Bug#1143581: trixie-pu: package calibre/8.5.0+ds-1+deb13u4

diff --git a/debian/changelog b/debian/changelog
index 2c68c9e613..97490afed4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+calibre (8.5.0+ds-1+deb13u4) trixie; urgency=medium
+
+  * This update adds fixup for CVE-2026-25636 patch in 8.5.0+ds-1+deb13u2
+
+  * Set default Debian branch name for trixie
+  * Use salsa CI
+  * Disable uscan test.
+    It always fail because the upstream code is not latest one.
+  * Add test for reproduce Debian bug 1143484
+  * CVE-2026-25636 (1/2): EPUB Input: Ensure font obfuscation processing
+    happens only on files from the EPUB (Closes: #1143484)
+  * Rename a CVE-2026-25636 patch in 8.5.0+ds-1+deb13u2
+  * Renumber patches
+  * CVE-2026-53511: Disallow Python templates when reading book metadata
+
+ -- YOKOTA Hiroshi <[email protected]>  Thu, 13 Aug 2026 01:10:49 +0900
+
 calibre (8.5.0+ds-1+deb13u3) trixie; urgency=medium
 
   * Fix security vulnerabilities and code quality issues (Closes: #1135543)
diff --git a/debian/copyright b/debian/copyright
index ec4263d541..950490edec 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -93,6 +93,18 @@ Copyright: Copyright (C) 2007, Kovid Goyal
            Copyright (C) 2008, Rosetta Contributors and Canonical Ltd.
 License: GPL-3
 
+Files: debian/*
+Copyright: YOKOTA Hiroshi, Martin Pitt, Nicholas D Steeves
+License: GPL-3
+
+Files: debian/tests/data/wasteland-woff-obf.epub
+Copyright: EPUB 3 Community Group
+License: CC-BY-SA-3.0
+Comment: input file was taken from EPUB 3 Samples
+  https://github.com/IDPF/epub3-samples/releases/download/20230704/wasteland-woff-obf.epub
+  https://idpf.github.io/epub3-samples/30/samples.html
+  https://github.com/IDPF/epub3-samples/
+
 
 License: Apache-2.0
  The full text of the GPL is distributed as in
@@ -118,6 +130,10 @@ License: LGPL-2.1+
  The full text of the LGPL is distributed as in
  /usr/share/common-licenses/LGPL-2.1 on Debian systems.
 
+License: CC-BY-SA-3.0
+ The full text of the CC-BY-SA-3.0 is distributed as in
+ /usr/share/common-licenses/CC-BY-SA-3.0 on Debian systems.
+
 License: BSD-3-Clause
  All rights reserved.
  .
diff --git a/debian/gbp.conf b/debian/gbp.conf
index 6b7cdfe43c..4cc8345f8e 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,5 +1,6 @@
 [DEFAULT]
 pristine-tar = True
+debian-branch = debian/trixie
 
 [dch]
 full = True
diff --git a/debian/patches/series b/debian/patches/series
index da92a1e411..5ac63c1d23 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -81,14 +81,18 @@ pykakasi/0080-Revert-Fix-a-regression-that-caused-incorrect-Englis.patch
 0081-Revert-Update-7zip-wrapper-code-for-removal-of-read-.patch
 upstream/0082-Fix-CVE-2025-64486.patch
 upstream/0083-CVE-2026-25635-CHM-Input-Ignore-internal-files-that-.patch
-upstream/0084-CVE-2026-25636-DRYer.patch
-upstream/0085-CVE-2026-25731-ZIP-Output-Change-the-template-engine.patch
-upstream/0086-CVE-2026-26064-ODT-Input-Ensure-images-are-extracted.patch
-upstream/0087-CVE-2026-26065-PDB-Input-Ensure-extracted-images-are.patch
-upstream/0088-CVE-2026-27810-Content-server-Sanitize-content-dispo.patch
-upstream/0089-CVE-2026-27824-Content-server-When-banning-IPs-for-r.patch
-upstream/0090-Fix-security-vulnerabilities-and-code-quality-issues.patch
-upstream/0091-CVE-2026-30853-RB-Input-Ensure-files-are-extracted-w.patch
-upstream/0092-CVE-2026-33205-1-2-E-book-viewer-prevent-reading-bac.patch
-upstream/0093-CVE-2026-33205-2-2-E-book-viewer-Disallow-background.patch
-upstream/0094-CVE-2026-33206-TXT-Input-Ensure-resource-files-are-r.patch
+upstream/0084-CVE-2026-25636-1-2-EPUB-Input-Ensure-font-obfuscatio.patch
+upstream/0085-CVE-2026-25636-2-2-DRYer.patch
+upstream/0086-CVE-2026-25731-ZIP-Output-Change-the-template-engine.patch
+upstream/0087-CVE-2026-26064-ODT-Input-Ensure-images-are-extracted.patch
+upstream/0088-CVE-2026-26065-PDB-Input-Ensure-extracted-images-are.patch
+upstream/0089-CVE-2026-27810-Content-server-Sanitize-content-dispo.patch
+upstream/0090-CVE-2026-27824-Content-server-When-banning-IPs-for-r.patch
+upstream/0091-Fix-security-vulnerabilities-and-code-quality-issues.patch
+upstream/0092-CVE-2026-30853-RB-Input-Ensure-files-are-extracted-w.patch
+upstream/0093-CVE-2026-33205-1-2-E-book-viewer-prevent-reading-bac.patch
+upstream/0094-CVE-2026-33205-2-2-E-book-viewer-Disallow-background.patch
+upstream/0095-CVE-2026-33206-TXT-Input-Ensure-resource-files-are-r.patch
+upstream/0096-CVE-2026-53511-1-3-Env-var-to-disable-python-templat.patch
+upstream/0097-CVE-2026-53511-2-3.patch
+upstream/0098-CVE-2026-53511-3-3-Disallow-Python-templates-when-re.patch
diff --git a/debian/patches/upstream/0084-CVE-2026-25636-1-2-EPUB-Input-Ensure-font-obfuscatio.patch b/debian/patches/upstream/0084-CVE-2026-25636-1-2-EPUB-Input-Ensure-font-obfuscatio.patch
new file mode 100644
index 0000000000..9f906d768a
--- /dev/null
+++ b/debian/patches/upstream/0084-CVE-2026-25636-1-2-EPUB-Input-Ensure-font-obfuscatio.patch
@@ -0,0 +1,63 @@
+From: Kovid Goyal <[email protected]>
+Date: Mon, 2 Feb 2026 09:51:18 +0530
+Subject: CVE-2026-25636 (1/2): EPUB Input: Ensure font obfuscation processing
+ happens only on files from the EPUB
+
+Forwarded: not-needed
+Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-8r26-m7j5-hm29
+Origin: backport, https://github.com/kovidgoyal/calibre/commit/267bfd34020a4f297c2de9cc0cde50ebe5d024d4
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143484
+
+Signed-off-by: YOKOTA Hiroshi <[email protected]>
+---
+ src/calibre/ebooks/conversion/plugins/epub_input.py |  4 +++-
+ src/calibre/utils/filenames.py                      | 14 ++++++++++++++
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/src/calibre/ebooks/conversion/plugins/epub_input.py b/src/calibre/ebooks/conversion/plugins/epub_input.py
+index 2505169..f62fed1 100644
+--- a/src/calibre/ebooks/conversion/plugins/epub_input.py
++++ b/src/calibre/ebooks/conversion/plugins/epub_input.py
+@@ -44,6 +44,8 @@ class EPUBInput(InputFormatPlugin):
+         import uuid
+ 
+         from lxml import etree
++
++        from calibre.utils.filenames import is_existing_subpath
+         idpf_key = opf.raw_unique_identifier
+         if idpf_key:
+             idpf_key = re.sub(r'[ \t\r\n]', '', idpf_key)
+@@ -74,7 +76,7 @@ class EPUBInput(InputFormatPlugin):
+                 uri = cr.get('URI')
+                 path = os.path.abspath(os.path.join(os.path.dirname(encfile), '..', *uri.split('/')))
+                 tkey = (key if algorithm == ADOBE_OBFUSCATION else idpf_key)
+-                if (tkey and os.path.exists(path)):
++                if (tkey and is_existing_subpath(path, os.getcwd())):
+                     self._encrypted_font_uris.append(uri)
+                     decrypt_font(tkey, path, algorithm)
+             return True
+diff --git a/src/calibre/utils/filenames.py b/src/calibre/utils/filenames.py
+index 5182f75..1cb07f4 100644
+--- a/src/calibre/utils/filenames.py
++++ b/src/calibre/utils/filenames.py
+@@ -644,6 +644,20 @@ def copytree_using_links(path, dest, dest_is_parent=True, filecopyfunc=copyfile)
+                 filecopyfunc(src, df)
+ 
+ 
++def is_existing_subpath(child: str, parent: str) -> bool:
++    ' Check if child is under parent. If either child or parent dont exist, returns False. '
++    try:
++        parent = os.path.realpath(parent, strict=True)  # resolve symlinks
++        child = os.path.realpath(child, strict=True)
++    except OSError:
++        return False
++    parent = os.path.abspath(parent)
++    child = os.path.abspath(child)
++    if not parent.endswith(os.sep):
++        parent += os.sep
++    return child.startswith(parent)
++
++
+ rmtree = shutil.rmtree
+ 
+ 
diff --git a/debian/patches/upstream/0084-CVE-2026-25636-DRYer.patch b/debian/patches/upstream/0085-CVE-2026-25636-2-2-DRYer.patch
similarity index 89%
rename from debian/patches/upstream/0084-CVE-2026-25636-DRYer.patch
rename to debian/patches/upstream/0085-CVE-2026-25636-2-2-DRYer.patch
index c4d08af444..e057ec930c 100644
--- a/debian/patches/upstream/0084-CVE-2026-25636-DRYer.patch
+++ b/debian/patches/upstream/0085-CVE-2026-25636-2-2-DRYer.patch
@@ -1,6 +1,6 @@
 From: Kovid Goyal <[email protected]>
 Date: Mon, 2 Feb 2026 11:25:09 +0530
-Subject: CVE-2026-25636: DRYer
+Subject: CVE-2026-25636 (2/2): DRYer
 
 Forwarded: not-needed
 Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-8r26-m7j5-hm29
@@ -12,10 +12,10 @@ Signed-off-by: YOKOTA Hiroshi <[email protected]>
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/calibre/ebooks/conversion/plugins/epub_input.py b/src/calibre/ebooks/conversion/plugins/epub_input.py
-index 2505169..edfebee 100644
+index f62fed1..6b81949 100644
 --- a/src/calibre/ebooks/conversion/plugins/epub_input.py
 +++ b/src/calibre/ebooks/conversion/plugins/epub_input.py
-@@ -66,15 +66,17 @@ class EPUBInput(InputFormatPlugin):
+@@ -68,15 +68,17 @@ class EPUBInput(InputFormatPlugin):
  
          try:
              root = etree.parse(encfile)
@@ -30,7 +30,7 @@ index 2505169..edfebee 100644
 -                path = os.path.abspath(os.path.join(os.path.dirname(encfile), '..', *uri.split('/')))
 +                path = os.path.abspath(os.path.join(base, '..', *uri.split('/')))
                  tkey = (key if algorithm == ADOBE_OBFUSCATION else idpf_key)
--                if (tkey and os.path.exists(path)):
+-                if (tkey and is_existing_subpath(path, os.getcwd())):
 +                if (tkey and is_existing_subpath(path, container_base)):
                      self._encrypted_font_uris.append(uri)
                      decrypt_font(tkey, path, algorithm)
diff --git a/debian/patches/upstream/0085-CVE-2026-25731-ZIP-Output-Change-the-template-engine.patch b/debian/patches/upstream/0086-CVE-2026-25731-ZIP-Output-Change-the-template-engine.patch
similarity index 100%
rename from debian/patches/upstream/0085-CVE-2026-25731-ZIP-Output-Change-the-template-engine.patch
rename to debian/patches/upstream/0086-CVE-2026-25731-ZIP-Output-Change-the-template-engine.patch
diff --git a/debian/patches/upstream/0086-CVE-2026-26064-ODT-Input-Ensure-images-are-extracted.patch b/debian/patches/upstream/0087-CVE-2026-26064-ODT-Input-Ensure-images-are-extracted.patch
similarity index 100%
rename from debian/patches/upstream/0086-CVE-2026-26064-ODT-Input-Ensure-images-are-extracted.patch
rename to debian/patches/upstream/0087-CVE-2026-26064-ODT-Input-Ensure-images-are-extracted.patch
diff --git a/debian/patches/upstream/0087-CVE-2026-26065-PDB-Input-Ensure-extracted-images-are.patch b/debian/patches/upstream/0088-CVE-2026-26065-PDB-Input-Ensure-extracted-images-are.patch
similarity index 100%
rename from debian/patches/upstream/0087-CVE-2026-26065-PDB-Input-Ensure-extracted-images-are.patch
rename to debian/patches/upstream/0088-CVE-2026-26065-PDB-Input-Ensure-extracted-images-are.patch
diff --git a/debian/patches/upstream/0088-CVE-2026-27810-Content-server-Sanitize-content-dispo.patch b/debian/patches/upstream/0089-CVE-2026-27810-Content-server-Sanitize-content-dispo.patch
similarity index 100%
rename from debian/patches/upstream/0088-CVE-2026-27810-Content-server-Sanitize-content-dispo.patch
rename to debian/patches/upstream/0089-CVE-2026-27810-Content-server-Sanitize-content-dispo.patch
diff --git a/debian/patches/upstream/0089-CVE-2026-27824-Content-server-When-banning-IPs-for-r.patch b/debian/patches/upstream/0090-CVE-2026-27824-Content-server-When-banning-IPs-for-r.patch
similarity index 100%
rename from debian/patches/upstream/0089-CVE-2026-27824-Content-server-When-banning-IPs-for-r.patch
rename to debian/patches/upstream/0090-CVE-2026-27824-Content-server-When-banning-IPs-for-r.patch
diff --git a/debian/patches/upstream/0090-Fix-security-vulnerabilities-and-code-quality-issues.patch b/debian/patches/upstream/0091-Fix-security-vulnerabilities-and-code-quality-issues.patch
similarity index 100%
rename from debian/patches/upstream/0090-Fix-security-vulnerabilities-and-code-quality-issues.patch
rename to debian/patches/upstream/0091-Fix-security-vulnerabilities-and-code-quality-issues.patch
diff --git a/debian/patches/upstream/0091-CVE-2026-30853-RB-Input-Ensure-files-are-extracted-w.patch b/debian/patches/upstream/0092-CVE-2026-30853-RB-Input-Ensure-files-are-extracted-w.patch
similarity index 100%
rename from debian/patches/upstream/0091-CVE-2026-30853-RB-Input-Ensure-files-are-extracted-w.patch
rename to debian/patches/upstream/0092-CVE-2026-30853-RB-Input-Ensure-files-are-extracted-w.patch
diff --git a/debian/patches/upstream/0092-CVE-2026-33205-1-2-E-book-viewer-prevent-reading-bac.patch b/debian/patches/upstream/0093-CVE-2026-33205-1-2-E-book-viewer-prevent-reading-bac.patch
similarity index 100%
rename from debian/patches/upstream/0092-CVE-2026-33205-1-2-E-book-viewer-prevent-reading-bac.patch
rename to debian/patches/upstream/0093-CVE-2026-33205-1-2-E-book-viewer-prevent-reading-bac.patch
diff --git a/debian/patches/upstream/0093-CVE-2026-33205-2-2-E-book-viewer-Disallow-background.patch b/debian/patches/upstream/0094-CVE-2026-33205-2-2-E-book-viewer-Disallow-background.patch
similarity index 100%
rename from debian/patches/upstream/0093-CVE-2026-33205-2-2-E-book-viewer-Disallow-background.patch
rename to debian/patches/upstream/0094-CVE-2026-33205-2-2-E-book-viewer-Disallow-background.patch
diff --git a/debian/patches/upstream/0094-CVE-2026-33206-TXT-Input-Ensure-resource-files-are-r.patch b/debian/patches/upstream/0095-CVE-2026-33206-TXT-Input-Ensure-resource-files-are-r.patch
similarity index 100%
rename from debian/patches/upstream/0094-CVE-2026-33206-TXT-Input-Ensure-resource-files-are-r.patch
rename to debian/patches/upstream/0095-CVE-2026-33206-TXT-Input-Ensure-resource-files-are-r.patch
diff --git a/debian/patches/upstream/0096-CVE-2026-53511-1-3-Env-var-to-disable-python-templat.patch b/debian/patches/upstream/0096-CVE-2026-53511-1-3-Env-var-to-disable-python-templat.patch
new file mode 100644
index 0000000000..e3e6942249
--- /dev/null
+++ b/debian/patches/upstream/0096-CVE-2026-53511-1-3-Env-var-to-disable-python-templat.patch
@@ -0,0 +1,68 @@
+From: Kovid Goyal <[email protected]>
+Date: Fri, 13 Feb 2026 15:52:21 +0530
+Subject: CVE-2026-53511 (1/3): Env var to disable python templates
+
+Forwarded: not-needed
+Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47
+Origin: backport, https://github.com/kovidgoyal/calibre/commit/833d3c96d8d39f5715b04fde06cb13163b0b2f66
+
+Signed-off-by: YOKOTA Hiroshi <[email protected]>
+---
+ manual/customize.rst            | 1 +
+ src/calibre/db/tests/reading.py | 7 +++++++
+ src/calibre/utils/formatter.py  | 5 +++++
+ 3 files changed, 13 insertions(+)
+
+diff --git a/manual/customize.rst b/manual/customize.rst
+index 61e7b40..a67ff2d 100644
+--- a/manual/customize.rst
++++ b/manual/customize.rst
+@@ -39,6 +39,7 @@ Environment variables
+     * ``CALIBRE_TEMP_DIR`` - sets the temporary folder used by calibre
+     * ``CALIBRE_CACHE_DIRECTORY`` - sets the folder calibre uses to cache persistent data between sessions
+     * ``CALIBRE_OVERRIDE_DATABASE_PATH`` - allows you to specify the full path to metadata.db. Using this variable you can have metadata.db be in a location other than the library folder. Useful if your library folder is on a networked drive that does not support file locking.
++    * ``CALIBRE_ALLOW_PYTHON_TEMPLATES`` - if set to a value other than ``1`` disables the use of Python based templates in calibre.
+     * ``CALIBRE_DEVELOP_FROM`` - used to run from a calibre development environment. See :ref:`develop`.
+     * ``CALIBRE_OVERRIDE_LANG`` - used to force the language used by the interface (ISO 639 language code)
+     * ``CALIBRE_TEST_TRANSLATION`` - used to test a translation .po file (should be the path to the .po file)
+diff --git a/src/calibre/db/tests/reading.py b/src/calibre/db/tests/reading.py
+index 42783b6..125d265 100644
+--- a/src/calibre/db/tests/reading.py
++++ b/src/calibre/db/tests/reading.py
+@@ -830,6 +830,13 @@ class ReadingTest(BaseTest):
+         v = formatter.safe_format('program: book_count("series:true", 0)', {}, 'TEMPLATE ERROR', mi)
+         self.assertEqual(v, '2')
+ 
++        # test python templates
++        v = formatter.safe_format('python:\ndef evaluate(book, ctx): return "x"', {}, 'TEMPLATE ERROR', mi)
++        if os.environ.get('CALIBRE_ALLOW_PYTHON_TEMPLATES', '') == '1':
++            self.assertEqual(v, 'x')
++        else:
++            self.assertTrue(v.startswith('TEMPLATE ERROR'))
++
+         # test counting books when none match the search
+         v = formatter.safe_format('program: book_count("series:afafaf", 0)', {}, 'TEMPLATE ERROR', mi)
+         self.assertEqual(v, '0')
+diff --git a/src/calibre/utils/formatter.py b/src/calibre/utils/formatter.py
+index 5c9985d..066c84d 100644
+--- a/src/calibre/utils/formatter.py
++++ b/src/calibre/utils/formatter.py
+@@ -8,6 +8,7 @@ __copyright__ = '2010, Kovid Goyal <[email protected]>'
+ __docformat__ = 'restructuredtext en'
+ 
+ import numbers
++import os
+ import re
+ import string
+ import traceback
+@@ -1788,6 +1789,10 @@ class TemplateFormatter(string.Formatter):
+         return rslt
+ 
+     def compile_python_template(self, template):
++        if os.environ.get('CALIBRE_ALLOW_PYTHON_TEMPLATES', '1') != '1':
++            raise ValueError(_('Python templates disallowed by the {} environment variable'
++                               ).format('CALIBRE_ALLOW_PYTHON_TEMPLATES'))
++
+         def replace_func(mo):
+             return mo.group().replace('\t', '    ')
+ 
diff --git a/debian/patches/upstream/0097-CVE-2026-53511-2-3.patch b/debian/patches/upstream/0097-CVE-2026-53511-2-3.patch
new file mode 100644
index 0000000000..3097260e31
--- /dev/null
+++ b/debian/patches/upstream/0097-CVE-2026-53511-2-3.patch
@@ -0,0 +1,26 @@
+From: Kovid Goyal <[email protected]>
+Date: Fri, 13 Feb 2026 16:02:52 +0530
+Subject: CVE-2026-53511 (2/3): ...
+
+Forwarded: not-needed
+Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47
+Origin: backport, https://github.com/kovidgoyal/calibre/commit/eb43668e769e0595c1412e76173d44dda105fcb1
+
+Signed-off-by: YOKOTA Hiroshi <[email protected]>
+---
+ src/calibre/db/tests/reading.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/calibre/db/tests/reading.py b/src/calibre/db/tests/reading.py
+index 125d265..3ce14bd 100644
+--- a/src/calibre/db/tests/reading.py
++++ b/src/calibre/db/tests/reading.py
+@@ -832,7 +832,7 @@ class ReadingTest(BaseTest):
+ 
+         # test python templates
+         v = formatter.safe_format('python:\ndef evaluate(book, ctx): return "x"', {}, 'TEMPLATE ERROR', mi)
+-        if os.environ.get('CALIBRE_ALLOW_PYTHON_TEMPLATES', '') == '1':
++        if os.environ.get('CALIBRE_ALLOW_PYTHON_TEMPLATES', '1') == '1':
+             self.assertEqual(v, 'x')
+         else:
+             self.assertTrue(v.startswith('TEMPLATE ERROR'))
diff --git a/debian/patches/upstream/0098-CVE-2026-53511-3-3-Disallow-Python-templates-when-re.patch b/debian/patches/upstream/0098-CVE-2026-53511-3-3-Disallow-Python-templates-when-re.patch
new file mode 100644
index 0000000000..4605fdf512
--- /dev/null
+++ b/debian/patches/upstream/0098-CVE-2026-53511-3-3-Disallow-Python-templates-when-re.patch
@@ -0,0 +1,68 @@
+From: Kovid Goyal <[email protected]>
+Date: Sun, 31 May 2026 13:33:08 +0530
+Subject: CVE-2026-53511 (3/3): Disallow Python templates when reading book
+ metadata
+
+Forwarded: not-needed
+Bug: https://github.com/kovidgoyal/calibre/security/advisories/GHSA-2j4m-2q7x-2c47
+Origin: backport, https://github.com/kovidgoyal/calibre/commit/712f4e1ff5c1e798c335bef3bacc4efdee052e9c
+
+Signed-off-by: YOKOTA Hiroshi <[email protected]>
+---
+ src/calibre/ebooks/metadata/book/base.py |  9 ++++++++-
+ src/calibre/utils/formatter.py           | 10 +++++++---
+ 2 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/src/calibre/ebooks/metadata/book/base.py b/src/calibre/ebooks/metadata/book/base.py
+index 91ad613..7133861 100644
+--- a/src/calibre/ebooks/metadata/book/base.py
++++ b/src/calibre/ebooks/metadata/book/base.py
+@@ -150,12 +150,19 @@ class Metadata:
+             val = d['#value#']
+             if val is None and d['datatype'] == 'composite':
+                 d['#value#'] = 'RECURSIVE_COMPOSITE FIELD (Metadata) ' + field
+-                val = d['#value#'] = self.formatter.safe_format(
++                # Python templates must be disallowed as they can come from
++                # untrusted sources (book metadata)
++                orig = self.formatter.allow_python_templates
++                self.formatter.allow_python_templates = False
++                try:
++                    val = d['#value#'] = self.formatter.safe_format(
+                                             d['display']['composite_template'],
+                                             self,
+                                             _('TEMPLATE ERROR'),
+                                             self, column_name=field,
+                                             template_cache=self.template_cache).strip()
++                finally:
++                    self.formatter.allow_python_templates = orig
+             return val
+         if field.startswith('#') and field.endswith('_index'):
+             try:
+diff --git a/src/calibre/utils/formatter.py b/src/calibre/utils/formatter.py
+index 066c84d..dea2023 100644
+--- a/src/calibre/utils/formatter.py
++++ b/src/calibre/utils/formatter.py
+@@ -1653,6 +1653,7 @@ class TemplateFormatter(string.Formatter):
+         self._caller = None
+         self.python_context_object = None
+         self.database = None
++        self.allow_python_templates = None
+ 
+     def _do_format(self, val, fmt):
+         if not fmt or not val:
+@@ -1789,9 +1790,12 @@ class TemplateFormatter(string.Formatter):
+         return rslt
+ 
+     def compile_python_template(self, template):
+-        if os.environ.get('CALIBRE_ALLOW_PYTHON_TEMPLATES', '1') != '1':
+-            raise ValueError(_('Python templates disallowed by the {} environment variable'
+-                               ).format('CALIBRE_ALLOW_PYTHON_TEMPLATES'))
++        if self.allow_python_templates is None:
++            if os.environ.get('CALIBRE_ALLOW_PYTHON_TEMPLATES', '1') != '1':
++                raise ValueError(_('Python templates disallowed by the {} environment variable'
++                                ).format('CALIBRE_ALLOW_PYTHON_TEMPLATES'))
++        elif not self.allow_python_templates:
++            raise ValueError(_('Python templates disallowed by policy for this formatter'))
+ 
+         def replace_func(mo):
+             return mo.group().replace('\t', '    ')
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
new file mode 100644
index 0000000000..f7b6992955
--- /dev/null
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,6 @@
+---
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
+
+variables:
+  SALSA_CI_DISABLE_USCAN: 1
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
new file mode 100644
index 0000000000..389477d0db
--- /dev/null
+++ b/debian/source/include-binaries
@@ -0,0 +1 @@
+debian/tests/data/wasteland-woff-obf.epub
diff --git a/debian/tests/control b/debian/tests/control
index ccab8e7571..4d987ab0fe 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -24,3 +24,7 @@ Restrictions: superficial
 Tests: convert-md-epub.sh
 Architecture: amd64 arm64 armhf i386
 Depends: @, epubcheck
+
+# Obfuscated fonts conversion test (Debian bug 1143484)
+Tests: convert-obfuscated-fonts.sh
+Architecture: amd64 arm64 armhf i386
diff --git a/debian/tests/convert-obfuscated-fonts.sh b/debian/tests/convert-obfuscated-fonts.sh
new file mode 100755
index 0000000000..6791bbc5cc
--- /dev/null
+++ b/debian/tests/convert-obfuscated-fonts.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -eu
+
+# Qt burfs some warnings to stderr when in Gnome-wayland session
+unset XDG_SESSION_TYPE
+
+# Qt outputs some warnings to stderr if XDG_RUNTIME_DIR is not set
+export XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR:=/tmp/runtime-debci}
+echo "#### XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR}"
+
+# input file was taken from EPUB 3 Samples
+#   https://github.com/IDPF/epub3-samples/releases/download/20230704/wasteland-woff-obf.epub
+#   https://idpf.github.io/epub3-samples/30/samples.html
+#   https://github.com/IDPF/epub3-samples/
+input_file=debian/tests/data/wasteland-woff-obf.epub
+output_file=${AUTOPKGTEST_ARTIFACTS}/wasteland-woff-obf.txt
+
+ebook-convert ${input_file} ${output_file}
diff --git a/debian/tests/data/wasteland-woff-obf.epub b/debian/tests/data/wasteland-woff-obf.epub
new file mode 100644
index 0000000000..2debdff616
Binary files /dev/null and b/debian/tests/data/wasteland-woff-obf.epub differ