1. Create the /etc/apt/keyrings folder.

2. Download the CSC keyring into it:
   ```
   wget -O /etc/apt/keyrings/csclub.gpg http://debian.csclub.uwaterloo.ca/csclub.gpg
   ```

3. Make sure that the CSC keyring is the only one in /etc/apt/trusted.gpg:
   ```
   gpg --no-options --show-keys /etc/apt/trusted.gpg
   ```

4. Delete /etc/apt/trusted.gpg and its backup file:
   ```
   rm -f /etc/apt/trusted.gpg /etc/apt/trusted.gpg~
   ```

5. Replace the old-style /etc/apt/sources.list and /etc/apt/sources.list.d/*.list
   files with the new Deb822 "sources" style (see /etc/apt/sources.list.d/*.sources
   on sorbitol; don't copy the one for the Dell repo).
   Add a helpful note in /etc/apt/sources.list for other syscom members:
   ```
   # See /etc/apt/sources.list.d/*.sources
   ```

6. apt update && apt dist-upgrade

7. apt autoremove --purge

8. During the upgrade, accept the new configuration files (choose the 'Y' option)
   for the following files:
   * /etc/fail2ban/fail2ban.conf
   * /etc/fail2ban/jail.conf
   * /etc/fail2ban/filter.d/sshd.conf
   Everything else should keep the old file.

9. Copy the following files from sorbitol:
   * /etc/fail2ban/fail2ban.local
   * /etc/fail2ban/jail.local
   * /etc/fail2ban/filter.d/sshd.local
   Then restart fail2ban.

10. If the 'ntp' package is installed, purge it and install systemd-timesyncd
    instead. Enable the systemd-timesyncd service and copy
    /etc/systemd/timesyncd.conf.d/csclub.conf from sorbitol. Start the service
    and make sure it's working.

11. Get rid of python2 if it's still installed:
    ```
    apt purge python2.7-minimal
    apt autoremove --purge
    ```