviations otherwise.
+- if (DATAFORM == "vanguard") {
+- sub(/^(Zone[\t ]+[^\t ]+)?[\t ]+[^\t ]+[\t ]+[^\t ]+[\t ]+[-+][^\t ]+/, \
+- "&CHANGE-TO-%z")
+- sub(/-00CHANGE-TO-%z/, "-00")
+- sub(/[-+][^\t ]+CHANGE-TO-/, "")
+- } else {
++ # Prefer explicit abbreviations in rearguard form, %z otherwise.
++ if (DATAFORM == "rearguard") {
+ if ($0 ~ /^[^#]*%z/) {
+ stdoff_column = 2 * ($0 ~ /^Zone/) + 1
+ rules_column = stdoff_column + 1
+@@ -216,6 +207,11 @@
+ }
+ sub(/%z/, abbr)
+ }
++ } else {
++ sub(/^(Zone[\t ]+[^\t ]+)?[\t ]+[^\t ]+[\t ]+[^\t ]+[\t ]+[-+][^\t ]+/, \
++ "&CHANGE-TO-%z")
++ sub(/-00CHANGE-TO-%z/, "-00")
++ sub(/[-+][^\t ]+CHANGE-TO-/, "")
+ }
+
+ # Normally, prefer whole seconds. However, prefer subseconds
+--- contrib/tzdata/zone.tab.orig
++++ contrib/tzdata/zone.tab
+@@ -264,8 +264,7 @@
+ ML +1239-00800 Africa/Bamako
+ MM +1647+09610 Asia/Yangon
+ MN +4755+10653 Asia/Ulaanbaatar most of Mongolia
+-MN +4801+09139 Asia/Hovd Bayan-Olgiy, Govi-Altai, Hovd, Uvs, Zavkhan
+-MN +4804+11430 Asia/Choibalsan Dornod, Sukhbaatar
++MN +4801+09139 Asia/Hovd Bayan-Olgii, Hovd, Uvs
+ MO +221150+1133230 Asia/Macau
+ MP +1512+14545 Pacific/Saipan
+ MQ +1436-06105 America/Martinique
+@@ -311,7 +310,7 @@
+ PF -2308-13457 Pacific/Gambier Gambier Islands
+ PG -0930+14710 Pacific/Port_Moresby most of Papua New Guinea
+ PG -0613+15534 Pacific/Bougainville Bougainville
+-PH +1435+12100 Asia/Manila
++PH +143512+1205804 Asia/Manila
+ PK +2452+06703 Asia/Karachi
+ PL +5215+02100 Europe/Warsaw
+ PM +4703-05620 America/Miquelon
+--- contrib/tzdata/zone1970.tab.orig
++++ contrib/tzdata/zone1970.tab
+@@ -184,7 +184,7 @@
+ IT,SM,VA +4154+01229 Europe/Rome
+ JM +175805-0764736 America/Jamaica
+ JO +3157+03556 Asia/Amman
+-JP +353916+1394441 Asia/Tokyo
++JP,AU +353916+1394441 Asia/Tokyo Eyre Bird Observatory
+ KE,DJ,ER,ET,KM,MG,SO,TZ,UG,YT -0117+03649 Africa/Nairobi
+ KG +4254+07436 Asia/Bishkek
+ KI,MH,TV,UM,WF +0125+17300 Pacific/Tarawa Gilberts, Marshalls, Wake
+@@ -210,8 +210,7 @@
+ MH +0905+16720 Pacific/Kwajalein Kwajalein
+ MM,CC +1647+09610 Asia/Yangon
+ MN +4755+10653 Asia/Ulaanbaatar most of Mongolia
+-MN +4801+09139 Asia/Hovd Bayan-Ölgii, Govi-Altai, Hovd, Uvs, Zavkhan
+-MN +4804+11430 Asia/Choibalsan Dornod, Sükhbaatar
++MN +4801+09139 Asia/Hovd Bayan-Ölgii, Hovd, Uvs
+ MO +221150+1133230 Asia/Macau
+ MQ +1436-06105 America/Martinique
+ MT +3554+01431 Europe/Malta
+@@ -248,7 +247,7 @@
+ PF -2308-13457 Pacific/Gambier Gambier Islands
+ PG,AQ,FM -0930+14710 Pacific/Port_Moresby Papua New Guinea (most areas), Chuuk, Yap, Dumont d'Urville
+ PG -0613+15534 Pacific/Bougainville Bougainville
+-PH +1435+12100 Asia/Manila
++PH +143512+1205804 Asia/Manila
+ PK +2452+06703 Asia/Karachi
+ PL +5215+02100 Europe/Warsaw
+ PM +4703-05620 America/Miquelon
+@@ -295,7 +294,7 @@
+ SA,AQ,KW,YE +2438+04643 Asia/Riyadh Syowa
+ SB,FM -0932+16012 Pacific/Guadalcanal Pohnpei
+ SD +1536+03232 Africa/Khartoum
+-SG,MY +0117+10351 Asia/Singapore peninsular Malaysia
++SG,AQ,MY +0117+10351 Asia/Singapore peninsular Malaysia, Concordia
+ SR +0550-05510 America/Paramaribo
+ SS +0451+03137 Africa/Juba
+ ST +0020+00644 Africa/Sao_Tome
+--- contrib/tzdata/zonenow.tab.orig
++++ contrib/tzdata/zonenow.tab
+@@ -5,7 +5,7 @@
+ # From Paul Eggert (2023-12-18):
+ # This file contains a table where each row stands for a timezone
+ # where civil timestamps are predicted to agree from now on.
+-# This file is like zone1970.tab (see zone1970.tab's coments),
++# This file is like zone1970.tab (see zone1970.tab's comments),
+ # but with the following changes:
+ #
+ # 1. Each timezone corresponds to a set of clocks that are planned
+@@ -97,9 +97,6 @@
+ # -04/-03 (Chile DST)
+ XX -3327-07040 America/Santiago most of Chile
+ #
+-# -04/-03 (Paraguay DST)
+-XX -2516-05740 America/Asuncion Paraguay
+-#
+ # -04/-03 - AST/ADT (North America DST)
+ XX +4439-06336 America/Halifax Atlantic ("AST/ADT") - Canada; Bermuda
+ #
+@@ -123,8 +120,6 @@
+ #
+ # -01/+00 (EU DST)
+ XX +3744-02540 Atlantic/Azores Azores
+-# -01/+00 (EU DST) until 2024-03-31; then -02/-01 (EU DST)
+-XX +7029-02158 America/Scoresbysund Ittoqqortoormiit
+ #
+ # +00 - GMT
+ XX +0519-00402 Africa/Abidjan far western Africa; Iceland ("GMT")
+@@ -199,7 +194,7 @@
+ XX +3431+06912 Asia/Kabul Afghanistan
+ #
+ # +05
+-XX +4120+06918 Asia/Tashkent Russia; west Kazakhstan; Tajikistan; Turkmenistan; Uzbekistan; Maldives
++XX +4120+06918 Asia/Tashkent Russia; Kazakhstan; Tajikistan; Turkmenistan; Uzbekistan; Maldives
+ #
+ # +05 - PKT
+ XX +2452+06703 Asia/Karachi Pakistan ("PKT")
+@@ -215,8 +210,6 @@
+ #
+ # +06
+ XX +2343+09025 Asia/Dhaka Russia; Kyrgyzstan; Bhutan; Bangladesh; Chagos
+-# +06 until 2024-03-01; then +05
+-XX +4315+07657 Asia/Almaty Kazakhstan (except western areas)
+ #
+ # +06:30
+ XX +1647+09610 Asia/Yangon Myanmar; Cocos
+@@ -228,7 +221,7 @@
+ XX -0610+10648 Asia/Jakarta Indonesia ("WIB")
+ #
+ # +08
+-XX +0117+10351 Asia/Singapore Russia; Brunei; Malaysia; Singapore
++XX +0117+10351 Asia/Singapore Russia; Brunei; Malaysia; Singapore; Concordia
+ #
+ # +08 - AWST
+ XX -3157+11551 Australia/Perth Western Australia ("AWST")
+@@ -240,7 +233,7 @@
+ XX +2217+11409 Asia/Hong_Kong Hong Kong ("HKT")
+ #
+ # +08 - PHT
+-XX +1435+12100 Asia/Manila Philippines ("PHT")
++XX +143512+1205804 Asia/Manila Philippines ("PHT")
+ #
+ # +08 - WITA
+ XX -0507+11924 Asia/Makassar Indonesia ("WITA")
+@@ -252,7 +245,7 @@
+ XX +5203+11328 Asia/Chita Russia; Palau; East Timor
+ #
+ # +09 - JST
+-XX +353916+1394441 Asia/Tokyo Japan ("JST")
++XX +353916+1394441 Asia/Tokyo Japan ("JST"); Eyre Bird Observatory
+ #
+ # +09 - KST
+ XX +3733+12658 Asia/Seoul Korea ("KST")
diff --git a/website/static/security/patches/EN-25:03/tzdata-2024b-2025a.patch.asc b/website/static/security/patches/EN-25:03/tzdata-2024b-2025a.patch.asc
new file mode 100644
index 0000000000..a4ca86afd8
--- /dev/null
+++ b/website/static/security/patches/EN-25:03/tzdata-2024b-2025a.patch.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmeajKYACgkQbljekB8A
+Gu/rTBAArfZClfutaM3DseJ5JQqYK9ZX8/K5bD7VXdz3ES+4+/OUq9JLS3mTDWfu
+KCWzuwf90nrE4E5HSLzvNjZj20EDw+rHPg0abmxc+itmixERMRttSfnYWyNA8aTx
+eqhZQpT7AyB7oEQEwl+u74Hziu04q94Dzw2uJ8Nd8wEgsOuAz5UKigiyFyzkhWJV
+KZeiS5BbCAoH+/OETNHjeloe+9J8hCHP4u48JktEMjHmNKcLE0Cz1i+AdN1VzUB7
+EoGhYkQzs25avBL5gFJabR7EJh1Ui6vT58LI/k3rAsnjlynAV+OZRyzzDg0f9UID
+ZqIL2PtAUI2NpF4O8H9FnlWxZXQlV8Dsu8dN0dT2nKTOicEponmlK+h7MPpIxmKc
+yPSDQ8Omu1jMSCuM1uoylvwxnSvRof2eOxCvlRjhG1pOGCYmGm1JQe3yXEIb9kb9
+2iDncF+8qFh/aa16gwsjFXqdB1nj5hds+F4ZSer67sOh1+EzhuJD7JlC1DvLl9Te
+C3Rdui3yLRwy3iZLodhv+OZmmUt2K0qR7Tp5+JER72iOMy4U0y9f3CwzqTNNEavm
+eDVvrnWZLFj5qRY5p4nzWvfz92BMoXIqFTElmwcHs9l2RW6AZts6i9qPTYIGN8bd
+c+VC4X7SRh5eRkmDQqYXOAdiBR44XygJqK6wE1Dh9IWJKkNUfxo=
+=AyyE
+-----END PGP SIGNATURE-----
diff --git a/website/static/security/patches/EN-25:03/tzdata-2025a.patch b/website/static/security/patches/EN-25:03/tzdata-2025a.patch
new file mode 100644
index 0000000000..dbc93c9653
--- /dev/null
+++ b/website/static/security/patches/EN-25:03/tzdata-2025a.patch
@@ -0,0 +1,929 @@
+--- contrib/tzdata/Makefile.orig
++++ contrib/tzdata/Makefile
+@@ -137,7 +137,7 @@
+ uint_least64_t.ck
+
+ # What kind of TZif data files to generate. (TZif is the binary time
+-# zone data format that zic generates; see Internet RFC 8536.)
++# zone data format that zic generates; see Internet RFC 9636.)
+ # If you want only POSIX time, with time values interpreted as
+ # seconds since the epoch (not counting leap seconds), use
+ # REDO= posix_only
+@@ -255,6 +255,7 @@
+ # -DHAVE_UNISTD_H=0 if tzselect program in the tz code.
+-The Unicode Common Locale Data
+-Repository contains data that may be useful for other selection
++Unicode's Common Locale Data
++Repository (CLDR)
++contains data that may be useful for other selection
+ interfaces; it maps timezone names like Europe/Prague to
+ locale-dependent strings like "Prague", "Praha", "Прага", and "布拉格".
+
//', or
+ start or end with '/'.
++ Also, a name must not be 'Etc/Unknown', as
++ CLDR uses that string for an unknown or invalid timezone.
+ Indian/Crozet
++ as a near-duplicate or alias of Asia/Dubai
++ merely because they are different countries or territories,
++ or their clocks disagreed before 1970, or the
++ Crozet Islands
++ are notable in their own right,
++ or the Crozet Islands are not adjacent to other locations
++ that use Asia/Dubai.
+ -' is a flag that the UT offset is in
+ some sense undefined; this notation is derived
+- from Internet
++ from Internet
+ RFC 3339.
+ (The abbreviation 'Z' that
+- Internet
++ Internet
+ RFC 9557 uses for this concept
+ would violate the POSIX requirement
+ of at least three characters in an abbreviation.)
+@@ -1115,8 +1126,8 @@
+ the name of a file from which time-related information is read.
+ The file's format is TZif,
+ a timezone information format that contains binary data; see
+- Internet
+- RFC 8536.
++ Internet
++ RFC 9636.
+ The daylight saving time rules to be used for a
+ particular timezone are encoded in the
+ TZif file; the format of the file allows US,
+@@ -1201,12 +1212,15 @@
+ The tm_isdst member is almost never needed and most of
+ its uses should be discouraged in favor of the abovementioned
+ APIs.
++ It was intended as an index into the tzname variable,
++ but as mentioned previously that usage is obsolete.
+ Although it can still be used in arguments to
+ mktime to disambiguate timestamps near
+ a DST transition when the clock jumps back on
+ platforms lacking tm_gmtoff, this
+- disambiguation does not work when standard time itself jumps back,
+- which can occur when a location changes to a time zone with a
++ disambiguation works only for proleptic TZ strings;
++ it does not work in general for geographical timezones,
++ such as when a location changes to a time zone with a
+ lesser UT offset.
+ timezone function
+ may now examine localtime(&clock)->tm_zone
+ (if TM_ZONE is defined) or
+- tzname[localtime(&clock)->tm_isdst]
+- (if HAVE_TZNAME is nonzero) to learn the correct time
++ use strftime with a %Z conversion specification
++ to learn the correct time
+ zone abbreviation to use.
+
+