diff --git a/.gitignore b/.gitignore
index cb85d6a..80d1d5e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -183,3 +183,4 @@
 /389-ds-base-1.4.2.1.tar.bz2
 /389-ds-base-1.4.2.2.tar.bz2
 /389-ds-base-1.4.2.3.tar.bz2
+/389-ds-base-1.4.2.4.tar.bz2
diff --git a/389-ds-base.spec b/389-ds-base.spec
index 609315b..023c846 100644
--- a/389-ds-base.spec
+++ b/389-ds-base.spec
@@ -17,7 +17,7 @@ ExcludeArch: i686
 
 %global use_asan 0
 %global use_rust 0
-%global use_perl 1
+%global use_legacy 1
 %global bundle_jemalloc 1
 %if %{use_asan}
 %global bundle_jemalloc 0
@@ -44,7 +44,7 @@ ExcludeArch: i686
 
 Summary:          389 Directory Server (base)
 Name:             389-ds-base
-Version:          1.4.2.3
+Version:          1.4.2.4
 Release:          %{?relprefix}1%{?prerel}%{?dist}
 License:          GPLv3+
 URL:              https://www.port389.org
@@ -113,6 +113,7 @@ BuildRequires:    python%{python3_pkgversion}-argcomplete
 BuildRequires:    python%{python3_pkgversion}-argparse-manpage
 BuildRequires:    python%{python3_pkgversion}-libselinux
 BuildRequires:    python%{python3_pkgversion}-policycoreutils
+BuildRequires:    python%{python3_pkgversion}-packaging
 
 # For cockpit
 BuildRequires:    rsync
@@ -205,11 +206,11 @@ Core libraries for the 389 Directory Server base package.  These libraries
 are used by the main package and the -devel package.  This allows the -devel
 package to be installed with just the -libs package and without the main package.
 
+%if %{use_legacy}
 %package          legacy-tools
 Summary:          Legacy utilities for 389 Directory Server (%{variant})
 Obsoletes:        %{name} <= 1.4.0.9
 Requires:         389-ds-base-libs = %{version}-%{release}
-%if %{use_perl}
 # for setup-ds.pl to support ipv6
 %if %{use_Socket6}
 Requires:         perl-Socket6
@@ -224,13 +225,12 @@ Requires:         bind-utils
 %global __provides_exclude_from %{_libdir}/%{pkgname}/perl
 %global __requires_exclude perl\\((DSCreate|DSMigration|DSUpdate|DSUtil|Dialog|DialogManager|FileConn|Inf|Migration|Resource|Setup|SetupLog)
 %{?perl_default_filter}
-%endif
-# End use perl
 
 %description      legacy-tools
 Legacy (and deprecated) utilities for 389 Directory Server. This includes
 the old account management and task scripts. These are deprecated in favour of
 the dscreate, dsctl, dsconf and dsidm tools.
+%endif  # use_legacy
 
 %package          devel
 Summary:          Development libraries for 389 Directory Server
@@ -313,8 +313,10 @@ ASAN_FLAGS="--enable-asan --enable-debug"
 RUST_FLAGS="--enable-rust"
 %endif
 
-%if !%{use_perl}
-PERL_FLAGS="--disable-perl"
+%if %{use_legacy}
+LEGACY_FLAGS="--enable-legacy --enable-perl"
+%else
+LEGACY_FLAGS="--disable-legacy --disable-perl"
 %endif
 
 %if %{use_clang}
@@ -345,7 +347,7 @@ autoreconf -fiv
            --with-systemdsystemconfdir=%{_sysconfdir}/systemd/system \
            --with-systemdgroupname=%{groupname}  \
            --libexecdir=%{_libexecdir}/%{pkgname} \
-           $NSSARGS $ASAN_FLAGS $RUST_FLAGS $PERL_FLAGS $CLANG_FLAGS \
+           $NSSARGS $ASAN_FLAGS $RUST_FLAGS $CLANG_FLAGS $LEGACY_FLAGS \
            --enable-cmocka \
            --enable-perl
 
@@ -399,7 +401,7 @@ mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/systemd/system/%{groupname}.wants
 find %{buildroot} -type f -name "*.la" -delete
 find %{buildroot} -type f -name "*.a" -delete
 
-%if %{use_perl}
+%if %{use_legacy}
 # make sure perl scripts have a proper shebang
 sed -i -e 's|#{{PERL-EXEC}}|#!/usr/bin/perl|' $RPM_BUILD_ROOT%{_datadir}/%{pkgname}/script-templates/template-*.pl
 %endif
@@ -467,9 +469,9 @@ fi
 %postun snmp
 %systemd_postun_with_restart %{pkgname}-snmp.service
 
+%if %{use_legacy}
 %post legacy-tools
 
-%if %{use_perl}
 # START UPGRADE SCRIPT
 
 if [ -n "$DEBUGPOSTTRANS" ] ; then
@@ -528,7 +530,7 @@ for inst in $instances ; do
     /bin/systemctl start $inst >> $output 2>&1 || :
 done
 #END UPGRADE
-%endif
+%endif # use_legacy
 
 exit 0
 
@@ -548,9 +550,6 @@ exit 0
 %config(noreplace)%{_sysconfdir}/%{pkgname}/config/slapd-collations.conf
 %config(noreplace)%{_sysconfdir}/%{pkgname}/config/certmap.conf
 %{_datadir}/%{pkgname}
-%exclude %{_datadir}/%{pkgname}/script-templates
-%exclude %{_datadir}/%{pkgname}/updates
-%exclude %{_datadir}/%{pkgname}/properties/*.res
 %{_datadir}/gdb/auto-load/*
 %{_unitdir}
 %{_bindir}/dbscan
@@ -561,8 +560,6 @@ exit 0
 %{_mandir}/man1/ds-logpipe.py.1.gz
 %{_bindir}/ldclt
 %{_mandir}/man1/ldclt.1.gz
-%{_sbindir}/ldif2ldap
-%{_mandir}/man8/ldif2ldap.8.gz
 %{_bindir}/logconv.pl
 %{_mandir}/man1/logconv.pl.1.gz
 %{_bindir}/pwdhash
@@ -573,22 +570,6 @@ exit 0
 %{_sbindir}/ns-slapd
 %{_mandir}/man8/ns-slapd.8.gz
 %{_libexecdir}/%{pkgname}/ds_systemd_ask_password_acl
-%{_sbindir}/bak2db
-%{_mandir}/man8/bak2db.8.gz
-%{_sbindir}/db2bak
-%{_mandir}/man8/db2bak.8.gz
-%{_sbindir}/db2index
-%{_mandir}/man8/db2index.8.gz
-%{_sbindir}/db2ldif
-%{_mandir}/man8/db2ldif.8.gz
-%{_sbindir}/dbverify
-%{_mandir}/man8/dbverify.8.gz
-%{_sbindir}/ldif2db
-%{_mandir}/man8/ldif2db.8.gz
-%{_sbindir}/upgradedb
-%{_mandir}/man8/upgradedb.8.gz
-%{_sbindir}/vlvindex
-%{_mandir}/man8/vlvindex.8.gz
 %{_mandir}/man5/99user.ldif.5.gz
 %{_mandir}/man5/certmap.conf.5.gz
 %{_mandir}/man5/slapd-collations.conf.5.gz
@@ -646,6 +627,7 @@ exit 0
 %{_libdir}/%{pkgname}/librsds.so
 %endif
 
+%if %{use_legacy}
 %files legacy-tools
 %doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel
 %{_bindir}/infadd
@@ -658,6 +640,39 @@ exit 0
 %{_mandir}/man1/mmldif.1.gz
 %{_bindir}/rsearch
 %{_mandir}/man1/rsearch.1.gz
+%{_libexecdir}/%{pkgname}/ds_selinux_enabled
+%{_libexecdir}/%{pkgname}/ds_selinux_port_query
+%config(noreplace)%{_sysconfdir}/%{pkgname}/config/template-initconfig
+%{_mandir}/man5/template-initconfig.5.gz
+%{_datadir}/%{pkgname}/properties/*.res
+%{_datadir}/%{pkgname}/script-templates
+%{_datadir}/%{pkgname}/updates
+%{_sbindir}/ldif2ldap
+%{_mandir}/man8/ldif2ldap.8.gz
+%{_sbindir}/bak2db
+%{_mandir}/man8/bak2db.8.gz
+%{_sbindir}/db2bak
+%{_mandir}/man8/db2bak.8.gz
+%{_sbindir}/db2index
+%{_mandir}/man8/db2index.8.gz
+%{_sbindir}/db2ldif
+%{_mandir}/man8/db2ldif.8.gz
+%{_sbindir}/dbverify
+%{_mandir}/man8/dbverify.8.gz
+%{_sbindir}/ldif2db
+%{_mandir}/man8/ldif2db.8.gz
+%{_sbindir}/restart-dirsrv
+%{_mandir}/man8/restart-dirsrv.8.gz
+%{_sbindir}/start-dirsrv
+%{_mandir}/man8/start-dirsrv.8.gz
+%{_sbindir}/status-dirsrv
+%{_mandir}/man8/status-dirsrv.8.gz
+%{_sbindir}/stop-dirsrv
+%{_mandir}/man8/stop-dirsrv.8.gz
+%{_sbindir}/upgradedb
+%{_mandir}/man8/upgradedb.8.gz
+%{_sbindir}/vlvindex
+%{_mandir}/man8/vlvindex.8.gz
 %{_sbindir}/monitor
 %{_mandir}/man8/monitor.8.gz
 %{_sbindir}/dbmon.sh
@@ -672,22 +687,6 @@ exit 0
 %{_mandir}/man8/suffix2instance.8.gz
 %{_sbindir}/upgradednformat
 %{_mandir}/man8/upgradednformat.8.gz
-%{_libexecdir}/%{pkgname}/ds_selinux_enabled
-%{_libexecdir}/%{pkgname}/ds_selinux_port_query
-%{_sbindir}/restart-dirsrv
-%{_mandir}/man8/restart-dirsrv.8.gz
-%{_sbindir}/start-dirsrv
-%{_mandir}/man8/start-dirsrv.8.gz
-%{_sbindir}/status-dirsrv
-%{_mandir}/man8/status-dirsrv.8.gz
-%{_sbindir}/stop-dirsrv
-%{_mandir}/man8/stop-dirsrv.8.gz
-%if %{use_perl}
-%config(noreplace)%{_sysconfdir}/%{pkgname}/config/template-initconfig
-%{_mandir}/man5/template-initconfig.5.gz
-%{_datadir}/%{pkgname}/properties/*.res
-%{_datadir}/%{pkgname}/script-templates
-%{_datadir}/%{pkgname}/updates
 %{_mandir}/man1/dbgen.pl.1.gz
 %{_bindir}/repl-monitor
 %{_mandir}/man1/repl-monitor.1.gz
@@ -737,7 +736,7 @@ exit 0
 %{_sbindir}/verify-db.pl
 %{_mandir}/man8/verify-db.pl.8.gz
 %{_libdir}/%{pkgname}/perl
-%endif
+%endif # use legacy
 
 %files snmp
 %doc LICENSE LICENSE.GPLv3+ LICENSE.openssl README.devel
@@ -764,6 +763,27 @@ exit 0
 %doc README.md
 
 %changelog
+* Thu Nov 14 2019 Mark Reynolds <mreynolds@redhat.com> - 1.4.2.4-1
+- Bump version to 1.4.2.4
+- Issue 50634 - Fix CLI error parsing for non-string values
+- Issue 50659 - AddressSanitizer: SEGV ... in bdb_pre_close
+- Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
+- Issue 50644 - fix regression with creating sample entries
+- Issue 50699 - Add Disk Monitor to CLI and UI
+- Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
+- Issue 50536 - After audit log file is rotated, DS version string is logged after each update
+- Issue 50712 - Version comparison doesn't work correctly on git builds
+- Issue 50706 - Missing lib389 dependency - packaging
+- Issue 49761 - Fix CI test suite issues
+- Issue 50683 - Makefile.am contains unused RPM-related targets
+- Issue 50696 - Fix various UI bugs
+- Issue 50641 - Update default aci to allows users to change their own password
+- Issue 50007, 50648 - improve x509 handling in dsctl
+- Issue 50689 - Failed db restore task does not report an error
+- Issue 50199 - Disable perl by default
+- Issue 50633 - Add cargo vendor support for offline builds
+- Issue 50499 - Fix npm audit issues
+
 * Sun Nov 03 2019 Mark Reynolds <mreynolds@redhat.com> - 1.4.2.3-1
 - Bump version to 1.4.2.3
 - Issue 50592 - Port Replication Tab to ReactJS
diff --git a/sources b/sources
index f0d172f..686c096 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (389-ds-base-1.4.2.3.tar.bz2) = c717c10d171c12e74194c1a19e0de3f609f07858b3c73fc5545eb65953a69e2bed6bca910ea7b8a6f711dbb86139f419534515ea03e7ea908ef89684d4162974
 SHA512 (jemalloc-5.2.0.tar.bz2) = e3be4d534770126caf10f2684aed9fe4ba1422dd47625fe50343cfb750f26eff869fcc7d1e30a96dd6c73f6614c4bbcd560fd24fc26b55ac731c43e60fd05234
+SHA512 (389-ds-base-1.4.2.4.tar.bz2) = b341bd55ef01b328b08de9dc88dca7dad7036064bda04469ebd650008ac4646395accacc32780bc7eab161a7fa5a8fa19f5511b827ab8a68b9c08dfc660969f1