1 tails (6.2) unstable; urgency=medium
3 * Upgrade to Tor Browser 13.0.14 based on 115.10 (tails/tails!1489)
6 - Upgrade to Tor Browser 13.0.14 based on 115.10 (tails/tails#20330)
9 - Add reference to which issue the Tor Browser upgrade is about
10 - Upgrade Tor Browser to 13.0.14-build1 (refs: tails#20330)
12 * Test suite: Adapt AppArmor regex for Linux 6.2+ (tails/tails!1461)
15 - AppArmor regex in `common_steps.rb` soon to become obsolete (tails/tails#20277)
18 - Drop unnecessary -E from grep's arguments
19 - Test suite: Adapt AppArmor regex for Linux 6.2+
21 * fixing linenumbers of ublock autoupdate patch (tails/tails!1485)
24 - fixing linenumbers of ublock autoupdate patch
26 * Test suite: Enter passphrase via Dogtail (tails/tails!1466)
29 - Step 'I change the passphrase of the Persistent Storage back to the original'
30 is fragile (tails/tails#20296)
33 - Test suite: Enter passphrase via Dogtail
35 * Fix scenario "I can launch various apps via GNOME Activities Overview"
39 - Scenario "I can launch various apps via GNOME Activities Overview" is fragile
43 - Test suite: Make closing window more robust
44 - Test suite: Fix flaky step "I close the window via Alt+F4"
45 - Test suite: Fix check if app was closed
46 - Test suite: Fix some apps not closed in scenario
48 * Disable magic SysRq hacks (tails/tails!1491)
51 - Lock screen bypass via sysrq (tails/tails#20334)
54 - Disable magic SysRq hacks
56 * Resolve "Upgrade Linux to 6.1.85" (tails/tails!1490)
59 - Upgrade Linux to 6.1.85 (tails/tails#20316)
62 - upgrade to kernel 6.1.85
64 * Hardening: Unconditionally disable Speculative Store Bypass (tails/tails!1488)
67 - Improve protection against Spectre v4 with spec_store_bypass_disable=on
71 - Hardening: Unconditionally disable Speculative Store Bypass
73 * Resolve "Upgrade to tor 0.4.8.11" (tails/tails!1487)
76 - Upgrade to tor 0.4.8.11 (tails/tails#20339)
81 * GitLab CI: Fix Ruff CI Job (again) (tails/tails!1486)
84 - Ruff CI job still broken (tails/tails#20338)
87 - GitLab CI: Fix bin/test-utils/ruff failing when no files were changed
88 - GitLab CI: Fix Ruff CI Job (again)
90 * tails-unblock-network: Skip all known non-network-related subsystems
94 - No network when "udevadm settle" failed despite successful MAC spoofing
98 - tails-unblock-network: Terminate udevadm trigger after 120 seconds
99 - tails-unblock-network: Log the subsystem of all devices
100 - tails-unblock-network: Don't skip rfkill subsystem
101 - tails-unblock-network: Skip all known non-network-related subsystems
102 - tails-unblock-network: Print which devices were triggered
103 - tails-unblock-network: Call `udevadm trigger` just once
104 - tails-unblock-network: Only wait for triggered udev events
105 - tails-unblock-network: Only synchronize the relevant filesystem
106 - Simplify tails-unblock-network
107 - tails-unblock-network: Add shellcheck comment
109 * tps-frontend: Fix and improve error dialog (tails/tails!1480)
112 - tps-frontend: "Failed to set text" when formatting markup in error dialog
116 - tps-frontend: Extract open_documentation function
117 - tps-frontend: Hide unexpected error messages behind a "Details" expander
118 - tps-frontend: Show error message if documentation can't be opened
119 - tps-frontend: Escape error message for markup parser
121 * Upgrader: make "Upgrade later" the default option (tails/tails!1478)
124 - Make "Upgrade Later" the default option in the first popup of Tails Upgrader
129 - Upgrader: make "Upgrade later" the default option
130 - Upgrader: make dialog method support defaulting to cancel
132 * List all languages that have at least 25% of strings translated on the Welcome
133 Screen (tails/tails!1476)
136 - Design and implement new criterion for listing languages in the Welcome Screen
141 - Delete PO files with invalid translations
143 - Revert "generate-languages-list: workaround the fact we can't distinguish
144 reviewed translations from non-reviewed ones"
145 - import-translations: Import PO files that have at least 25% of strings
148 * auto/config: don't set TAILS_GIT_BASE_COMMIT when building from tags
152 - 6.1 not reproducible anymore (tails/tails#20311)
155 - Consistently use spaces for indentation
156 - auto/config: don't set TAILS_GIT_BASE_COMMIT when building from tags
158 * Disable the NVIDIA shader cache in browsers and add explanations for browser
159 environment variables (tails/tails!1472)
162 - Consider disabling Nvidia shader cache (tails/tails#20278)
165 - Point to the docs for more context.
166 - Disable NVIDIA shader cache in browsers (refs: tails/tails#20278)
167 - Document browser env vars we skip when syncing with start-browser
168 - Add explanations for browser env vars from upstream start-browser that we do
170 - Add explanations for browser environment variables
172 * Test suite: make pause() verbosely run pry in the caller's context
176 - Make pause() verbosely run pry in the caller's context (tails/tails#20305)
180 - Test suite: add breakpoint alias for pause
181 - Test suite: make pry quiet in the "I pause" step
182 - Test suite: make pause() verbosely run pry in the caller's context
184 * Test suite: support redefining steps during a run for development purposes
188 - Support redefining steps during a run for development purposes
193 - guard against unwanted redefinitions
194 - Test suite: move patch code after guard
196 - Test suite: make reload_code work in class contexts
197 - Add another test suite hacking example
198 - Test suite: simplify and fix issue with --guess
200 - Test suite: remove scenario and step definitions used for experiment
201 - Test suite: support redefining steps during a run for development purposes
202 - Test suite: improve experiment on hot-reloading step definitions
203 - Test suite: make --interactive-debuggin with for failures in @source-tagged
205 - Test suite: experiments on hot-reloading step definitions
207 * explain reproducibility test results are not blocking (tails/tails!1469)
210 - Release process: check early that there are enough manual testers
212 - Make notifying the TR a release process task for the RM instead of manual test
213 - moving some TR documentation from test to release process
214 - explain reproducibility test results are not blocking
216 * Improve wording (tails/tails!1468)
219 - Rename "Language & Region" as "Language & Formats" (tails/tails#20204)
224 * Test suite: make find() not wait for 10 seconds (tails/tails!1467)
227 - Suppress some output from the test suite screen matching machinery
229 - Drop Screen#find() (tails/tails#20303)
230 - wait_vanish does nothing (tails/tails#20302)
233 - Test suite: debug log duration of Screen#wait*
234 - Test suite: make wait() spam the debug log less
235 - Test suite: debug log consistently in wait/find_any/wait_any/wait_vanish
236 - Test suite: suppress some debug logging when find():ing images
237 - Test suite: wait a bit before clicking
238 - Test suite: fix wait_vanish()
239 - Test suite: implement wait_vanish() with find()
240 - Test suite: rename method to follow ruby ?-convention
241 - Test suite: make find() not wait for 10 seconds
243 * Test suite: Work around VM sometimes restarting after shutdown
247 - Step 'I shutdown Tails and wait for the computer to power off' sometimes fails
248 by rebooting instead (tails/tails#12132)
249 - Test suite: VM sometimes restarts after shutdown (tails/tails#20245)
252 - Test suite: Work around VM sometimes restarting after shutdown
254 * Test suite: Fix unexpected return (tails/tails!1458)
257 - Returning from step definition in `usb.rb` raises an `unexpected return
258 (LocalJumpError)` (tails/tails#20276)
261 - Test suite: Fix unexpected return
263 * Refactor code to get boot device (tails/tails!1454)
266 - Refactor code to get boot device
268 * GitLab CI: bin/test-utils/ruff also checks uncommitted/untracked changes
272 - GitLab CI: Use is-file-type script again in bin/test-utils/ruff
273 - GitLab CI: Improve bin/test-utils/ruff
275 * Detect I/O failures on Tails partition(s) (tails/tails!1427)
278 - Detect SquashFS and I/O errors while Tails is running (tails/tails#5856)
281 - execute_successfully will stop the test if it returns a exit code != 0.
282 - Revert "Fix systemd dependencies."
283 - Use better wording in hardware_failure.feature
284 - Use the device name not the device path.
286 - Use the get_boot_device from tailslib.
287 - We know the boot device from beginning, so no need to use update_pattern.
288 - rename IOErrorPattern class.
289 - remove partion detection errors.
290 - critical target error is triggered on the device not on the partition.
291 - Don't use EXT4-fs fake errors, as we use only hardware issues.
292 - Only detect hardware issues and no filesystem ons.
293 - test failurs on different devices.
294 - Need to do a new UDisk sync in order to get the cleartext_device.
295 - Add debug information.
296 - Detect I/O failures on Tails partition.
298 - Fix systemd dependencies.
299 - Make tails-report-disk-ioerrors translatable.
300 - Test the tails-detect-disk-ioerrors service.
301 - rename detect-squashfs-errors to detect-disk-ioerrors.
302 - rename tails-detect-disk-errors -> tails-detect-disk-resize-errors.
304 -- Tails developers <tails@boum.org> Mon, 22 Apr 2024 11:40:37 +0200
306 tails (6.1) unstable; urgency=medium
308 * Install intel-microcode 3.20240312.1 to fix RFDS Intel CPU vulnerabilities
312 - Upgrade intel-microcode to mitigate the RFDS ("register file data sampling")
313 and Intel Processor Return Predictions Advisory (INTEL-SA-00982) hardware
314 vulnerability (tails/tails#20293)
317 - Install intel-microcode 3.20240312.1 to fix RFDS Intel CPU vulnerabilities
319 * Resolve "Upgrade to Tor Browser 13.0.13 based on 115.9.1" (tails/tails!1462)
322 - Upgrade to Tor Browser 13.0.13 based on 115.9.1 (tails/tails#20289)
325 - Fetch Tor Browser from our own archive
326 - Upgrade Tor Browser to 13.0.13
328 * tails-create-iuk: don't break when an updated file has a backslash in its name
332 - tails-create-iuk fails when an updated file has a backslash in its name
336 - Document non-obvious behavior
337 - IUK creation: don't break when an updated file has a backslash in its name
338 - IUK test suite: add tag to ease development
339 - IUK test suite: verify that our removal of trusted.overlay.* xattrs works
340 - IUK test suite: preserve xattrs when unpacking test SquashFS
341 - IUK test suite: add regression test for backslash in name of updated file
343 * Actually set Mutter's check-alive-timeout in gdm to 300s (tails/tails!1430)
346 - Welcome Screen frequently shows "Welcome to Tails!" is not responding
350 - Actually set Mutter's check-alive-timeout in gdm to 300s
352 * Fix Onion Circuits (tails/tails!1428)
355 - Write automated tests for Onion Circuits (tails/tails#18338)
356 - Onion Circuits is broken (tails/tails#20233)
359 - Test suite: Test that Onion Circuits works
362 * Resolve "Upgrade to Tor Browser based on ESR 115.9" (tails/tails!1455)
365 - Upgrade to Tor Browser based on ESR 115.9 (tails/tails#20261)
368 - Fetch Tor Browser from our own archive
369 - Upgrade Tor Browser to 13.0.12
371 * Test suite: Use Dogtail to set up admin password (tails/tails!1447)
374 - Test suite: Use Dogtail to set up admin password (tails/tails#20251)
377 - Test suite: Use Dogtail to set up admin password
378 - Welcome Screen: Make admin password entries accessible
380 * Test suite: Make closing notification list more robust (tails/tails!1435)
383 - Test suite: Step 'all notifications have disappeared' is flaky
387 - Test suite: Make closing notification list more robust
389 * Enable Tracker again (tails/tails!1434)
392 - Opening GNOME Videos shows an error message about tracker-miner-fs-3.service
393 being masked (tails/tails#20243)
394 - tracker-extract-3.service often fails to connect to filesystem miner
396 - Opening GNOME Videos displays error dialog: tracker-miner-fs-3-service is
397 masked (tails/tails#20237)
400 - Test suite: delete scenario for detecting tails#20220
401 - Only start tracker-miner-fs-3.service after gnome-session.target
402 - Don't pull in tracker-extract-3.service before default.target
403 - Test suite: Fix scenario "The tracker-miner-fs service didn't time out"
404 - Make Tracker not index or monitor any directories
405 - Test suite: Test that tracker-miner-fs service didn't time out
406 - Enable Tracker again
408 * Install alsa-topology-conf (tails/tails!1452)
411 - Consider installing alsa-topology-conf package (tails/tails#20270)
414 - Install alsa-topology-conf (refs: tails/tails#20270)
416 * GitLab CI: Fix Ruff CI job (tails/tails!1446)
419 - Ruff CI job doesn't check any files (tails/tails#20266)
422 - GitLab CI: Fix Ruff CI job
424 * Resolve "Step "I enable persistence" returns before Persistent Storage was
425 unlocked" (tails/tails!1445)
428 - Step "I enable persistence" returns before Persistent Storage was unlocked
432 - Test suite: Don't retry Dogtail method which we expect to fail
433 - Test suite: Fix button label
435 * Test suite: add scenario verifying that the live user can access exactly the
436 local services it is supposed to (tails/tails!1444)
439 - Add test: the amnesia user can only access the expected services
443 - Test suite: also use allowlist approach to track which services should be
444 available for the live user
445 - Firewall: allow root to use Tor's DNSPort
446 - Test suite: don't use fancy ruby pattern matching for Hash unpacking
447 - Test suite: extract to constant
448 - Test suite: pretty log what was tested
449 - Test suite: make sure the connection was made by the live user
450 - Test suite: make explicit that check is an anti-test
452 - Test suite: add scenario verifying that the live user can access exactly the
453 local services it is supposed to
454 - Firewall: don't DROP OUTPUT, LOG and REJECT instead
455 - Test suite: allow matching dropped packets based on uid and gid
456 - Test suite: add seemingly forgotten step
457 - Test suite: improve how we test untorified connections
458 - Test suite: cupsd is no longer listening on anything but loopback
459 - Test suite: optimize scenario
460 - Test suite: improve typing and use IPAddr#loopback? instead of regex
461 - Test suite: refactor
463 * Build system: bump RAM to avoid OOM during mksquashfs (refs: tails/tails#20228)
467 - Building in RAM FTBFS due to oom (tails/tails#20228)
470 - Build system: bump RAM to avoid OOM during mksquashfs (refs: tails/tails#20228)
472 * Test suite: improve --late-patch (tails/tails!1440)
475 - Test suite: Improve --late-patch (tails/tails#20256)
479 - Test suite: make --late-patch without argument work with the testoverlayfs IUK
481 - Test suite: fix cmd_helper() multi-line output
482 - Test suite: make --late-patch without argument copy all changed files
483 - Test suite: make --late-patch infer destination when only source is given
485 * tps-frontend: Disable timeout for ChangePassphrase call (tails/tails!1439)
488 - Changing passphrase of Persistent Storage reports an error even if it
489 eventually succeeds after the frontend stopped waiting for it
493 - Fix "Passphrase was changed successfully" printed on error
495 - Use os.path.join for aesthetic reasons
496 - Remove unused error
497 - Use `systemctl show` to get terminating signal
498 - GitLab CI: Make black target Python 3.11
499 - tps: Work around systemd not detecting oom-kill
500 - tps: Reconnect to udisks if the D-Bus connection is lost
501 - tps: Use more efficient method to get boot device
502 - tps: More useful error messages
503 - tps-frontend: Strip D-Bus error
504 - tps: Raise a NotEnoughMemoryError if udisks2 is oom-killed
505 - tps: Include Thread ID (TID) in log output
506 - tps: Fix method name included in log output
508 - tps-frontend: Disable timeout for ChangePassphrase call
510 * tps-frontend: Fix only one custom feature being shown (tails/tails!1438)
513 - Only one custom feature is shown in Persistent Storage UI (tails/tails#19267)
516 - Reformat with black
517 - Reformat with black
518 - Silence linting failure
521 - tps-frontend: Fix only one custom feature being shown
523 * Install PipeWire instead of PulseAudio (tails/tails!1433)
526 - Replace PulseAudio with PipeWire (tails/tails#20219)
529 - Install PipeWire instead of PulseAudio
531 * Help the RM when we FTBFS during release process due to an unused APT source,
532 take 2 (tails/tails!1432)
535 - FTBFS during release process when an unused APT source is configured
539 - Fix error reporting
541 * Test suite: Check for unexpected error messages in journal (tails/tails!1424)
544 - Test suite: Check unexpected journal messages of priority "err" or higher
548 - Drop investigating errors in the journal from manual test suite
549 - Print errors in assert
550 - Use .each instead of .select
552 - Update expected journal entries
554 - Add expected journal entries for ALSA bug
555 - Remove diversion of non-existent file
556 - Test suite: Check for unexpected error messages in journal
558 * Avoid starting unnecessary services for Debian-gdm (tails/tails!1422)
561 - Avoid starting unnecessary services for Debian-gdm
563 * Test suite improvements (tails/tails!1411)
566 - Test suite: make sure notifications have disappeared
567 - Test suite: Fix Tor Browser not starting because Tor is not ready
568 - Test suite: Don't start Electrum and Synaptic via remote shell
569 - Test suite: Start tails-backup via remote shell
570 - Test suite: Sort launch_* functions alphabetically
571 - Simplify try_for() block
572 - Test suite: Use Enter again to open file chooser
573 - Test suite: Start apps via remote shell
574 - Test suite: Use dogtail to attach disk in GNOME Disks
576 * Allow tails-debugging-info commands to fail (tails/tails!1410)
579 - tails-debugging-info crashes if any of the commands it runs fails
583 - Revert "Ensure tails-debugging-info does not crash in case lsblk returns a non-
585 - place error suppression at the right place
586 - more ruff improvements
587 - permanently disable B603
590 - simple ruff-suggested improvements
591 - Improve scenario description
592 - Add scenario which runs tails-debugging-info --strict and checks the exit code
593 - Add --strict mode to tails-debugging-info
594 - Allow tails-debugging-info commands to fail
596 * Tails Cloner: unmount all filesystems on target device (tails/tails!1372)
599 - Tails Cloner fails on "Partitioning device" several times... and then succeeds
601 - The retry decorator is buggy when the 10 attempts fail: "cannot access local
602 variable 'e' where it is not associated with a value" (tails/tails#20252)
603 - Tails Cloner fails installing to/upgrading devices with other mounted
604 partitions (tails/tails#20149)
607 - Cloner: handle unmounting devices without partition tables again
608 - Cloner: drop excessive debug logging
609 - Cloner: appease Ruff vs PLW2901 (redefined-loop-name)
610 - Cloner: add docstring
611 - Cloner: update docstring
612 - Cloner: make unmount_device() always unmount all filesystems on the device
613 - Cloner: also unmount before resetting the MBR
614 - Cloner: drop nonsense code
615 - Update Cloner screenshot vs changes from tails!1372
616 - Reformat with black
617 - Fix more instances of RUF012
618 - Fix 1 instance of RUF012: this class attribute does not need to be mutable
620 - Override Ruff E402: we have gi.require_version
622 - Catch regular program errors but not important system exceptions
624 - Fix Ruff ISC003 and PLW2901
625 - Remove unused import
627 - Fix a bunch of Ruff violations
628 - Revert "Cloner and Test suite: add label to device pretty name, adjust test
630 - Cloner: defensive proramming++
631 - Cloner: drop useless debug logging
632 - Cloner: unmount all partitions related to the target when needed
633 - Cloner: improve detection of persistent storage and allow installing to LUKS
635 - Cloner: only list partitions as targets when they are upgradeable
636 - Cloner: Fix scoping issue in retry()-wrapper's error handling
637 - Cloner and Test suite: add label to device pretty name, adjust test accordingly
639 * Upgrade Thunderbird to 115.9
641 -- Tails developers <tails@boum.org> Tue, 26 Mar 2024 13:35:48 +0100
643 tails (6.0) unstable; urgency=medium
645 * Disable Tracker (tails/tails!1423)
648 - tracker-extract-3.service often fails to connect to filesystem miner (tails/tails#20220)
651 - Disable the tracker services for all users
652 - Be consistent with how we mask systemd services
655 * Upgrade Tor Browser to 13.0.10 (tails/tails!1418)
658 - Upgrade to Tor Browser 13.0.10 based on ESR 115.8 (tails/tails#20210)
661 - Fetch Tor Browser from our own archive
662 - Upgrade Tor Browser to 13.0.10
664 * Tails Cloner: don't attempt to unmount the target device twice
668 - tails-installer fails to install to already mounted devices (tails/tails#20139)
671 - Tails Cloner: don't attempt to unmount the target device twice (refs:
674 * Install python3-pyqt5 to fix Electrum not starting (tails/tails!1357)
677 - Electrum does not start in Tails 6.0 (tails/tails#20079)
680 - Install python3-pyqt5 to fix Electrum not starting
682 * Test suite: Wait for notifications to disappear (tails/tails!1420)
685 - Scenario "Persistent browser bookmarks" is fragile (tails/tails#20218)
688 - Test suite: Wait for notifications to disappear
690 * Update call for testing template (tails/tails!1378)
693 - Call for testing template is outdated (tails/tails#18909)
696 - Update call for testing template
698 * tps: Handle psutil.NoSuchProcess exception (tails/tails!1421)
701 - Check for conflicting apps breaks activating Persistent Storage feature (tails/tails#19434)
706 - tps: Handle psutil.NoSuchProcess exception
708 * Make QT applications use the default GTK cursor size (tails/tails!1416)
711 - Qt applications do not respect cursor size (tails/tails#20206)
714 - Add shell directive to make shellcheck happy
719 - onionshare: Don't set QT_QPA_PLATFORM
720 - Make QT apps shipped in Tails use cursor size configured in GNOME
721 - Make QT applications use the default GTK cursor size
723 * Remove desktop icons (tails/tails!1415)
726 - No spinner over desktop when starting an app (tails/tails#19920)
729 - Test suite: remove obsolete code
730 - Drop handling of desktop icons
731 - Re-add Files to Favorites
732 - Drop the "Desktop Icons NG" GNOME Shell extension
733 - Test suite: remove unused images
734 - Test suite: remove unused images
736 * Fix Tails Installer (tails/tails!1414)
739 - tails-installer fails to start (tails/tails#20207)
742 - Fix Tails Installer
744 * re-introduce GDM error messages before Welcome Screen, and add Disk Failure
745 error message too (tails/tails!1412)
748 - SquashFS errors during boot lead to false-positives on graphics card error reports (tails/tails#16030)
751 - Test suite: order scenarios in chronological time of failure
752 - Test suite: split out unsupported hardware test from hardware failure feature
753 - Test suite: express goal in feature summary
754 - Test suite: be more specific
755 - Test suite: remove duplicate word
756 - Test suite: remove duplicate method definition
757 - Fix typos and links, make example more specific
758 - Test suite: make capitalization consistent
759 - Test suite: make spelling of "graphics card" consistent with user facing
760 strings and documentation
761 - rubocop --autocorrect
764 - Revert "delay error message reporting to desktop session"
766 - add picture for regression test
767 - retain plymouth's splash
768 - clarify the kind of error
771 - Add test for a broken graphic card.
772 - Enable test about disk read failures before reaching the Welcome Screen again.
774 * Test suite: Enter path via Dogtail (tails/tails!1409)
777 - Revert "VeraCrypt test suite (file container): robustness improvement (refs:
779 - Test suite: Add link to GTK issue
780 - Test suite: Enter path via Dogtail
782 * tails-iuk-generate-upgrade-description-files: only warn about missing
783 --previous_version (tails/tails!1408)
786 - tails-iuk-generate-upgrade-description-files fails without any --previous_version (tails/tails#20197)
789 - tails-iuk-generate-upgrade-description-files: only warn about missing
792 * Additional Software notify: Fix error exit code if no buttons specified
796 - Step 'I can open the Additional Software log file from the notification' is still fragile (tails/tails#20196)
801 - Additional Software: Fix error exit code if no buttons specified
802 - Additional Software: Log the error exit code
804 * Test suite: Fix flaky step 'And I can save the current page as "index.html" to
805 the <dir> GNOME bookmark' (tails/tails!1405)
808 - "Scenario Outline: The default XDG directories are usable in Tor Browser" is fragile (tails/tails#20159)
811 - Test suite: Fix flaky step 'And I can save the current page as "index.html" to
812 the <dir> GNOME bookmark'
814 * Don't install Bullseye backport of cryptsetup-bin in Bookworm images
818 - Bookworm images incorrectly include cryptsetup-bin package built for Bullseye (tails/tails#20193)
821 - Revert "Temporarily pin our cryptsetup 2:2.6.1-4~deb11u1~tails1 backport"
823 * Make failure to add entry to cache fatal again, and provide guidance
827 - website-cache gc not good enough on jenkins (tails/tails#20150)
831 - Abort on failure to add website cache entry and provide guidance
832 - Make indentation consistent
833 - Log website cache inodes usage
835 * Upgrade to Bookworm 12.5 (tails/tails!1402)
838 - Upgrade to Bookworm 12.5 (tails/tails#20153)
841 - Upgrade to Bookworm 12.5
843 * Test suite: lower needed pattern coverage after filling the memory
847 - "Scenario Tails erases memory on DVD boot medium removal: vfat" very frequently fails (tails/tails#20156)
850 - Test suite: lower needed pattern coverage after filling the memory
852 * Firewall: allow the amnesia user to connect to any local TCP port that's not
853 explicitly blocked (tails/tails!1400)
856 - Audacity is slow to start in 6.0~rc1 due to incompatible plugins (tails/tails#20185)
859 - Firewall: allow the amnesia user to connect to any local port that's not
861 - Drop some more "white-list"
862 - blacklist → blocklist
863 - whitelist → allowlist
865 * Fix dump-user-env (tails/tails!1399)
868 - make code more understandable
871 * Welcome Screen: Support unlock kernel parameter (tails/tails!1398)
874 - Document unlock kernel parameter
878 - Welcome Screen: Support unlock kernel parameter
880 * Welcome Screen: Disable check-alive feature (tails/tails!1397)
883 - Disable "Window not responding" dialog in Welcome Screen (tails/tails#20190)
886 - Welcome Screen: Disable check-alive feature
888 * Mention full file name in Step 5.2 of the installation doc (tails/tails!1395)
891 - Mention full file name is Step 5.2 of installation instructions
896 - Mention full file name in Step 5.2
897 - Add snippets for current version
898 - Generate snippets for image file name
900 * Fix displaying notification of Additional Software installation failure
904 - Additional Software installation failure notification is not displayed (most of the time?) on Bookworm (tails/tails#20170)
907 - 2 is an error exit code
908 - Fix displaying notification of Additional Software installation failure
910 * Re-install gstreamer1.0-plugins-bad (tails/tails!1393)
913 - 6.0~rc1 does not include gstreamer1.0-plugins-bad (tails/tails#20178)
916 - Remove obsolete and incomplete explanation
917 - Re-install gstreamer1.0-plugins-bad
919 * Prioritize Persistent Storage app in GNOME Shell search (tails/tails!1392)
922 - Searching for "Persistent Storage" in the gnome-shell overview should show the Persistent Storage app before the backup app (tails/tails#20182)
925 - Prioritze Persistent Storage app in GNOME Shell search
927 * tps-frontend: Fix race condition in handling of conflicting applications
931 - tps-frontend: Race condition in handling of conflicting applications (tails/tails#20164)
934 - tps-frontend: Fix race
936 * Do not auto-mount TailsData partitions (tails/tails!1390)
939 - The backup tool is interfered by GNOME's own passphrase prompt (tails/tails#20143)
942 - Test suite: adapt scenarios to GNOME not auto-mounting TailsData partitions any
944 - Do not auto-mount TailsData partitions
946 * Silence some error messages in the journal (tails/tails!1388)
949 - Journal shows problem with gnome keyboard configuration (tails/tails#20172)
952 - Silence error message
953 - Disable gnome-power-manager live-config hook
955 * decrease usage of short git commit IDs (tails/tails!1386)
958 - Tails 6.0~rc1 not reproducible due to different lengths Git short commit ids (tails/tails#20165)
961 - remove references to short ids
962 - minimum length for short id
964 * Enable Electrum's Jade Blockstream wallet support (tails/tails!1385)
967 - Electrum does not support hardware wallet Jade Blockstream in Tails 6.0 (tails/tails#20137)
970 - Enable Electrum's Jade Blockstream wallet support
972 * Reliably handle issuing shutdown command via remote shell (tails/tails!1384)
975 - Reliably handle issuing shutdown command via remote shell (tails/tails#20160)
978 - rubocop --autocorrect
979 - Test suite: let's be explicit that execute_successfully() + spawn doesn't mix
980 - Test suite: just use spawn() instead of execute(..., spawn: true)
981 - Test suite: fix instance where execute_successfully and spawn don't mix
982 - Test suite, remote shell: stop with the server ACK when spawning commands
984 * Lock the GNOME location services switch (tails/tails!1382)
987 - Lock the GNOME location services switch (tails/tails#20071)
991 - Update 00_Tails_defaults
993 * Use consistent capitalization of "Persistent Storage" (tails/tails!1380)
1007 - Remove unused imports
1009 - Use consistent capitalization of "Persistent Storage"
1011 * Build system: log the size of the Website cache entry we are about to add
1015 - Fix the problem raised by shellcheck instead of silencing it
1016 - Appease shellcheck
1017 - Build system: log the size of the Website cache entry we are about to add
1018 (refs: tails/tails#20150)
1020 * Log website cache filesystem usage at relevant times (tails/tails!1376)
1023 - Log website cache filesystem usage at relevant times
1025 * Install bullseye's onionshare 2.2 in Tails Bookworm (tails/tails!1375)
1028 - OnionShare stays open in the background and fails to reopen (tails/tails#20135)
1032 - APT: add Bullseye -security and -updates sources (refs: tails/tails#20135)
1033 - Do everything needed to install OnionShare 2.2 forward-ported from bullseye
1034 (refs: tails/tails#20135)
1036 * RM doc updates post-5.22 (tails/tails!1374)
1040 - clarify expected result
1041 - clarify: when the next major is in the next series
1043 * UsePrivilegeSeparation is deprecated (tails/tails!1373)
1046 - UsePrivilegeSeparation is deprecated
1048 * Fix failure when running multiple asp-post-apt hooks in parallel
1052 - ASP: asp-post-apt hook fails if previous invocation is still running (tails/tails#20147)
1055 - Silence systemd-run in asp-post-apt hook
1056 - Fix check for installed/removed packages
1057 - Update Additional Software design doc
1058 - Fix Additional Software design doc
1059 - Additional Software: Ensure packages are only handled once
1060 - Additional Software: Use lock file to avoid race conditions
1061 - Avoid asp-post-apt hooks running forever in some cases
1062 - Fix failure when running multiple asp-post-apt hooks in parallel
1064 * Fix spawn_tps_frontend (tails/tails!1368)
1067 - tps-frontend disappears while setting up Persistent Storage for Additional Software (tails/tails#20141)
1070 - Fix inter-process communication based on non-zero exit codes
1071 - Revert "Avoid asp-post-apt hooks running forever in some cases"
1072 - Revert "Fix failure when running multiple asp-post-apt hooks in parallel"
1073 - Sync' both Ruff configurations
1075 - Use long option name
1076 - Use subprocess.check_call with gtk-launch instead of subprocess.Popen
1077 - Additional Software: Fix app hanging if Persistent Storage is not created
1078 - Use subprocess.check_call instead of subprocess.Popen
1079 - Avoid asp-post-apt hooks running forever in some cases
1080 - Reduce memory used by asp-post-apt hook
1081 - Fix failure when running multiple asp-post-apt hooks in parallel
1082 - Set SyslogIdentifier with systemd-run
1085 - Run ruff --fix on modified files
1086 - Fix spawn_tps_frontend
1087 - Don't use stderr=subprocess.PIPE with subprocess.Popen
1089 * Fix broken tests for feature/bookworm (tails/tails!1367)
1092 - Adjust Bookworm test suite to !1166 (tails/tails#19738)
1095 - Test suite: fixup incorrect suggestion that was applied
1096 - Test suite: wait for GNOME authentication dialog to disappear
1097 - Test suite: fix comment
1098 - Test suite: use grabFocus() instead of worse code
1099 - Test suite: refactor
1101 - Test suite: deal with GNOME authentication prompt getting in the way
1102 - Test suite: fix Nautilus vs our showingOnly default (refs: tails/tails#19738)
1103 - Test suite: bump image for Bookworm
1104 - Test suite: deal with GNOME authentication prompt getting in the way
1105 - Test suite: improve step name
1106 - Test suite: don't reinvent the wheel
1107 - Test suite: don't use hardcoded passphrase
1108 - Test suite: adapt a bunch of steps to GNOME auto-mounting removable media
1109 (refs: tails/tails#15900)
1110 - Test suite: add a handy mountpoint() method
1111 - Test suite: support multiple mountpoints in parse_udisksctl_info()
1112 - Test suite: use different method when filling storage devices until they are
1114 - Test suite: be more precise when determining available space in mountpoint
1116 * Remove friction to report errors (tails/tails!1363)
1119 - Remove friction to write to our support channels (tails/tails#19102)
1122 - Remove obsolete call to chmod that causes FTBFS
1123 - Remove deleted file from l10n setup and .gitignore
1124 - Use install(1) instead of cp + chmod
1125 - De-duplicate tails-documentation.desktop.in
1126 - Update 2 more references to renamed bug reporting page
1128 - Core pages: adjust to renamed page
1129 - Stop ignoring deleted file
1130 - Test suite: move scenario to more appropriate feature
1131 - Test suite: improve scenario name
1132 - Test suite: adapt scenario to #19102
1133 - Test suite: split out and fix "open the Report an Error launcher" step
1134 - Test suite: drop obsolete test
1135 - Test suite: generalize step name
1137 - Point directly to WhisperBack from the desktop (#19102)
1139 - Rewrite instructions to send error reports
1141 - Remove section about "Tails does not start"
1143 * Fix Ruff policy violations in files modified on feature/bookworm, take 2
1147 - Fix Ruff & Rubocop policy violations in files modified on feature/bookworm (tails/tails#20124)
1152 - Reformat with Black
1153 - Trust our callers to not pass us untrusted input
1154 - Accept manual handling of subprocess.run result
1155 - Make check more generic
1157 - Automatically fix Ruff UP031
1158 - Automatically fix Ruff UP022
1159 - Automatically fix Ruff PIE790
1161 * Fix Ruff & Rubocop policy violations in files modified on feature/bookworm
1165 - Fix Ruff & Rubocop policy violations in files modified on feature/bookworm (tails/tails#20124)
1168 - rubocop --autocorrect
1169 - Silence Ruff false positive
1170 - Silence Ruff false positive
1172 - Automatically fix UP032 "Use f-string instead of `format` call"
1173 - Automatically fix UP024 "Replace aliased errors with `OSError`"
1175 * Use the Tails logo as the user icon (tails/tails!1358)
1178 - Add a user icon (tails/tails#20078)
1181 - Use our logo as the user icon
1183 * Replace Gedit with GNOME Text Editor (tails/tails!1355)
1186 - Migrate from gedit to gnome-text-editor (tails/tails#19651)
1189 - Test suite: adapt to the migration from Gedit to GNOME Text editor
1190 - Test suite: update example in comment
1191 - Replace Gedit with GNOME Text Editor
1193 * remove "custom" keyboard layout from greeter (tails/tails!1354)
1196 - Remove "A user-defined custom Layout" option as keyboard layout (tails/tails#20109)
1199 - Reformat with Black
1202 - Ignore false positive
1203 - remove "custom" keyboard layout from greeter
1205 * Add full commit ID to /etc/os-release (tails/tails!1352)
1208 - Add full commit ID to /etc/os-release
1210 * Add diceware word lists Catalan, Italian, and Spanish (tails/tails!1340)
1213 - Have diceware word lists for each of our tier-1 languages (tails/tails#20014)
1216 - Reformat with Black
1217 - Add diceware word lists Catalan, Italian, and Spanish
1219 * Detect SquashFS errors and alert the user about them (tails/tails!1334)
1222 - SquashFS errors during boot lead to false-positives on graphics card error reports (tails/tails#16030)
1225 - delay error message reporting to desktop session
1226 - Update picture for Bookworm
1227 - comment: how to test
1228 - clarify which comment applies to what
1229 - Add test for opening the documentation.
1230 - Update reference image for Tails 6.0
1231 - shellcheck-suggested fix
1232 - Revert "Enable debug for gdm-wayland-session.tails"
1234 - Revert "make shellcheck happy"
1236 - Improve journal reader
1237 - Point to /ioerror that gives more context
1238 - Draft /ioerror (#5856)
1240 - Explain how to browse files as root
1241 - Reference fsck instructions
1244 - Use buttons in user error message.
1245 - send ready signal after the file exists.
1247 - refresh translations
1248 - make URL non-translatable
1249 - make shellcheck happy
1251 - add documentation about signal READY hack.
1252 - Use wait_for_remote_shell in hardware_failure test.
1253 - Use propper English in test suite.
1254 - Add signal_ready cmd_type to remote shell
1255 - Make it a systemd-notify daemon
1256 - Split error message for small screens like our test suite.
1257 - make detect-squashfs-errors.service start before gdm.
1259 - Enable debug for gdm-wayland-session.tails
1260 - try to fix test of eraly hardware failure message.
1261 - Use other base image to test plymouth error message.
1262 - make rubocop happy.
1263 - Add test for plymouth Disk error message.
1265 - Add reference image.
1266 - Make tails-report-squashfs-errors to work with Tails 5.X.
1268 - fix typos and make rubocop happy.
1269 - Add features to test hardware failure.
1270 - Add logic to read the user action.
1271 - Add buttons to error message.
1272 - Update notify-send message to sajolida's suggestion
1273 - Update path for squashfs failures.
1274 - Update error message to sajolida's suggestion.
1275 - Add comments on tails-detect-squashfs-errors.
1276 - also process old entries
1278 - Simple UI to report errors when they happen
1279 - Move to places where others files live too ;)
1280 - Use /squashfs_failed as /run cannot be set via initramfs/early_patch.
1281 - Use accepted return code.
1282 - Do not start GDM, if we detect SQUASHFS errors.
1283 - Add deamon to detect squashfs errors.
1285 * Upgrade Vagrant basebox to Debian Bookworm (tails/tails!1323)
1288 - Upgrade Vagrant basebox to Bookworm (tails/tails#19562)
1291 - Build system: install po4a 0.62-1 from bullseye
1292 - Build system: enable bookworm-{backports,updates}
1293 - Build system: bump APT snapshots to ones containing
1294 bookworm-{backports,updates}
1295 - Build system: bump RAM to avoid OOM during mksquashfs (refs: tails/tails#20085)
1296 - Build system: drop -backports and -updates APT sources from builder
1297 - Build system: bump APT snapshots while migrating to Bookworm
1298 - Build system: upgrade builder basebox to Debian Bookworm (refs:
1301 * Fix Tails Cloner: Reset start button, link and labels when last drive removes
1302 (#20069) (tails/tails!1313)
1305 - When the last drive is removed and it was a Tails USB the labels and buttons
1306 should reset to the Install condition (tails/tails#20069)
1309 - don't return early if drive is None in `on_target_partitions_changed()`
1311 * Improve Tails Cloner info bar and delete message text (tails/tails!1309)
1314 - Comply with style guide: Capitalize Persistent Storage in delete message text
1315 - Remove 'or SD card' from infobar as SD cards are deprecated.
1316 - Apply black formatting to "Plug in a USB stick" Update gui.py
1317 - Comply with style guide: 'USB flash drive' to 'USB stick'
1318 - Remove infobar text's 'Please' to comply with style guide
1319 - Fix infobar text typo 'Plug' instead of 'Plug in' used elsewhere
1321 * Add run-nosymfollow.mount (tails/tails!1247)
1324 - Create run-nosymfollow.mount (tails/tails#19487)
1327 - tps test suite: set up the nosymfollow mount like we now do in production
1333 - Suppress Ruff B904
1336 - Suppress Ruff T100
1338 - Suppress Ruff PLW0603
1341 - Suppress Ruff E402
1342 - tps test suite: update comment
1343 - Add run-nosymfollow.mount
1345 * Harden NetworkManager.service (tails/tails!1246)
1348 - Consider using systemd's security features in NetworkManager service files
1352 - Restore read-write access to all kernel variables
1353 - SystemCallError should be SystemCallErrorNumber
1354 - Remove PrivateIPC (RemoveIPC is correct name)
1355 - Harden NetworkManager.service
1357 * Improve the tails-about dialog to easier identify nightly build
1361 - Make it easier to identify which nightly build is running (tails/tails#17543)
1364 - tails-about: remove unused import
1365 - tails-about: remove "Tails developers" noise to match design
1366 - tails-about: fix grammar to match design
1367 - fix indention to please rubocop.
1368 - VERSION is not only a number.
1369 - Use regex to get infos out of os-release.
1370 - Unreleased versions don't have a release date.
1371 - rename misleading functionname.
1372 - Add reference image for Update to 6.3~testoverlayfs
1373 - remove unsused entries in auto/config
1374 - Add reference image for upgrade to 6.2~testoverlayfs.
1375 - Test suite: make test file name & content match the version
1376 - Fix version determine in os-release.
1377 - Bump test iuk version as we now use os-release to get the Tails version.
1378 - get_release_Date is a function.
1379 - Revert changes on config/binary_rootfs/squashfs.sort
1380 - Remove last occurence of /etc/amnesia/version
1381 - make shellcheck happy.
1382 - read TAILS_SOURCE_DATE_EPOCH from os-release to set minimum date.
1383 - try to fix automatic_update test
1385 - Use built-in plattform.freedesktop_os_release to parse os_release.
1386 - Next attempt to fix test suite.
1387 - fix autotest suite.
1388 - import needed Dict from typing.
1389 - make tests to use os-release.
1390 - fix wrong syntax in shell.
1391 - Add deprecation waring to tails-version.
1392 - Get rid of /etc/amnesia/version
1393 - Improve the tails-about dialog to easier identify nighly build.
1395 * Release process adapt for major version bumps (tails/tails!1192)
1398 - Clarify PREVIOUS_STABLE_VERSION when switching to new debian series
1402 - Release process: migrate calculation to rm-config so we can automate some steps
1403 - Release process: fix grammar now that there can be multiple test IUKs (refs:
1406 - Release process, QA: deal with which versions to test Incremental Upgrades from
1408 - Verify that the test UDFs we generate are correct before publishing.
1409 - Release process: publish test UDFs for both previous stable version and (if
1410 any) the last alpha/beta/RC when releasing a major version
1412 * Simplify TCA start procedure (tails/tails!1175)
1415 - Simplify TCA start procedure (tails/tails#19720)
1420 - Improve usage message
1421 - Move closefrom_override to separate file
1437 - netnsdrop: Remove unused argument env_file
1438 - Rename connect-socket -> inherit-fd
1439 - tca: Inline run-tca-in-netns in tca
1440 - tca: Check Persistent Storage status in application.py
1441 - Inline more wrapper scripts
1442 - Rename run_in_netns -> run_in_netns_as_amnesia
1443 - userenv: Allow passing TOR_BROWSER_SKIP_OFFLINE_WARNING
1444 - tca: Close all file descriptors except for the ones we want to keep open
1445 - Remove unnecessary env_keep statements from sudoers files
1446 - userenv: Allow passing NOTIFY_SOCKET environment variable
1447 - tca: Pass environment to child via a file
1449 * systemd: Use both name and description in user unit status messages (Bookworm)
1453 - systemd: Use both name and description in user unit status messages
1455 * Upgrade to Debian 12 (Bookworm) (tails/tails!1119)
1458 - Tails 6.0 based on Debian 12 (Bookworm) (tails/tails#19477)
1461 - Fix inter-process communication based on non-zero exit codes
1462 - Revert "Avoid asp-post-apt hooks running forever in some cases"
1463 - Test suite: fixup incorrect suggestion that was applied
1464 - Test suite: wait for GNOME authentication dialog to disappear
1465 - Test suite: fix comment
1466 - Revert "Fix failure when running multiple asp-post-apt hooks in parallel"
1467 - Sync' both Ruff configurations
1469 - Use long option name
1470 - Use subprocess.check_call with gtk-launch instead of subprocess.Popen
1471 - Additional Software: Fix app hanging if Persistent Storage is not created
1472 - Use subprocess.check_call instead of subprocess.Popen
1473 - Avoid asp-post-apt hooks running forever in some cases
1474 - Reduce memory used by asp-post-apt hook
1475 - Fix failure when running multiple asp-post-apt hooks in parallel
1476 - Set SyslogIdentifier with systemd-run
1479 - Run ruff --fix on modified files
1480 - Fix spawn_tps_frontend
1481 - Don't use stderr=subprocess.PIPE with subprocess.Popen
1482 - Test suite: use grabFocus() instead of worse code
1483 - Test suite: refactor
1485 - Test suite: deal with GNOME authentication prompt getting in the way
1487 - Test suite: fix Nautilus vs our showingOnly default (refs: tails/tails#19738)
1488 - Test suite: bump image for Bookworm
1489 - Test suite: deal with GNOME authentication prompt getting in the way
1490 - Test suite: improve step name
1491 - Reformat with Black
1494 - Ignore false positive
1495 - remove "custom" keyboard layout from greeter
1497 - Test suite: don't reinvent the wheel
1498 - Test suite: don't use hardcoded passphrase
1499 - Update to Bookworm
1500 - Use our logo as the user icon
1501 - Stop avertizing share.riseup.net
1502 - Use consistent terminology and title capitalization
1503 - Improve style of nested blocks
1506 - Use consistent terminology
1507 - Explain better what is the Super key
1508 - Document known issues
1509 - Remove not-so-useful link
1510 - Improve phrase and style guide
1511 - Don't use 'your' when talking about public computers, mostly
1512 - Replace encryption_and_privacy/virtual_keyboard by a note
1514 - Test suite: adapt a bunch of steps to GNOME auto-mounting removable media
1515 (refs: tails/tails#15900)
1516 - Test suite: add a handy mountpoint() method
1517 - Test suite: support multiple mountpoints in parse_udisksctl_info()
1518 - Test suite: use different method when filling storage devices until they are
1520 - Reformat with Black
1521 - Trust our callers to not pass us untrusted input
1522 - Accept manual handling of subprocess.run result
1523 - Make check more generic
1525 - Automatically fix Ruff UP031
1526 - Automatically fix Ruff UP022
1527 - Automatically fix Ruff PIE790
1530 - remove duplicate word
1531 - Remove useless if statement
1532 - Test suite: be more precise when determining available space in mountpoint
1533 - Test suite: adapt to the migration from Gedit to GNOME Text editor
1534 - Test suite: update example in comment
1535 - Replace Gedit with GNOME Text Editor
1536 - rubocop --autocorrect
1537 - Silence Ruff false positive
1538 - Silence Ruff false positive
1540 - Automatically fix UP032 "Use f-string instead of `format` call"
1541 - Automatically fix UP024 "Replace aliased errors with `OSError`"
1542 - Tails Cloner: don't attempt to unmount the target device twice (refs:
1544 - Test suite: fix scenario where Nautilus misbehaves with our showingOnly default
1545 (refs: tails/tails#19738)
1546 - Gmail in Tails is easier now!
1548 - Update to Bookworm
1549 - Capitalize 'Lock Screen'
1550 - Install python3-pyqt5 to fix Electrum not starting
1551 - Test suite: bump image
1552 - Install pipewire-media-session to repair GNOME's screen recording capability
1553 (refs: tails/tails#19441)
1555 - Mention OnionShare in faq#onion-service
1556 - Update to OnionShare 2.6
1557 - Cover the case when screeshots are too big
1558 - Add full commit ID to /etc/os-release
1559 - Document Dark Theme and Night Light modes
1560 - Fix capitalization
1561 - Update to #15900 and #15767
1562 - Document the fix for the no-overview GNOME Shell extension
1564 - Remove unused icon
1565 - Update screenshots
1566 - Fix icon reference
1567 - Add CSS for Windows commands
1568 - Add missing screenshot
1571 - Refresh and apply style guide
1572 - Improve indentation
1573 - Refresh and apply style guide
1575 - Stop bothering people with Windows XP
1576 - Help with platform compatibility
1577 - Update to Bookworm and apply style guide
1579 - Restructure summary and details
1580 - APT: disable warning about the non-free/non-free-firmware split
1581 - Remove duplicate bookworm-security source
1582 - Fix incompatibility with no-overview and window-list GNOME shell extensions
1583 - GNOME shell: add and enable no-overview extension version 13 (refs:
1585 - Bookworm: don't install gnome-screenshot any more (refs: tails/tails#20116)
1586 - Reformat with Black
1587 - Add diceware word lists Catalan, Italian, and Spanish
1588 - Allow images to overflow paragraphs
1589 - Improve instructions for screenshots
1590 - Update to the version of Disks in Bookworm
1591 - Update all symbolic icons
1592 - Update path to 'Show Hidden Files'
1593 - Update to the removal of GtkHash (#20114)
1594 - Update to the removal of the Files browser integration of mat2
1596 - Update to Tails 6.0
1597 - Update features apps and rewrite as flex
1598 - Use title capitalization
1600 - Add missing screenshot
1601 - Remove not-so-helpful GNOME doc
1602 - Stop mentioning dial-up modems as the future
1604 - Update to new system menu
1605 - Use more colored and contrasted icon
1606 - Use title capitalization
1608 - Differentiate system menu with and without Wi-Fi
1610 - Update insturctions to troubleshoot Wi-Fi
1611 - Change our style guide regarding screenshots
1612 - The Screen Reader now takes around 5 seconds to start
1613 - Replace News section from homepage with something better
1615 - Move FAQ to a better place
1619 - Point to more active and searchable channel
1620 - Remove not-so-frequent questions
1622 - Link to future work
1623 - Remove question that is answered in so many other ways
1624 - Replace youtube-dl by its new fork in Debian
1625 - Remove complicated advice
1626 - Deduplicate FAQ with requirements
1627 - Don't duplicate issues already documented elsewhere
1628 - Upstream issues has been fixed in Linux 5.9
1629 - Merge very similar issues
1630 - Delete very old issues that are probably not useful anymore
1632 - Delete unused images
1633 - Present XMPP options like Pidgin does
1634 - Remove very old migration instructions
1637 - Place image better on upgrade and clone scenarios
1638 - Apply Apple style guide
1641 - Remove not-so-useful icon
1642 - The Screen Reader now works in the Unsafe Browser
1643 - Merge and update screenshots
1646 - KeePassXC now has a cool documentation
1649 - The auto-type feature is hidden by default now
1650 - Remove outdated link
1656 - Add 'Status' column
1658 - Minimal update to 6.0
1660 - Update to 6.0 and refresh language
1661 - Mention on /install as well
1662 - Update to Debian 12
1664 - Improve placement of link
1665 - Refresh language and simplify
1666 - GitLab is the place to go
1667 - Explain better the real-world implications of cold boot attacks
1669 - It's not only about the source code
1673 - Simplify and improve language
1674 - Link to historical landmark
1675 - Small language, link, and formatting improvements
1678 - Build system: install po4a 0.62-1 from bullseye
1679 - Build system: enable bookworm-{backports,updates}
1680 - Build system: bump APT snapshots to ones containing
1681 bookworm-{backports,updates}
1682 - Revert "Merge /lib/firmware → /usr/lib/firmware (refs: tails/tails#20075)"
1683 - Build system: bump RAM to avoid OOM during mksquashfs (refs: tails/tails#20085)
1684 - Build system: drop -backports and -updates APT sources from builder
1685 - Build system: bump APT snapshots while migrating to Bookworm
1686 - Build system: upgrade builder basebox to Debian Bookworm (refs:
1688 - Enable GNOME's auto-mounting of pluggable storage (refs: tails/tails#15900)
1691 - Remove old migration note
1692 - Fix vertical alignment
1694 - Fix vertical alignment
1695 - Align first section title on the left
1696 - Reformat with black
1697 - tails-about: remove unused import
1698 - tails-about: remove "Tails developers" noise to match design
1699 - tails-about: fix grammar to match design
1700 - Remove duplicate Bookworm APT sources
1701 - fix indention to please rubocop.
1702 - Test suite: fix Rubocop violations
1703 - Reintroduce changes to feature/bookworm lost in merge conflict resolution vs
1705 - VERSION is not only a number.
1706 - Use regex to get infos out of os-release.
1707 - Unreleased versions don't have a release date.
1708 - rename misleading functionname.
1709 - Add reference image for Update to 6.3~testoverlayfs
1710 - Link to the upstream version that matches Bookworm's Golang
1711 - remove unsused entries in auto/config
1712 - Add reference image for upgrade to 6.2~testoverlayfs.
1713 - Test suite: make test file name & content match the version
1714 - Fix version determine in os-release.
1715 - Bump test iuk version as we now use os-release to get the Tails version.
1716 - get_release_Date is a function.
1717 - Revert changes on config/binary_rootfs/squashfs.sort
1718 - Remove last occurence of /etc/amnesia/version
1719 - make shellcheck happy.
1720 - read TAILS_SOURCE_DATE_EPOCH from os-release to set minimum date.
1721 - try to fix automatic_update test
1723 - Use built-in plattform.freedesktop_os_release to parse os_release.
1724 - Next attempt to fix test suite.
1725 - fix autotest suite.
1726 - import needed Dict from typing.
1727 - make tests to use os-release.
1728 - fix wrong syntax in shell.
1729 - Add deprecation waring to tails-version.
1730 - Get rid of /etc/amnesia/version
1731 - Improve the tails-about dialog to easier identify nighly build.
1732 - Revert "OnionShare: enable "public" mode by default"
1733 - Test suite: drop `showingOnly: true` parameters added in feature/bookworm
1734 - status-menu-helper Gnome Shell extension: port to Gnome 43 for Tails/Bookworm
1735 - Test suite: fix race condition
1736 - Test suite: fix race condition
1737 - usbguard: allow all devices that are already connected when the daemon starts
1738 - Replace busy-wait with proper systemd dependency, made possible by Bookworm
1739 - Reject new USB devices plugged while the screen is locked
1740 - GNOME Shell extensions: declare compatibility with Bookworm
1741 - Increase the chances we successfully unmount all the relevant filesystems on
1743 - Update mountpoint path for merged-/usr
1744 - Update live-build submodule
1745 - Test suite: fix fillram script for Bookworm
1746 - Test suite: update expected images
1747 - Test suite: update expected image
1748 - Update list of custom packages for Bookworm and bring back the check
1749 - Enable the feature-bookworm APT overlay
1750 - live-build: avoid deprecated "apt-key add", instead drop keys in
1751 /etc/apt/trusted.gpg.d
1752 - Test suite: update Backup feature for Bookworm
1753 - Test suite: allow specifying the polkit dialog title
1754 - Test suite: Bookworm's hwclock does not accept relative dates anymore
1755 - Fix buggy merge conflict resolution
1756 - AppArmor: add canonical merged-/usr path to HOMEDIRS variable
1757 - Test suite: start porting Pidgin tests to Bookworm
1758 - Test suite: update SFTP test for Bookworm
1759 - Test suite: port SSH tests to Dogtail
1760 - Test suite: update expected AppArmor denial messages for merged-/usr
1761 - Test suite: update default set of groups for Bookworm
1762 - Test suite: use Dogtail for Totem "not allowed to open"
1763 - Test suite: update expected images
1764 - Revert "Test suite: remove now unused code"
1765 - Update AppArmor policy for merged-/usr
1766 - Test suite: update most Evince tests for Bookworm and port them to Dogtail
1767 - Test suite: make method a tiny bit more generic
1768 - Test suite: remove obsolete tag
1769 - Test suite: update screenshot test for Bookworm
1770 - Test suite: update network connect/disconnect for Bookworm
1772 - Test suite: update VeraCrypt tests for Bookworm and port them to Dogtail
1773 - Test suite: add a couple Dogtail convenience methods
1774 - Test suite: factorize
1775 - Test suite: update expected image
1776 - Keep installing dbus-x11: needed to start the Root Terminal with pkexec
1777 - Update PolicyKit admin user configuration to new rules language
1778 - Test suite: use Dogtail for the PolicyKit prompt and to wait for GNOME Terminal
1779 - Test suite: use Dogtail to check zenity dialog
1780 - Test suite: use better Gherkin phrasing
1781 - Fix Unsafe Browser's name resolution
1782 - Test suite: use Dogtail to check the LAN web server message in the Unsafe
1784 - Test suite: make a couple test methods compatible with the Unsafe Browser
1785 - Test suite: remove obsolete comment
1786 - Test suite: remove now unused code
1787 - Test suite: start the Unsafe Browser using "gio launch"
1788 - Test suite: Paste bridge via Dogtail
1789 - Test suite: update expected images
1790 - partitioning: ensure the system partition remains an ESP
1791 - partitioning: copy file needed by mlabel, that was split out on Bookworm
1792 - Test suite: update expected denial log message for merged-/usr
1793 - Test suite: update expected images
1794 - Test suite: update expected images
1795 - OnionShare: enable "public" mode by default
1796 - Revert "Temporarily revert "hotfix: refresh Thunderbird patch""
1797 - Update live-build submodule
1798 - OnionShare: use ~/Downloads as the "receive files" directory
1799 - OnionShare: update config file to 2.6, in particular to auto-connect to Tor
1800 - OnionShare: update onion-grater rules for 2.6
1801 - Make AppArmor logs a little bit less noisy
1802 - OnionShare: run as native Wayland
1803 - OnionShare: update AppArmor profile for Bookworm
1804 - Import OnionShare .desktop file and icon
1805 - Adjust to match renaming of OnionShare executables
1806 - Update the list of backends in the usr.sbin.cups AppArmor profile for Bookworm
1807 - Bump APT snapshots for the Vagrant box
1808 - Test suite: update expected pictures
1809 - Disable signing of DKMS modules
1810 - Drop hook that's obsolete on a merged-/usr system
1811 - Adjust for merged-/usr
1812 - live-build: fix breakage with merged-/usr
1813 - Switch to merged-/usr (aka. usrmerge)
1814 - Remove obsolete blocker
1815 - Keep installing xxd
1816 - Remove Debian logo in unlock screen
1817 - Desktop icons: don't display anything besides our shortcuts and the Trash
1818 - Display Desktop icons at standard size
1819 - Keep installing wpasupplicant
1820 - Drop fake obfs4proxy package: not needed anymore
1821 - Temporarily revert "hotfix: refresh Thunderbird patch"
1822 - Keep installing gnome-keyring
1823 - Remove obsolete pref
1824 - Adjust to gnome-shell-extension-desktop-icons-ng
1825 - Temporarily disable initramfs size check
1826 - Convert our polkit rules to the new JavaScript format
1827 - Update expected /etc/passwd and /etc/group
1828 - Make it easier to copy the new file
1829 - Fix error reporting
1830 - Update test suite & design doc: we don't ship dhclient since Tails 5.0
1831 - Temporarily disable custom packages check
1832 - Explicitly set hasOverview and showWelcomeDialog
1833 - Adjust to renamed GNOME Shell menu
1834 - systemd: Use both name and description in unit status messages
1835 - Drop support for reading encrypted DVDs
1836 - Upgrade the Linux kernel to 6.1.27-1 from Bookworm
1837 - Update for Bookworm
1838 - Adjust path for Bookworm
1839 - Fix UID & GID stability
1840 - Remove obsolete patch
1841 - Refresh and unfuzzy patches
1842 - Upgrade to Linux 6.1.25-1 (devel branch)
1843 - Revert "Workaround missing APT snapshots."
1844 - Revert "Test suite: disable bridge QR code automated tests"
1845 - Install the Linux kernel from Debian Bookworm
1846 - Refresh tails-000-standard.list packages list for Bookworm
1847 - Enable non-free-firmware APT component for the Bookworm APT sources
1848 - Follow package rename: gnomes-themes-standard → gnome-themes-extra
1849 - Replace exfat-fuse with in-kernel implementation + exfatprogs
1850 - Migrate to gnome-shell-extension-desktop-icons-ng
1851 - Don't try to install nautilus-gtkhash: not available in Bookworm
1852 - Don't try to install nautilus-wipe: not available in Bookworm
1853 - Don't try to install obsolete crda package
1854 - Workaround missing APT snapshots.
1855 - Rubocop: target Bookworm's Ruby version
1856 - pre-commit-translation: remove obsolete script
1857 - GitLab CI: use Debian Bookworm image by default
1858 - Support Bookworm host system to run our test suite
1859 - Require a Bullseye host system to build Tails
1860 - Reference issue that tracks this "XXX" comment
1861 - Persistent Storage: enable localized word lists included in Bookworm
1862 - Remove obsolete detail in comment
1863 - Upgrade to Debian 12 (Bookworm)
1864 - run_test_suite: run all tests on feature/bookworm
1866 -- Tails developers <tails@boum.org> Mon, 26 Feb 2024 16:11:09 +0100
1868 tails (6.0~rc1) unstable; urgency=medium
1870 * Tails Cloner: don't attempt to unmount the target device twice
1874 - tails-installer fails to install to already mounted devices (tails/tails#20139)
1877 - Tails Cloner: don't attempt to unmount the target device twice (refs:
1880 * Install python3-pyqt5 to fix Electrum not starting (tails/tails!1357)
1883 - Electrum does not start in Tails 6.0 (tails/tails#20079)
1886 - Install python3-pyqt5 to fix Electrum not starting
1888 * Fix spawn_tps_frontend (tails/tails!1368)
1891 - tps-frontend disappears while setting up Persistent Storage for Additional Software (tails/tails#20141)
1894 - Fix inter-process communication based on non-zero exit codes
1895 - Revert "Avoid asp-post-apt hooks running forever in some cases"
1896 - Revert "Fix failure when running multiple asp-post-apt hooks in parallel"
1897 - Sync' both Ruff configurations
1899 - Use long option name
1900 - Use subprocess.check_call with gtk-launch instead of subprocess.Popen
1901 - Additional Software: Fix app hanging if Persistent Storage is not created
1902 - Use subprocess.check_call instead of subprocess.Popen
1903 - Avoid asp-post-apt hooks running forever in some cases
1904 - Reduce memory used by asp-post-apt hook
1905 - Fix failure when running multiple asp-post-apt hooks in parallel
1906 - Set SyslogIdentifier with systemd-run
1909 - Run ruff --fix on modified files
1910 - Fix spawn_tps_frontend
1911 - Don't use stderr=subprocess.PIPE with subprocess.Popen
1913 * Fix broken tests for feature/bookworm (tails/tails!1367)
1916 - Adjust Bookworm test suite to !1166 (tails/tails#19738)
1919 - Test suite: fixup incorrect suggestion that was applied
1920 - Test suite: wait for GNOME authentication dialog to disappear
1921 - Test suite: fix comment
1922 - Test suite: use grabFocus() instead of worse code
1923 - Test suite: refactor
1925 - Test suite: deal with GNOME authentication prompt getting in the way
1926 - Test suite: fix Nautilus vs our showingOnly default (refs: tails/tails#19738)
1927 - Test suite: bump image for Bookworm
1928 - Test suite: deal with GNOME authentication prompt getting in the way
1929 - Test suite: improve step name
1930 - Test suite: don't reinvent the wheel
1931 - Test suite: don't use hardcoded passphrase
1932 - Test suite: adapt a bunch of steps to GNOME auto-mounting removable media
1933 (refs: tails/tails#15900)
1934 - Test suite: add a handy mountpoint() method
1935 - Test suite: support multiple mountpoints in parse_udisksctl_info()
1936 - Test suite: use different method when filling storage devices until they are
1938 - Test suite: be more precise when determining available space in mountpoint
1940 * Fix Ruff policy violations in files modified on feature/bookworm, take 2
1944 - Fix Ruff & Rubocop policy violations in files modified on feature/bookworm (tails/tails#20124)
1949 - Reformat with Black
1950 - Trust our callers to not pass us untrusted input
1951 - Accept manual handling of subprocess.run result
1952 - Make check more generic
1954 - Automatically fix Ruff UP031
1955 - Automatically fix Ruff UP022
1956 - Automatically fix Ruff PIE790
1958 * Fix Ruff & Rubocop policy violations in files modified on feature/bookworm
1962 - Fix Ruff & Rubocop policy violations in files modified on feature/bookworm (tails/tails#20124)
1965 - rubocop --autocorrect
1966 - Silence Ruff false positive
1967 - Silence Ruff false positive
1969 - Automatically fix UP032 "Use f-string instead of `format` call"
1970 - Automatically fix UP024 "Replace aliased errors with `OSError`"
1972 * Use the Tails logo as the user icon (tails/tails!1358)
1975 - Add a user icon (tails/tails#20078)
1978 - Use our logo as the user icon
1980 * Replace Gedit with GNOME Text Editor (tails/tails!1355)
1983 - Migrate from gedit to gnome-text-editor (tails/tails#19651)
1986 - Test suite: adapt to the migration from Gedit to GNOME Text editor
1987 - Test suite: update example in comment
1988 - Replace Gedit with GNOME Text Editor
1990 * remove "custom" keyboard layout from greeter (tails/tails!1354)
1993 - Remove "A user-defined custom Layout" option as keyboard layout (tails/tails#20109)
1996 - Reformat with Black
1999 - Ignore false positive
2000 - remove "custom" keyboard layout from greeter
2002 * Add full commit ID to /etc/os-release (tails/tails!1352)
2005 - Add full commit ID to /etc/os-release
2007 * Add diceware word lists Catalan, Italian, and Spanish (tails/tails!1340)
2010 - Have diceware word lists for each of our tier-1 languages (tails/tails#20014)
2013 - Reformat with Black
2014 - Add diceware word lists Catalan, Italian, and Spanish
2016 * Upgrade Vagrant basebox to Debian Bookworm (tails/tails!1323)
2019 - Upgrade Vagrant basebox to Bookworm (tails/tails#19562)
2022 - Build system: install po4a 0.62-1 from bullseye
2023 - Build system: enable bookworm-{backports,updates}
2024 - Build system: bump APT snapshots to ones containing
2025 bookworm-{backports,updates}
2026 - Build system: bump RAM to avoid OOM during mksquashfs (refs: tails/tails#20085)
2027 - Build system: drop -backports and -updates APT sources from builder
2028 - Build system: bump APT snapshots while migrating to Bookworm
2029 - Build system: upgrade builder basebox to Debian Bookworm (refs:
2032 * Improve the tails-about dialog to easier identify nightly build
2036 - Make it easier to identify which nightly build is running (tails/tails#17543)
2039 - tails-about: remove unused import
2040 - tails-about: remove "Tails developers" noise to match design
2041 - tails-about: fix grammar to match design
2042 - fix indention to please rubocop.
2043 - VERSION is not only a number.
2044 - Use regex to get infos out of os-release.
2045 - Unreleased versions don't have a release date.
2046 - rename misleading functionname.
2047 - Add reference image for Update to 6.3~testoverlayfs
2048 - remove unsused entries in auto/config
2049 - Add reference image for upgrade to 6.2~testoverlayfs.
2050 - Test suite: make test file name & content match the version
2051 - Fix version determine in os-release.
2052 - Bump test iuk version as we now use os-release to get the Tails version.
2053 - get_release_Date is a function.
2054 - Revert changes on config/binary_rootfs/squashfs.sort
2055 - Remove last occurence of /etc/amnesia/version
2056 - make shellcheck happy.
2057 - read TAILS_SOURCE_DATE_EPOCH from os-release to set minimum date.
2058 - try to fix automatic_update test
2060 - Use built-in plattform.freedesktop_os_release to parse os_release.
2061 - Next attempt to fix test suite.
2062 - fix autotest suite.
2063 - import needed Dict from typing.
2064 - make tests to use os-release.
2065 - fix wrong syntax in shell.
2066 - Add deprecation waring to tails-version.
2067 - Get rid of /etc/amnesia/version
2068 - Improve the tails-about dialog to easier identify nighly build.
2070 * Release process adapt for major version bumps (tails/tails!1192)
2073 - Clarify PREVIOUS_STABLE_VERSION when switching to new debian series
2077 - Release process: migrate calculation to rm-config so we can automate some steps
2078 - Release process: fix grammar now that there can be multiple test IUKs (refs:
2081 - Release process, QA: deal with which versions to test Incremental Upgrades from
2083 - Verify that the test UDFs we generate are correct before publishing.
2084 - Release process: publish test UDFs for both previous stable version and (if
2085 any) the last alpha/beta/RC when releasing a major version
2087 * Upgrade to Debian 12 (Bookworm) (tails/tails!1119)
2089 Upgrades most packages
2092 - Tails 6.0 based on Debian 12 (Bookworm) (tails/tails#19477)
2095 - Fix inter-process communication based on non-zero exit codes
2096 - Revert "Avoid asp-post-apt hooks running forever in some cases"
2097 - Test suite: fixup incorrect suggestion that was applied
2098 - Test suite: wait for GNOME authentication dialog to disappear
2099 - Test suite: fix comment
2100 - Revert "Fix failure when running multiple asp-post-apt hooks in parallel"
2101 - Sync' both Ruff configurations
2103 - Use long option name
2104 - Use subprocess.check_call with gtk-launch instead of subprocess.Popen
2105 - Additional Software: Fix app hanging if Persistent Storage is not created
2106 - Use subprocess.check_call instead of subprocess.Popen
2107 - Avoid asp-post-apt hooks running forever in some cases
2108 - Reduce memory used by asp-post-apt hook
2109 - Fix failure when running multiple asp-post-apt hooks in parallel
2110 - Set SyslogIdentifier with systemd-run
2113 - Run ruff --fix on modified files
2114 - Fix spawn_tps_frontend
2115 - Don't use stderr=subprocess.PIPE with subprocess.Popen
2116 - Test suite: use grabFocus() instead of worse code
2117 - Test suite: refactor
2119 - Test suite: deal with GNOME authentication prompt getting in the way
2121 - Test suite: fix Nautilus vs our showingOnly default (refs: tails/tails#19738)
2122 - Test suite: bump image for Bookworm
2123 - Test suite: deal with GNOME authentication prompt getting in the way
2124 - Test suite: improve step name
2125 - Reformat with Black
2128 - Ignore false positive
2129 - remove "custom" keyboard layout from greeter
2131 - Test suite: don't reinvent the wheel
2132 - Test suite: don't use hardcoded passphrase
2133 - Update to Bookworm
2134 - Use our logo as the user icon
2135 - Stop avertizing share.riseup.net
2136 - Use consistent terminology and title capitalization
2137 - Improve style of nested blocks
2140 - Use consistent terminology
2141 - Explain better what is the Super key
2142 - Document known issues
2143 - Remove not-so-useful link
2144 - Improve phrase and style guide
2145 - Don't use 'your' when talking about public computers, mostly
2146 - Replace encryption_and_privacy/virtual_keyboard by a note
2148 - Test suite: adapt a bunch of steps to GNOME auto-mounting removable media
2149 (refs: tails/tails#15900)
2150 - Test suite: add a handy mountpoint() method
2151 - Test suite: support multiple mountpoints in parse_udisksctl_info()
2152 - Test suite: use different method when filling storage devices until they are
2154 - Reformat with Black
2155 - Trust our callers to not pass us untrusted input
2156 - Accept manual handling of subprocess.run result
2157 - Make check more generic
2159 - Automatically fix Ruff UP031
2160 - Automatically fix Ruff UP022
2161 - Automatically fix Ruff PIE790
2164 - remove duplicate word
2165 - Remove useless if statement
2166 - Test suite: be more precise when determining available space in mountpoint
2167 - Test suite: adapt to the migration from Gedit to GNOME Text editor
2168 - Test suite: update example in comment
2169 - Replace Gedit with GNOME Text Editor
2170 - rubocop --autocorrect
2171 - Silence Ruff false positive
2172 - Silence Ruff false positive
2174 - Automatically fix UP032 "Use f-string instead of `format` call"
2175 - Automatically fix UP024 "Replace aliased errors with `OSError`"
2176 - Tails Cloner: don't attempt to unmount the target device twice (refs:
2178 - Test suite: fix scenario where Nautilus misbehaves with our showingOnly default
2179 (refs: tails/tails#19738)
2180 - Gmail in Tails is easier now!
2182 - Update to Bookworm
2183 - Capitalize 'Lock Screen'
2184 - Install python3-pyqt5 to fix Electrum not starting
2185 - Test suite: bump image
2186 - Install pipewire-media-session to repair GNOME's screen recording capability
2187 (refs: tails/tails#19441)
2189 - Mention OnionShare in faq#onion-service
2190 - Update to OnionShare 2.6
2191 - Cover the case when screeshots are too big
2192 - Add full commit ID to /etc/os-release
2193 - Document Dark Theme and Night Light modes
2194 - Fix capitalization
2195 - Update to #15900 and #15767
2196 - Document the fix for the no-overview GNOME Shell extension
2198 - Remove unused icon
2199 - Update screenshots
2200 - Fix icon reference
2201 - Add CSS for Windows commands
2202 - Add missing screenshot
2205 - Refresh and apply style guide
2206 - Improve indentation
2207 - Refresh and apply style guide
2209 - Stop bothering people with Windows XP
2210 - Help with platform compatibility
2211 - Update to Bookworm and apply style guide
2213 - Restructure summary and details
2214 - APT: disable warning about the non-free/non-free-firmware split
2215 - Remove duplicate bookworm-security source
2216 - Fix incompatibility with no-overview and window-list GNOME shell extensions
2217 - GNOME shell: add and enable no-overview extension version 13 (refs:
2219 - Bookworm: don't install gnome-screenshot any more (refs: tails/tails#20116)
2220 - Reformat with Black
2221 - Add diceware word lists Catalan, Italian, and Spanish
2222 - Allow images to overflow paragraphs
2223 - Improve instructions for screenshots
2224 - Update to the version of Disks in Bookworm
2225 - Update all symbolic icons
2226 - Update path to 'Show Hidden Files'
2227 - Update to the removal of GtkHash (#20114)
2228 - Update to the removal of the Files browser integration of mat2
2230 - Update to Tails 6.0
2231 - Update features apps and rewrite as flex
2232 - Use title capitalization
2234 - Add missing screenshot
2235 - Remove not-so-helpful GNOME doc
2236 - Stop mentioning dial-up modems as the future
2238 - Update to new system menu
2239 - Use more colored and contrasted icon
2240 - Use title capitalization
2242 - Differentiate system menu with and without Wi-Fi
2244 - Update insturctions to troubleshoot Wi-Fi
2245 - Change our style guide regarding screenshots
2246 - The Screen Reader now takes around 5 seconds to start
2247 - Replace News section from homepage with something better
2249 - Move FAQ to a better place
2253 - Point to more active and searchable channel
2254 - Remove not-so-frequent questions
2256 - Link to future work
2257 - Remove question that is answered in so many other ways
2258 - Replace youtube-dl by its new fork in Debian
2259 - Remove complicated advice
2260 - Deduplicate FAQ with requirements
2261 - Don't duplicate issues already documented elsewhere
2262 - Upstream issues has been fixed in Linux 5.9
2263 - Merge very similar issues
2264 - Delete very old issues that are probably not useful anymore
2266 - Delete unused images
2267 - Present XMPP options like Pidgin does
2268 - Remove very old migration instructions
2271 - Place image better on upgrade and clone scenarios
2272 - Apply Apple style guide
2275 - Remove not-so-useful icon
2276 - The Screen Reader now works in the Unsafe Browser
2277 - Merge and update screenshots
2280 - KeePassXC now has a cool documentation
2283 - The auto-type feature is hidden by default now
2284 - Remove outdated link
2290 - Add 'Status' column
2292 - Minimal update to 6.0
2294 - Update to 6.0 and refresh language
2295 - Mention on /install as well
2296 - Update to Debian 12
2298 - Improve placement of link
2299 - Refresh language and simplify
2300 - GitLab is the place to go
2301 - Explain better the real-world implications of cold boot attacks
2303 - It's not only about the source code
2307 - Simplify and improve language
2308 - Link to historical landmark
2309 - Small language, link, and formatting improvements
2312 - Build system: install po4a 0.62-1 from bullseye
2313 - Build system: enable bookworm-{backports,updates}
2314 - Build system: bump APT snapshots to ones containing
2315 bookworm-{backports,updates}
2316 - Revert "Merge /lib/firmware → /usr/lib/firmware (refs: tails/tails#20075)"
2317 - Build system: bump RAM to avoid OOM during mksquashfs (refs: tails/tails#20085)
2318 - Build system: drop -backports and -updates APT sources from builder
2319 - Build system: bump APT snapshots while migrating to Bookworm
2320 - Build system: upgrade builder basebox to Debian Bookworm (refs:
2322 - Enable GNOME's auto-mounting of pluggable storage (refs: tails/tails#15900)
2325 - Remove old migration note
2326 - Fix vertical alignment
2328 - Fix vertical alignment
2329 - Align first section title on the left
2330 - Reformat with black
2331 - tails-about: remove unused import
2332 - tails-about: remove "Tails developers" noise to match design
2333 - tails-about: fix grammar to match design
2334 - Remove duplicate Bookworm APT sources
2335 - fix indention to please rubocop.
2336 - Test suite: fix Rubocop violations
2337 - Reintroduce changes to feature/bookworm lost in merge conflict resolution vs
2339 - VERSION is not only a number.
2340 - Use regex to get infos out of os-release.
2341 - Unreleased versions don't have a release date.
2342 - rename misleading functionname.
2343 - Add reference image for Update to 6.3~testoverlayfs
2344 - Link to the upstream version that matches Bookworm's Golang
2345 - remove unsused entries in auto/config
2346 - Add reference image for upgrade to 6.2~testoverlayfs.
2347 - Test suite: make test file name & content match the version
2348 - Fix version determine in os-release.
2349 - Bump test iuk version as we now use os-release to get the Tails version.
2350 - get_release_Date is a function.
2351 - Revert changes on config/binary_rootfs/squashfs.sort
2352 - Remove last occurence of /etc/amnesia/version
2353 - make shellcheck happy.
2354 - read TAILS_SOURCE_DATE_EPOCH from os-release to set minimum date.
2355 - try to fix automatic_update test
2357 - Use built-in plattform.freedesktop_os_release to parse os_release.
2358 - Next attempt to fix test suite.
2359 - fix autotest suite.
2360 - import needed Dict from typing.
2361 - make tests to use os-release.
2362 - fix wrong syntax in shell.
2363 - Add deprecation waring to tails-version.
2364 - Get rid of /etc/amnesia/version
2365 - Improve the tails-about dialog to easier identify nighly build.
2366 - Revert "OnionShare: enable "public" mode by default"
2367 - Test suite: drop `showingOnly: true` parameters added in feature/bookworm
2368 - status-menu-helper Gnome Shell extension: port to Gnome 43 for Tails/Bookworm
2369 - Test suite: fix race condition
2370 - Test suite: fix race condition
2371 - usbguard: allow all devices that are already connected when the daemon starts
2372 - Replace busy-wait with proper systemd dependency, made possible by Bookworm
2373 - Reject new USB devices plugged while the screen is locked
2374 - GNOME Shell extensions: declare compatibility with Bookworm
2375 - Increase the chances we successfully unmount all the relevant filesystems on
2377 - Update mountpoint path for merged-/usr
2378 - Update live-build submodule
2379 - Test suite: fix fillram script for Bookworm
2380 - Test suite: update expected images
2381 - Test suite: update expected image
2382 - Update list of custom packages for Bookworm and bring back the check
2383 - Enable the feature-bookworm APT overlay
2384 - live-build: avoid deprecated "apt-key add", instead drop keys in
2385 /etc/apt/trusted.gpg.d
2386 - Test suite: update Backup feature for Bookworm
2387 - Test suite: allow specifying the polkit dialog title
2388 - Test suite: Bookworm's hwclock does not accept relative dates anymore
2389 - Fix buggy merge conflict resolution
2390 - AppArmor: add canonical merged-/usr path to HOMEDIRS variable
2391 - Test suite: start porting Pidgin tests to Bookworm
2392 - Test suite: update SFTP test for Bookworm
2393 - Test suite: port SSH tests to Dogtail
2394 - Test suite: update expected AppArmor denial messages for merged-/usr
2395 - Test suite: update default set of groups for Bookworm
2396 - Test suite: use Dogtail for Totem "not allowed to open"
2397 - Test suite: update expected images
2398 - Revert "Test suite: remove now unused code"
2399 - Update AppArmor policy for merged-/usr
2400 - Test suite: update most Evince tests for Bookworm and port them to Dogtail
2401 - Test suite: make method a tiny bit more generic
2402 - Test suite: remove obsolete tag
2403 - Test suite: update screenshot test for Bookworm
2404 - Test suite: update network connect/disconnect for Bookworm
2406 - Test suite: update VeraCrypt tests for Bookworm and port them to Dogtail
2407 - Test suite: add a couple Dogtail convenience methods
2408 - Test suite: factorize
2409 - Test suite: update expected image
2410 - Keep installing dbus-x11: needed to start the Root Terminal with pkexec
2411 - Update PolicyKit admin user configuration to new rules language
2412 - Test suite: use Dogtail for the PolicyKit prompt and to wait for GNOME Terminal
2413 - Test suite: use Dogtail to check zenity dialog
2414 - Test suite: use better Gherkin phrasing
2415 - Fix Unsafe Browser's name resolution
2416 - Test suite: use Dogtail to check the LAN web server message in the Unsafe
2418 - Test suite: make a couple test methods compatible with the Unsafe Browser
2419 - Test suite: remove obsolete comment
2420 - Test suite: remove now unused code
2421 - Test suite: start the Unsafe Browser using "gio launch"
2422 - Test suite: Paste bridge via Dogtail
2423 - Test suite: update expected images
2424 - partitioning: ensure the system partition remains an ESP
2425 - partitioning: copy file needed by mlabel, that was split out on Bookworm
2426 - Test suite: update expected denial log message for merged-/usr
2427 - Test suite: update expected images
2428 - Test suite: update expected images
2429 - OnionShare: enable "public" mode by default
2430 - Revert "Temporarily revert "hotfix: refresh Thunderbird patch""
2431 - Update live-build submodule
2432 - OnionShare: use ~/Downloads as the "receive files" directory
2433 - OnionShare: update config file to 2.6, in particular to auto-connect to Tor
2434 - OnionShare: update onion-grater rules for 2.6
2435 - Make AppArmor logs a little bit less noisy
2436 - OnionShare: run as native Wayland
2437 - OnionShare: update AppArmor profile for Bookworm
2438 - Import OnionShare .desktop file and icon
2439 - Adjust to match renaming of OnionShare executables
2440 - Update the list of backends in the usr.sbin.cups AppArmor profile for Bookworm
2441 - Bump APT snapshots for the Vagrant box
2442 - Test suite: update expected pictures
2443 - Disable signing of DKMS modules
2444 - Drop hook that's obsolete on a merged-/usr system
2445 - Adjust for merged-/usr
2446 - live-build: fix breakage with merged-/usr
2447 - Switch to merged-/usr (aka. usrmerge)
2448 - Remove obsolete blocker
2449 - Keep installing xxd
2450 - Remove Debian logo in unlock screen
2451 - Desktop icons: don't display anything besides our shortcuts and the Trash
2452 - Display Desktop icons at standard size
2453 - Keep installing wpasupplicant
2454 - Drop fake obfs4proxy package: not needed anymore
2455 - Temporarily revert "hotfix: refresh Thunderbird patch"
2456 - Keep installing gnome-keyring
2457 - Remove obsolete pref
2458 - Adjust to gnome-shell-extension-desktop-icons-ng
2459 - Temporarily disable initramfs size check
2460 - Convert our polkit rules to the new JavaScript format
2461 - Update expected /etc/passwd and /etc/group
2462 - Make it easier to copy the new file
2463 - Fix error reporting
2464 - Update test suite & design doc: we don't ship dhclient since Tails 5.0
2465 - Temporarily disable custom packages check
2466 - Explicitly set hasOverview and showWelcomeDialog
2467 - Adjust to renamed GNOME Shell menu
2468 - systemd: Use both name and description in unit status messages
2469 - Drop support for reading encrypted DVDs
2470 - Upgrade the Linux kernel to 6.1.27-1 from Bookworm
2471 - Update for Bookworm
2472 - Adjust path for Bookworm
2473 - Fix UID & GID stability
2474 - Remove obsolete patch
2475 - Refresh and unfuzzy patches
2476 - Upgrade to Linux 6.1.25-1 (devel branch)
2477 - Revert "Workaround missing APT snapshots."
2478 - Revert "Test suite: disable bridge QR code automated tests"
2479 - Install the Linux kernel from Debian Bookworm
2480 - Refresh tails-000-standard.list packages list for Bookworm
2481 - Enable non-free-firmware APT component for the Bookworm APT sources
2482 - Follow package rename: gnomes-themes-standard → gnome-themes-extra
2483 - Replace exfat-fuse with in-kernel implementation + exfatprogs
2484 - Migrate to gnome-shell-extension-desktop-icons-ng
2485 - Don't try to install nautilus-gtkhash: not available in Bookworm
2486 - Don't try to install nautilus-wipe: not available in Bookworm
2487 - Don't try to install obsolete crda package
2488 - Workaround missing APT snapshots.
2489 - Rubocop: target Bookworm's Ruby version
2490 - pre-commit-translation: remove obsolete script
2491 - GitLab CI: use Debian Bookworm image by default
2492 - Support Bookworm host system to run our test suite
2493 - Require a Bullseye host system to build Tails
2494 - Reference issue that tracks this "XXX" comment
2495 - Persistent Storage: enable localized word lists included in Bookworm
2496 - Remove obsolete detail in comment
2497 - Upgrade to Debian 12 (Bookworm)
2498 - run_test_suite: run all tests on feature/bookworm
2500 -- Tails developers <tails@boum.org> Wed, 31 Jan 2024 20:56:28 +0100
2502 tails (5.22) unstable; urgency=medium
2504 * Resolve "Upgrade to Tor Browser based on ESR 115.7" (tails/tails!1366)
2507 - Upgrade to Tor Browser based on ESR 115.7 (tails/tails#20060)
2510 - Fetch Tor Browser from our own archive
2511 - Upgrade Tor Browser to 13.0.9
2513 * replace bookworm-updates with bookworm-security and upgrade kernel to 6.1.69
2517 - Re-enable bookworm-security APT source (tails/tails#20010)
2518 - Upgrade to Linux 6.1.69 (DSA 5593-1) (tails/tails#20121)
2521 - replace bookworm-updates with bookworm-security and update kernel
2523 * htpdate: privacyinternational.org -> securitylab.amnesty.org (tails/tails!1370)
2526 - https-get-expired failing for https://www.privacyinternational.org
2530 - black reformatting
2531 - refer to design in source code
2532 - htpdate: privacyinternational.org -> securitylab.amnesty.org
2534 * Don't try to create a Persistent Storage on a device that already has 2
2535 partitions (tails/tails!1348)
2538 - Don't try to create a Persistent Storage on a device that already has 2
2539 partitions (tails/tails#20000)
2542 - Disable error prone Ruff rule
2543 - Revert error prone linting
2545 - Bring back type annotation lost by linting
2546 - Make indentation consistent
2548 - Reformat with black
2550 - Fix check for too many partitions
2551 - Remove unused import
2552 - Linting prompted by, and done by, ruff
2553 - Linting prompted by the ruff-changed-files CI job
2554 - Document limitation
2555 - Reformat with black
2556 - Explain the user that we can't create a Persistent Storage on a device that
2557 already has 2 partitions
2558 - Improve name of widget
2559 - Don't try to create a Persistent Storage on a device that already has 2
2561 - Fix buggy refactoring
2562 - Reformat with black
2563 - refactor InvalidBootDeviceErrorType
2564 - Convey reason why the boot device is not supported from the tps backend to the
2567 * Check and attempt to safely repair the Persistent Storage filesystem before
2568 mounting it (tails/tails!1351)
2571 - Reformat with black
2572 - Check and safely attempt to repair Persistent Storage filesystem before
2575 * Bugfix: Additional Software was sometimes left unconfigured after creating
2576 Persistent Storage (tails/tails!1350)
2579 - Additional Software sometimes left unconfigured after creating Persistent
2580 Storage (tails/tails#19926)
2583 - Bugfix: Additional Software was sometimes left unconfigured after creating
2586 * Don't try to unlock or delete a Persistent Storage that's on a read-only USB
2587 stick (tails/tails!1349)
2590 - tpsd should not try to unlock or delete a Persistent Storage that's on a read-
2591 only USB stick (tails/tails#20024)
2595 - Fix ordering of widgets
2596 - Reformat with black
2598 - Implement updated UI phrasing
2600 - Let Ruff fix the issues that it reported and can fix itself
2601 - Don't try to delete a Persistent Storage that's on a read-only USB stick
2602 - tpsd: expose whether the Persistent Storage can be deleted
2603 - Welcome Screen: link to help when we don't allow unlocking Persistent Storage
2604 on a read-only device
2605 - Save UI file with current Glade
2607 - Reformat with black
2608 - Lint files changed by this MR
2609 - Add missing space in log message
2610 - Let Ruff fix the issues that it reported and can fix itself
2611 - Welcome Screen: don't allow unlocking Persistent Storage on a read-only device
2612 - tps: identify when the device is read-only and we should not try to unlock it
2613 - Remove unused imports
2615 * Resolve "Test suite often fails to grabFocus of the Persistent Storage
2616 passphrase entry" (tails/tails!1345)
2619 - Test suite often fails to grabFocus of the Persistent Storage passphrase entry
2623 - Test suite: log when applying workaround for #20054
2624 - Test suite: revolutionize code readability thanks to RuboCop
2625 - Test suite: appease RuboCop
2626 - Add forgotten closing parenthesis
2627 - Test suite: improve method name
2628 - Test suite: prefix #20054 logging to make all of it easier to grep from
2630 - Test suite: attempt to detect and work around tails/tails#20054
2631 - Move variable to where it is used
2633 * onion-grater: only log dropped stream/circ events when debugging is enabled...
2637 - onion-grater's "dropped restricted circuit event" is spammy and leaky
2641 - onion-grater: only log dropped stream/circ events when debugging is enabled
2642 (refs: tails/tails#20126)
2643 - onion-grater: fix typo
2645 * tor-browser uses local documentation (tails/tails!1341)
2648 - Tor Browser should open documentation links from local website when offline
2652 - ruff --fix + black
2653 - avoid tails.net.attack.er sneaking in
2654 - skip offline warning when url has been resolved
2656 - black reformatting
2657 - less globals, easier testing
2658 - urls we can't resolve are passed through
2659 - check if link is to tails website
2661 - fix argument parsing
2662 - FIX leftover shell interpolation
2663 - tor-browser uses local documentation
2664 - tor-browser reimplemented in Python3
2665 - refactor tails-documentation
2667 * ruff works for feature/bookworm, too (tails/tails!1339)
2670 - ruff-changed-files false positives in GitLab CI:
2671 origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME:?} is an unknown ref
2675 - make sure that the target branch is known
2677 * move actual URL outside of the translatable string (tails/tails!1337)
2680 - tails-report-disk-errors includes a translatable URLs to the Tails live website
2685 - move actual URL outside of the translatable string
2687 * Add wrote to device at speed MB/sec INFO log to `clone_persistent_storage`
2691 - Log wrote to device at MB/sec for clone Persistent Storage too
2695 - Only run `clone_persistent_storage()` method if requested. Fixes printing wrong
2696 write speed if Persistent Storage unlocked but unrequested.
2697 - Check `write_size` is not None or 0.0 before logging write speed.
2698 - refactor "wrote to device" into `@log_write_speed()` decorator
2699 - Rename `get_persistent_storage_backup_size` import and usage to match the new
2700 name from: https://gitlab.tails.boum.org/tails/tails/-
2701 /commit/8021cdae30af640537c4c234049b9d69b955f1cd?merge_request_iid=1335
2702 - fix wrong unit math should be Megabytes not Mebibytes
2703 - remove duplicated `PERSISTENCE_DIR` from config.py and import `from
2704 tailslib.persistence` instead.
2705 - rename: `get_persistent_storage_backup_size()` function to refer to the size of
2706 the backup / used space.
2707 - revert: "iff" was not a typo but an abbreviation that looks like one. Used full
2709 - switch to time.monotonic() which returns floating point seconds, remove unused
2711 - Move luks2 header size to function where it is used
2712 - Fix: use "s" as the symbol for "second" instead of "sec"
2713 - Add get_persistent_storage_size()
2714 - Add `luks2_header_size` and `persistence_mountpoint` keys
2715 - Add wrote to device at speed MB/sec INFO log to `clone_persistent_storage`
2717 * Allow Tor Browser to save files to Documents, Downloads, Music, Pictures,
2718 Videos and their subfolders (tails/tails!1333)
2721 - Allow Tor Browser to save files to Documents, Downloads, Music, Pictures,
2722 Videos and their subfolders (tails/tails#19255)
2725 - Make usages of "Bookmark" in the context unique.
2728 - Point submodule to the version with torbrowser-launcher!7 merged
2729 - fix paths to real binary.
2730 - Don't patch files if a simple hook is possible.
2731 - Make XDG dir tests passes.
2732 - make rubocop really happy.
2735 - Do file changes to xdg-user-dirs.desktop/user-dirs-update-gtk.desktop via
2737 - The negative tests is failing, so removing it for the moment.
2738 - To select different desternation folders from bookmarks.
2739 - Make the tests for XDG User Dirs working.
2740 - Find the bookmarks an a German localized system.
2741 - Fix localized.feature tests.
2742 - don't ask the user to localize xdg user dirs.
2743 - Add autotests to make sure, we can use the XDG User Dirs correctly.
2744 - Make sure, that the xdg-user-dirs are not translated.
2745 - Update torbrowser-luncher Apparmor profile.
2747 * Fix Tails Cloner AttributeError: 'NoneType' object has no attribute 'props'
2748 (#18986) (tails/tails!1312)
2751 - Tails Cloner sometimes fails to format the newly created system partition
2755 - Remove useless @retry decorator
2757 - Remove retry decorator on non-idempotent method
2758 - Remove unused method
2759 - Remove unused method
2760 - Remove `get_system_partition` redundant for loop due to @retry decorator,
2761 remove some trailing white spaces
2762 - Change retry range from 10 to 11 so the last retry will be the 10th.
2763 - Fix: "No such interface" by adding @retry decorator function to problematic
2764 udisks methods closes #18986
2765 - Remove temporary debug print() statements
2766 - Set `_get_object` default prop='drive', use "block" arg for
2767 `try_getting_udisks_object`
2768 - add `props` param to `_get_object` so hasattr(obj, props) can be checked before
2770 - Remove obsolete comment about 'NoneType' from old racy `_get_object`. New code
2772 - Fix None object in unmount_device @ filesystem =
2773 self._get_object(udi).props.filesystem
2774 - Solves AttributeError: 'NoneType' object has no attribute 'props' (#18986)
2776 * Upgrade Thunderbird to 115.7
2778 -- Tails developers <tails@boum.org> Mon, 29 Jan 2024 13:04:11 +0100
2780 tails (5.21) unstable; urgency=medium
2782 * Upgrade to Tor Browser 13.0.7 based on Firefox 115.6 (tails/tails!1329)
2785 - Upgrade to Tor Browser based on Firefox 115.6 (tails/tails#20067)
2788 - Fetch Tor Browser from our own archive
2789 - Upgrade Tor Browser to 13.0.7-build1
2791 * Merge /lib/firmware → /usr/lib/firmware (tails/tails!1324)
2794 - Ensure Tails 5.x (Bullseye, non-/usr-merged) can load all the firmware we
2795 include (tails/tails#20075)
2798 - Merge /lib/firmware → /usr/lib/firmware (refs: tails/tails#20075)
2800 * upgrade kernel to 6.1.66 (tails/tails!1320)
2803 - upgrade kernel to 6.1.66
2805 * Upgrade Tor Browser to 13.0.6 (tails/tails!1316)
2808 - Tor Browser sometimes crashes when clicking the uBlock icon (tails/tails#20061)
2811 - Fetch Tor Browser from our own archive
2812 - Upgrade Tor Browser to 13.0.6
2814 * Help users when first-boot resizing fails and creates a semi-broken USB stick
2818 - Help users when first-boot resizing fails and creates a semi-broken USB stick
2822 - dialog text reflects our decision better
2823 - usrmerge won't break our code
2824 - set -o pipefail helps writing more robust code
2825 - rename utils for consistency
2826 - enable units (and rename them)
2827 - Apply 1 suggestion(s) to 1 file(s)
2828 - Actually send the report
2829 - Add forgotten report-disk-errors.pot to po/POTFILES.in
2830 - allow for report-disk-errors to be translated
2831 - break up text so it's easier to translate
2832 - better function name
2833 - show UI for partition resize errors
2834 - catch disk errors in flag file
2836 * enable bookworm-updates and switch to kernel 6.1.67 (tails/tails!1330)
2839 - Fix regressions introduced in Linux 6.1.66 (tails/tails#20086)
2840 - Upgrade to Linux 6.1.67 (tails/tails#20091)
2843 - enable bookworm-updates and switch to kernel 6.1.67
2845 * Localize the clock displayed in the GNOME top bar (tails/tails!1328)
2848 - Clock displayed by date@tails.boum.org is not localized (tails/tails#19895)
2851 - tails-get-date: sort import block
2852 - tails-get-date: reformat with Black
2853 - tails-get-date: Try LANG when LC_TIME is empty
2855 * Upgrade Linux to 6.1.66 on stable (tails/tails!1322)
2858 - Upgrade to Linux 6.1.66 (tails/tails#20072)
2861 - fixing line numbers in diff for #20033
2862 - fix prestera location
2863 - upgrade kernel to 6.1.66
2864 - Update the snapshot of the Debian archive to 2023121004
2866 * Resolve "Upgrade to tor 0.4.8.10" (tails/tails!1319)
2869 - Upgrade to tor 0.4.8.10 (tails/tails#20080)
2872 - upgrading tor to 0.4.8.10
2874 * fix prestera location (tails/tails!1314)
2877 - fix prestera location
2879 * Have CI enforce Ruff linting rules for files modified by MRs (tails/tails!1311)
2882 - Establish a coding standards baseline for our Python code base
2884 - Add Ruff configuration (tails/tails#20049)
2888 - refactor: plain text output is default
2889 - junit output for ruff CI test
2890 - explain differences
2891 - developers style guidelines for Python
2892 - apply CI suggestions
2893 - isort. check that CI finds problems in this file
2895 - resolve revisions to hash
2896 - more specific filtering
2899 * Fix incorrect check button label text when no target USB present
2903 - Starting Tails Cloner without target USB has wrong message (tails/tails#20063)
2906 - Resolve merge conflict of new formatting with changed `elif self.opts.partition
2907 or not self.get_selected_drive():` line.
2908 - Fix incorrect check button label text when no target USB present.
2910 * Make time synchronization more robust: replace unreliable web servers in
2911 htpdate pools (tails/tails!1307)
2914 - Some web servers in our htpdate pool return incorrect time (tails/tails#19923)
2917 - htpdate: replace www.thunderbird.net with www.gimp.org
2918 - htpdate: replace en.wikipedia.org with www.openpgp.org
2919 - htpdate: drop leap.se, replacing it with gnu.org, replacing it with
2922 * tps error is in details, not in summary (tails/tails!1306)
2925 - Revisit how we prefill WhisperBack reports with information from tps
2929 - specify app that triggered the bug report
2930 - summary and details have separate headers
2932 * Tails Cloner: give more relevant "Backup Instructions" if clone Persistent
2933 Storage checked (tails/tails!1305)
2936 - Apply black formatting to `help_link.set_` lines in on_target_partition_changed
2937 - Removed incorrect white space after def
2938 on_check_button_clone_persistent_storage_toggled
2939 - Clone Persistent Storage Toggle should call `on_target_partitions_changed` with
2940 None argument since `combobox_target` parameter is unused.
2941 - Change misleading method name on_target_changed to on_target_partitions_changed
2942 - Show 'Backup Instructions' link if clone Persistent Storage checked
2944 * Fix Tails Cloner bug: button sensitivity or labels don't update if source or
2945 targets change #20042 (tails/tails!1302)
2948 - Tails Cloner: Upgrade stays sensitive if tick clone Persistent Storage then
2949 switch to a Tails target device (tails/tails#20042)
2952 - Fix Tails Cloner bug: button sensitivity or labels don't update if source or
2953 targets change #20042
2955 * Reformat Python code with Black and enforce via GitLab CI (tails/tails!1300)
2959 - Use Optional[TYPE], more readable that Union[None, TYPE]
2960 - Document how to set up .git-blame-ignore-revs
2961 - Document .git-blame-ignore-revs a bit
2964 - More type hints fixes and modernization
2966 - Type hints don't have to be comments anymore
2967 - Move import to a type-checking block
2968 - Greeter: fix most type annotations and mypy errors
2970 - Add more revisions that git blame should ignore
2971 - Add .git-blame-ignore-revs, referencing the first reformatting with Black
2972 - Move "nosec blacklist" back where bandit honors it
2973 - GitLab CI: enforce Black formatting of Python code
2974 - Reformat with Black
2975 - Add Black configuration
2977 * Revert update to the Electrum incentive during our fundraiser
2981 - Update the language for Electrum incentive during the donation campaign
2985 - Revert "Update the Electrum incentive during our fundraiser"
2987 -- Tails developers <tails@boum.org> Thu, 21 Dec 2023 10:34:04 +0000
2989 tails (5.20) unstable; urgency=medium
2991 * Upgrade Thunderbird to 1:115.5.0-1~deb11u1
2993 * Upgrade Tor Browser to 13.0.4 (refs: tails/tails#20043) (tails/tails!1295)
2996 - Upgrade to Tor Browser 13.0.4 based on Firefox 115.5 (tails/tails#20043)
2999 - Upgrade Tor Browser to 13.0.4 (refs: tails/tails#20043)
3001 * fixing line numbers in diff for #20033 (tails/tails!1298)
3004 - fixing line numbers in diff for #20033
3006 * GitLab CI: ensure Rubocop compliance (tails/tails!1301)
3009 - Run Rubocop in GitLab CI (tails/tails#19307)
3012 - Fix regression introduced by partial renaming in
3013 5b46d28df4f40418cd6cde90b1fbbc9dd48b3c14
3014 - Test suite: remove duplicate step
3015 - Manually correct Rubocop offense
3016 - Test suite: simplifications prompted by Rubocop
3017 - Rubocop: replace obsolete parameters with their new names
3018 - Manually correct or disable Rubocop offenses
3019 - GitLab CI: test Rubocop compliance
3020 - rubocop --regenerate-todo
3021 - Manually correct or disable Rubocop offenses
3022 - Rubocop: relax a few limits
3023 - Manually correct or disable Rubocop offenses
3024 - rubocop --autocorrect--all
3025 - Rubocop: use 88 chars max line length
3026 - Rubocop: target Ruby 3.1 (Bookworm)
3027 - Test suite: work around the OSK not showing on new tabs
3028 - Rubocop: silence false positive
3029 - Test suite: fix more Rubocop offenses
3031 - Explain why we're retrying and future nicer workaround
3032 - Test suite: give some time when verifying that each action we took happened
3033 - Test suite: verify that ctrl+a selected all of the address bar
3034 - Test suite: don't focus the address bar in "open new tab" step
3035 - Test suite: make browser helper work for all browsers
3036 - Test suite: make Dogtail code work in all locales
3037 - Test suite: retry inputting the URL into the browser navigation bar if it
3038 failed (refs: tails/tails#20017)
3040 * Test suite: remove obsolete localization of UnsafeBrowserStartPage.png
3044 - Test suite: clean up obsolete localization of UnsafeBrowserStartPage.png
3048 - Test suite: remove obsolete localization of UnsafeBrowserStartPage.png
3050 * explain locale descriptions RM process (tails/tails!1297)
3053 - Explain how to inspect the locale-descriptions diff during the release process
3057 - clarify what to do when inspecting
3059 - comment po-to-mozilla.toml
3060 - clarifies relationship between code and process
3062 * Draft: Resolve "devel branch FTBFS since the upgrade to uBlock 1.53"
3066 - Ensure tails-debugging-info does not crash in case lsblk returns a non-zero
3068 - Include more information about the boot device partition and filesystem layout
3069 in WhisperBack reports
3070 - partitioning: always "set -x"
3071 - Include /var/log/boot.log in WhisperBack reports
3072 - automailer supports content-type: html
3073 - automailer: multiple x-attach fields
3074 - Test suite: give sysadmins a chance to update OpenPGP keys before we fail
3076 * tps: various bug fixes (tails/tails!1294)
3079 - tpsd: TypeError: exceptions must derive from BaseException (tails/tails#20011)
3083 - tps: use logger object consistently
3084 - Remove now unused variable
3085 - tps: don't log exception object twice
3086 - tps: fix reporting of errors about refreshing state of features
3087 - tps: Fix "return" used instead of "raise"
3089 * Emacs: configure the perlnavigator Perl Language Server when used with the
3090 Eglot LSP client (tails/tails!1291)
3093 - Emacs: configure the perlnavigator Perl Language Server when used in
3094 combination with the Eglot LSP client
3096 * misc whisperback improvements (tails/tails!1290)
3099 - Whisperback is only displayed in English (tails/tails#20040)
3100 - Too many WhisperBack reports without description (tails/tails#19351)
3101 - tails-debugging-info is available to amnesia-level attacker (tails/tails#19997)
3104 - Fix what these comments are about
3105 - Remove useless comment
3106 - remove useless a11y code
3107 - sort import modules better with isort
3109 - WhisperBack: remove useless shebangs on files that are not meant to be executed
3110 - Remove unused variable
3111 - Remove unused variable
3112 - WhisperBack: reformat with black
3113 - WhisperBack: remove useless inheritance from object class
3114 - WhisperBack: remove About dialog
3117 - hidden_msg → details
3118 - add a middle "technical details" frame
3119 - headers are not editable
3121 - remove useless instance variable
3122 - Test suite: fix typo in WhisperBack name, improve phrasing of scenarios and
3124 - put fields in bold, html markup only if needed
3125 - use whisperback css to clean padding
3126 - add trailing ellipsis
3127 - more space between textareas
3128 - ignore temporary files
3129 - improve python linting
3130 - don't maximize automatically
3131 - UI matches design more closely
3132 - report has more prefilled data
3133 - tps sends more informative reports
3134 - TPS sends prefill data to WhisperBack
3135 - whisperback supports being prefilled
3136 - redesign Whisperback UI
3138 - automatic tests changed to reflect #19997
3139 - fix whisperback localization
3140 - only whisperback can read debug logs
3142 * Make WhisperBack reports quicker to triage and possibly more actionable wrt.
3143 unusual or buggy boot device partition topology (tails/tails!1289)
3146 - Ensure tails-debugging-info does not crash in case lsblk returns a non-zero
3148 - Include more information about the boot device partition and filesystem layout
3149 in WhisperBack reports
3150 - partitioning: always "set -x"
3151 - Include /var/log/boot.log in WhisperBack reports
3153 * Ensure uBlock does not download and enable additional per-region/language
3154 blocklists (tails/tails!1287)
3157 - uBlock enables and downloads per-region/language additional blocklists
3161 - code slightly more readable
3162 - extra newline makes reading easier
3163 - Avoid fingerprinting by refreshing uBlock lists
3164 - Ensure uBlock does not download and enable additional per-region/language
3167 * automailer: more featuresss (tails/tails!1286)
3170 - automailer supports content-type: html
3171 - automailer: multiple x-attach fields
3173 * Update the Electrum incentive during our fundraiser (tails/tails!1283)
3176 - Update the language for Electrum incentive during the donation campaign
3180 - Make comment match updated frequency
3181 - Clarify test instructions
3182 - Document how to test the incentives
3183 - Update the Electrum incentive during our fundraiser
3185 * Fix IUK test suite and make it test what it was meant to (tails/tails!1282)
3188 - iuk test suite fails on sid: "A: constructing full path: invalid argument."
3192 - IUK test suite: fix the ownership test
3193 - IUK test suite: fix test for existence of file in SquashFS
3194 - IUK test suite: ensure we can read the files we're going to pack
3195 - IUK test suite: fix argument matching
3197 * Test suite: retry inputting the URL into the browser navigation bar if it
3198 failed (tails/tails!1277)
3201 - Make opening URLs in the browser in the test suite reliable again
3205 - Test suite: work around the OSK not showing on new tabs
3206 - Rubocop: silence false positive
3207 - Test suite: fix more Rubocop offenses
3209 - Explain why we're retrying and future nicer workaround
3210 - Test suite: give some time when verifying that each action we took happened
3211 - Test suite: verify that ctrl+a selected all of the address bar
3212 - Test suite: don't focus the address bar in "open new tab" step
3213 - Test suite: make browser helper work for all browsers
3214 - Test suite: make Dogtail code work in all locales
3215 - Test suite: retry inputting the URL into the browser navigation bar if it
3216 failed (refs: tails/tails#20017)
3218 * Test suite: give sysadmins a chance to update OpenPGP keys before failing
3222 - Test suite: give sysadmins a chance to update OpenPGP keys before we fail
3224 * Tor blog post: shift all headings 1 level further (tails/tails!1270)
3227 - Tor blog post: shift all headings 1 level further
3229 * Test suite: allow Thunderbird to connect to test email server even if it's
3230 within RFC1918 range (tails/tails!1268)
3233 - Test suite: allow Thunderbird to connect to test email server even if it's
3234 within RFC1918 range
3235 - Refactoring: extract code to method
3236 - Move method to a more appropriate location
3238 * Add script to recover lost translations (tails/tails!1263)
3241 - Improve script documentation
3242 - Do not try to recover obsolete translations
3243 - use wrapwidth also for parsing.
3246 - Use argparser and add width support.
3247 - merge does too much -> create a own copy method.
3248 - Add Recover-lost-translationy.py
3250 * simplify locale-descriptions update during RM (tails/tails!1187)
3253 - fix pipeline doctest dependencies
3255 - output is sanitized and checked
3257 - suggest mozilla-compatible locales
3259 - update locale descriptions
3260 - always show the second suggestion block
3262 - documentation available to people that need to fix
3263 - integrate with Gitlab CI
3264 - more detailed process
3265 - non-copypastable suggestions are more exhaustive
3266 - separate generate and suggest usecases
3267 - map more languages using semi-automated tool
3268 - black reformatting
3269 - comments clarifying language
3270 - automatically get suggestions
3272 - some languages needs to be added anyway
3274 - follow new process, new mozilla descriptions file
3275 - change approach: only partially automated
3276 - automatically generate locale list
3278 -- Tails developers <tails@boum.org> Mon, 27 Nov 2023 12:54:50 +0100
3280 tails (5.19.1) unstable; urgency=medium
3282 * Upgrade tor to 0.4.8.9 (tails/tails!1285)
3285 - Upgrade to tor 0.4.8.9 (tails/tails#20031)
3288 - Upgrade tor to 0.4.8.9 (refs: tails/tails#20031)
3290 * upgrade to tor 0.4.8.8 (tails/tails!1281)
3293 - Upgrade to tor 0.4.8.8 (tails/tails#20018)
3296 - upgrade to tor 0.4.8.8
3298 * Test suite: adapt to subtle UI change in Thunderbird 115.4.1 (tails/tails!1271)
3301 - Thunderbird test fails: can't find received test email in the UI while it's
3302 there (tails/tails#20008)
3305 - Test suite: adapt to subtle UI change in Thunderbird 115.4.1
3307 * Help the RM when we FTBFS during release process due to an unused APT source
3311 - FTBFS during release process when an unused APT source is configured
3315 - Use clearer grep --recursive instead of rgrep
3316 - Help the RM when we FTBFS during release process due to an unused APT source
3318 -- Tails developers <tails@boum.org> Tue, 14 Nov 2023 11:55:39 +0100
3320 tails (5.19) unstable; urgency=medium
3322 * Upgrade to Tor Browser 13.0.1 based on Firefox 115.4 (tails/tails!1265)
3325 - Upgrade to Tor Browser 13.0.1 based on Firefox 115.4 (tails/tails#19994)
3328 - Tor Browser release process: adjust one more thing to new tarball naming scheme
3329 - Upgrade Tor Browser to 13.0.1 (refs: tails/tails#19994)
3331 * Update to Thunderbird 115 and re-enable Thunderbird automated tests
3335 - Fix and re-enable "I can send emails, and receive emails over IMAP" automated
3336 test: Certificate handling on Jenkins needs updating for Thunderbird 102
3338 - Update to Thunderbird 115 (tails/tails#19885)
3341 - Test suite: remove unused step
3342 - Test suite: adapt steps for changes in Thunderbird 115 (refs:
3344 - Test suite: dont import isotesters' snakeoil SSL cert anymore
3345 - Test suite: re-enable "I can send emails, and receive emails over IMAP" test
3346 - Update Thunderbird patches from
3347 tails/thunderbird@b8b54f4bb25b028171be3b7548f2b7d309d5b61d
3349 * Refresh Thunderbird patch (tails/tails!1257)
3352 - Refresh Thunderbird patch
3354 * Tor Browser 13 (tails/tails!1232)
3357 - Upgrade to Tor Browser 13 based on Firefox 115 (tails/tails#19478)
3360 - Test suite: adapt test to Tor Browser's download dialog having random roles
3361 - Browsers: hide the bookmark toolbar
3362 - Escape "." that's meant as a literal char, rather than a special regepx char
3363 - Test suite: don't assign an assignment :)
3364 - Test suite: add image due to new Italian translation
3365 - Test suite: move browser-related scenarios from common_steps.rb to browser.rb
3366 - Test suite: don't use translated string in Dogtail
3367 - Test suite: adapt scenario for Tor Browser's New Identity feature vs version
3369 - Test suite: rename step
3371 - Tor Browser: hide Tor donation campaign in about:tor
3372 - 10-tbb: don't create the profile directory outside of create_default_profile()
3373 - Test suite: make sure browser URL bar is focused and ready for interaction
3374 - Test suite: refactor
3376 - Test suite: bump images for Tor Browser 13.0
3377 - Upgrade Tor Browser to final 13.0 (refs: tails/tails#19478)
3378 - Update (last time!) AppArmor policy for Tor Browser 13 (refs:
3380 - onion-grater: log the rewrite of CIRC CLOSED events when tor-browser-mode is
3382 - Update AppArmor policy for Tor Browser 13
3383 - onion-grater: make the circuit leak prevention compatible with Tor Browser 13
3384 - Upgrade Tor Browser to 13.0a6 (refs: tails/tails#19478)
3385 - Upgrade Tor Browser to 13.0a5-build1 (refs: tails/tails#19478)
3386 - Test suite: adapt test to Tor Browser 13.0a4's file download UX (refs:
3388 - Upgrade Tor Browser to 13.0a4 (refs: tails/tails#19478)
3389 - Update (again) AppArmor policy for Tor Browser 13 (refs: tails/tails#19478)
3390 - Test suite: bump images
3391 - Test suite: optimize
3392 - Test suite: fix test where method names were mixed up
3393 - Test suite: German uses a new separator in Tor Browser 13
3394 - Adapt for new Tor Browser tarball naming scheme.
3395 - Upgrade Tor Browser to 13.0a3-build1 (refs: tails/tails#19478)
3396 - onion-grater: craft correct empty answers for `getinfo circuit-status`
3397 - Clean up unnecessary json data
3398 - Tor Browser: allow subscribing to CIRC events via onion-grater
3399 - Unsafe Browser: disable uBlock Origin
3400 - Update AppArmor policy for Tor Browser 13 (refs: tails/tails#19478)
3401 - Browsers: hide warning when downloading files
3402 - Test suite: revert from setting browser url with Dogtail's .text= to
3404 - 10-tbb: sanity check that we migrated everything from TBB's profile
3405 - 10-tbb: clean up TorBrowser sub-dir properly
3406 - 10-tbb: remove potential residual file from inside omni.ja
3407 - 10-tbb: adapt for upgrade to Tor Browser 13 (refs: tails/tails#19478)
3408 - Upgrade Tor Browser to 13.0a2-build2
3410 * add image for new translation (tails/tails!1264)
3413 - Fix "Tails is localized for every tier-1 language, Examples (#6)"
3417 - add image for new translation
3419 * Upgrade to Linux 6.1.55-1 (tails/tails!1266)
3422 - Upgrade to Linux 6.1.55 (tails/tails#20004)
3425 - Upgrade to linux-image-6.1.0-13-amd64 (currently at version 6.1.55-1)
3427 * Avoid errors when publishing UDFs (tails/tails!1260)
3430 - run test from the right directory
3431 - fix: diff-index exit code
3432 - Apply 1 suggestion(s) to 1 file(s)
3433 - less git commit errors
3434 - manually check test udf
3435 - More checks where I do errors
3437 * Upgrade to Bullseye 11.8, tor 0.4.8.7, and OnionCircuits 0.8 (tails/tails!1259)
3440 - Onion Circuits: please allow copying relay information (tails/tails#12114)
3441 - OnionCircuits uses deprecated functions (tails/tails#19917)
3442 - Replicate Vidalia's ability to close arbitrary circuits (tails/tails#8927)
3443 - Release Onion Circuits 0.8 (tails/tails#19963)
3444 - Upgrade to tor 0.4.8.7 (tails/tails#19978)
3445 - Upgrade to Bullseye 11.8 (tails/tails#19957)
3449 - onion-grater: allow OnionCircuits to close arbitrary circuits
3450 - Install OnionCircuits from sid (currently 0.8)
3451 - Upgrade to tor 0.4.8.7
3452 - Upgrade to Bullseye 11.8
3454 * post-5.18 release improvements (tails/tails!1254)
3457 - Apply 3 suggestion(s) to 2 file(s)
3458 - plan next RM shift
3460 - locale-independent output for date
3461 - tests can be selected passing arguments
3462 - announce-and-seed-torrents a bit more idempotent
3464 - clarify what to do in case of "no"
3465 - better merge-main-branch question
3466 - some tips on configuring automailer
3467 - some info on how to configure automailer
3468 - thunderbird command can be customized
3470 * Install sq-keyring-linter (tails/tails!1248)
3473 - Add sq-keyring-linter to Tails images (tails/tails#19970)
3476 - Install sq-keyring-linter
3478 * fix deprecation warning (tails/tails!1140)
3481 - date GNOME Shell extension uses deprecated JavaScript (tails/tails#19021)
3484 - usage of object.actor is deprecated
3485 - fix deprecation warning
3487 -- Tails developers <tails@boum.org> Mon, 30 Oct 2023 07:45:10 +0000
3489 tails (5.18) unstable; urgency=medium
3491 * Resolve "Upgrade Tor Browser to 12.5.6" (tails/tails!1253)
3494 - Upgrade Tor Browser to 12.5.6 (tails/tails#19983)
3497 - Fetch Tor Browser from our own archive
3498 - Upgrade Tor Browser to 12.5.6
3500 * Update tor to 0.4.8.6 (tails/tails!1252)
3503 - Upgrade to tor 0.4.8.6 (tails/tails#19977)
3506 - Update tor to 0.4.8.6
3508 * Upgrade to Linux linux-image-6.1.0-12-amd64 (currently version 6.1.52-1)
3512 - Upgrade to Linux 6.1.52 (DSA 5492-1) (tails/tails#19967)
3515 - Refresh webext-ublock-origin-firefox patch vs 1.51.0+dfsg-2
3516 - Update the snapshot of the Debian archive to 2023092602
3517 - Upgrade to Linux linux-image-6.1.0-12-amd64 (currently version 6.1.52-1)
3519 * Upgrade to Tor Browser 12.5.5 (tails/tails!1249)
3522 - Upgrade to Tor Browser 12.5.5 (tails/tails#19980)
3525 - Fetch Tor Browser from our own archive
3526 - Get ready for upcoming "git-annex sync" behavior change
3527 - Upgrade Tor Browser to 12.5.5
3529 * Fix cryptsetup backport (tails/tails!1240)
3532 - Clarify reason why we install our cryptsetup backport
3533 - Temporarily pin our cryptsetup 2:2.6.1-4~deb11u1~tails1 backport
3534 - Needed package update: add exception for cryptsetup
3535 - Enable the fix-cryptsetup-backport APT overlay
3537 * Test suite: ensure node is focused after node.grabFocus (tails/tails!1235)
3540 - Test suite: drop grabFocus workaround + simplify
3541 - Test suite: drop grabFocus workaround + simplify
3542 - Test suite: mechanically drop workaround that is now part of grabFocus
3543 - Test suite: ensure node is focused after node.grabFocus
3545 * Defer the chutney bootstrap check until we need Tor (tails/tails!1179)
3548 - keep-snapshots is better avoided for release
3549 - move script to its own file
3550 - waiting chutney starts *after* test suite started
3551 - test-rerun waits for chutney to be bootstrapped
3552 - Release process: document how to run `chutney wait_for_bootstrap`
3553 - Test suite: make --disable-chutney work again
3554 - Test suite: be more careful about when we require Chutney to have bootstrapped
3555 - Test suite: disable the network for the VM by default
3556 - Test suite: debug_log chutney events instead of puts:ing
3557 - Test suite: defer the chutney bootstrap check until we need Tor
3559 -- Tails developers <tails@boum.org> Mon, 02 Oct 2023 11:26:32 +0200
3561 tails (5.17.1) unstable; urgency=medium
3563 * Upgrade Tor Browser to 12.5.4 (tails/tails!1244)
3566 - Upgrade TorBrowser to 12.5.4 (tails/tails#19972)
3569 - Upgrade Tor Browser to 12.5.4 (refs: tails/tails#19972)
3571 * Update tor to 0.4.8.5 (tails/tails!1241)
3574 - Support conflux circuits (tails/tails#19879)
3575 - Upgrade to tor 0.4.8.x (tails/tails#19952)
3578 - Update tor to 0.4.8.5 (refs: tails/tails#19952)
3580 * Add $HOME/.local/bin to $PATH if it exists (tails/tails!1237)
3583 - Add $HOME/.local/bin to $PATH if it exists Update .profile
3585 -- Tails developers <tails@boum.org> Thu, 14 Sep 2023 20:06:20 +0200
3587 tails (5.17) unstable; urgency=medium
3589 * Upgrade Thunderbird to 1:102.15.0-1~deb11u1
3591 * tps: make is_upgraded() require a single upgraded keyslot (tails/tails!1209)
3594 - Upgrading Persistent Storage times out on some systems and displays an error in
3595 the Welcome Screen but succeeds in the background (tails/tails#19728)
3598 - tps: revert commented out code that was committed by mistake
3599 - Enable the 19728-tps-upgrade-check-vs-corrupt-keys APT overlay (refs:
3601 - tps: drop parsing of luksDump and use JSON instead
3602 - Avoid variables named "match" which is a Python >= 3.10 keyword
3603 - tps: assign variable to regexp for readability
3605 - Welcome screen: bump timeout for activating persistence from 2m to 5m
3606 - Welcome Screen: drop timeout for upgrading the persistent storage
3607 - tps: redact sensitive information from luksDump in the logs
3608 - tps: use more redable re.MULTILINE instead of re.M alias
3609 - tps: make is_upgraded() require a single upgraded keyslot
3611 * Upgrade Tor Browser to 12.5.3 (tails/tails!1238)
3614 - Remove obsolete config/chroot_local-includes/usr/share/live/config/xserver-
3615 xorg/*.ids (tails/tails#19330)
3618 - Fetch Tor Browser from our own archive
3619 - Upgrade Tor Browser to 12.5.3-build1
3621 * Test suite: capture needed-package-updates's output by on failure
3625 - Tets suite: capture needed-package-updates's output by on failure
3627 * Enable all available printers. (tails/tails!1234)
3630 - Enable all available printers.
3632 * Test suite: make changing Persistent Storage passphrase, and deleting
3633 Persistent Storage, more robust (tails/tails!1231)
3636 - Flaky tests: Changing the Persistent Storage passphrase, deleting Persistent
3637 Storage (tails/tails#19950)
3641 - Test suite: make deleting the Persistent Storage more robust
3642 - Test suite: make changing Persistent Storage passphrase more robust
3644 * Remove manual manipulation of env of start-systemd-desktop-target
3648 - Simplify start-systemd-desktop-target (tails/tails#16968)
3651 - Remove manual manipulation of env of start-systemd-desktop-target
3653 * Install printer-driver-brlaser (tails/tails!1228)
3656 - Install printer-driver-brlaser (tails/tails#18254)
3659 - Install printer-driver-brlaser
3661 * Remove the plymouth.ignore-udev hack (tails/tails!1224)
3664 - Check if we can get rid of the plymouth.ignore-udev hack in tails-gdm-failed-
3665 to-start.service (tails/tails#16964)
3668 - Remove the plymouth.ignore-udev hack.
3670 * Resolve "Document how to deal with virt-viewer's CSD" (tails/tails!1223)
3673 - Document how to deal with virt-viewer's CSD (tails/tails#19941)
3676 - Make sure Tails APT signing key is trusted
3677 - Update apt to ensure that apt-cache policy will present a candidate
3678 - Test suite: check that virt-viewer is not affected by tails/tails#19064
3679 - Set up automated test suite so it is not affected by tails/tails#19064
3681 * Display binary package names if not everything needs an update
3685 - Prevent version mismatches among binary packages from src:linux
3689 - fix loop over issues
3690 - Reformat with black
3691 - Display binary package names· if not everything needs an update tails#16375
3693 * Misc post-release fixes (tails/tails!1219)
3696 - Lack of regex support in Dogtail's child method breaks Thunderbird tests
3701 - Rewrite regexp to fit in Dogtail syntax
3702 - test suite supports regexp
3703 - workaround test hidden in test suite
3704 - locale-independent output for date
3706 * RM doc updates (tails/tails!1218)
3709 - Apply 1 suggestion(s) to 1 file(s)
3710 - twitter credentials explained
3711 - expected timing updated
3713 - list possible stages in rm-config help
3714 - explicitly say which stage we're in now
3715 - fix python strings
3716 - black reformatting
3717 - standardize locale
3719 * GitLab CI: allow forcing to run a pipeline by setting $CI_FORCE_RUN
3723 - GitLab CI: allow forcing to run a pipeline by setting $CI_FORCE_RUN
3725 * Rename Tails Installer as Tails Cloner (tails/tails!1200)
3728 - Rename Tails Installer as Tails Cloner (tails/tails#16907)
3731 - Rename Tails Installer as Tails Cloner
3733 * Add script to detect needed package updates from Debian (tails/tails!1155)
3736 - Prevent version mismatches among binary packages from src:linux
3738 - Track security updates during the Tails code freeze (tails/tails#14728)
3741 - Release process: add special mention for the needed package update test
3742 - Print error instead of trigger an exception.
3743 - Use highest package version if multiple are available.
3744 - Reformat with black
3745 - Test suite setup doc: update dependencies
3747 - Use the Ultimate Debian Database (UDD) directly.
3749 - Test suite: document new dependencies
3750 - Test suite: ensure frozen packages are up-to-date
3751 - Needed package update: add exception
3752 - APT: switch to pinning via source package when relevant
3753 - Fix logic to detect an issue correctly.
3754 - Reformat with black
3756 - make mypy happy again.
3757 - Fix logic to return errcode 0 if no issue is shown.
3758 - move SUITES into part of Madison.
3759 - make madison a local variable
3762 - Have default value be the correct type
3763 - Reformat with black
3764 - Use consistent terminology
3765 - Start linting new script
3767 - Remove unused import
3770 - use qa.debian.org Madison API
3771 - restructure the config file to handle also distribution.
3773 - Fix type annotations.
3774 - Always query stable-security's version to and request update..
3775 - Query also stable-secuirty for updates.
3776 - We should first look for the source, as we have only query source package
3778 - Only add metadata, when available.
3779 - Add script to detect needed package updates from Debian
3781 -- Tails developers <tails@boum.org> Mon, 04 Sep 2023 09:10:16 +0000
3783 tails (5.16.1) unstable; urgency=medium
3785 * Mitigate Downfall and INCEPTION speculative-execution vulnerabilities
3789 - Fix Downfall and INCEPTION speculative-execution vulnerabilities
3793 - Update SquashFS sort file manually
3794 - Upgrade to Linux linux-image-6.1.0-11-amd64 (currently version 6.1.38-4)
3796 * onion-grater: deal with race condition in my_circuits() (tails/tails!1212)
3799 - Circuits view sometimes not displayed in Tor Browser, possibly related onion-
3800 grater exception and dropped restricted stream event (tails/tails#19897)
3803 - onion-grater: deal with race condition in my_circuits()
3805 * automailer.py: add support for notmuch (tails/tails!1213)
3808 - automailer.py: add support for notmuch (tails/tails#19932)
3811 - automailer: remove duplicate variable
3812 - automailer (notmuch): add support for attachments
3813 - Reformat with black
3814 - automailer: refactoring (extract code to function)
3816 - automailer: name parameter instead of relying on position
3817 - automailer (notmuch): use the specified email body
3818 - automailer: simplify
3820 * Add options verification to Tails shell library (tails/tails!1211)
3823 - Tails shell library should verify that it is called set -e -u
3827 - Replace backticks with single quotes to prevent command substitution
3828 - Add another options verification to Tails shell library
3829 - Add options verification to Tails shell library
3831 * simplify and fix automailer parser config (tails/tails!1210)
3834 - generate-call-for-trusted-reproducer is broken: TypeError: add_parser_mailer()
3835 missing 1 required positional argument: 'config' (tails/tails#19929)
3838 - simplify and fix automailer parser config
3840 * create_box.sh: fix IMG_SIZE parsing on Debian Sid (tails/tails!1208)
3843 - Creating basebox broken on Debian Sid (tails/tails#19927)
3846 - create_box.sh: use jq for json parsing instead of awk
3847 - create_box.sh: fix IMG_SIZE parsing on Debian Sid
3849 * Test suite: make --view and --vnc-server-only compatible with Wayland without
3850 sudo (tails/tails!1203)
3853 - Make shellcheck happy
3854 - Test suite: send arbitrary options to x11vnc via the TAILS_X11VNC_OPTS
3855 environment variable
3856 - Test suite: make --view and --vnc-server-only compatible with Wayland
3858 * Initialize passphrase strength hint as blank, don't show 0%! (tails/tails!1202)
3861 - Passphrase strength meter initially shows 0% (tails/tails#19918)
3864 - Update passphrase_view.py to remove "0%" and display blank hint initially
3865 - Update passphrase_dialog.py to not display "0%" as strength hint before the
3867 - Update change_passphrase_dialog.py to have a blank default hint instead of "0%"
3870 -- Tails developers <tails@boum.org> Mon, 14 Aug 2023 15:11:40 +0200
3872 tails (5.16) unstable; urgency=medium
3874 * Upgrade to Thunderbird 1:102.14.0-1~deb11u1
3876 * Upgrade to Linux 6.1.38-2
3878 * Upgrade to Tor Browser 12.5.2 (Firefox 102.14) (tails/tails!1207)
3881 - Upgrade to Tor Browser 12.5.2 (Firefox 102.14) (tails/tails#19889)
3884 - Fetch Tor Browser from our own archive
3885 - Upgrade Tor Browser to 12.5.2
3887 * Install amd64-microcode from Debian security (tails/tails!1204)
3890 - Upgrade to Linux 6.1.38 and amd64-microcode 3.20230719.1 (tails/tails#19888)
3893 - Install amd64-microcode from Debian security
3895 * Test suite: ensure tails-debugging-info does not crash (tails/tails!1206)
3898 - Automated tests for Whisperback (tails/tails#19881)
3901 - Remove obsolete justification
3903 - Stop installing inotify-tools
3904 - Drop obsolete /run/tordate
3905 - WhisperBack: move huge "lsusb --verbose" below info that's more often used
3906 - Test suite: ensure tails-debugging-info does not crash
3908 * Test suite: ignore exception if LAN web server is kill():ed before we wait()
3912 - Test suite: ignore exception if LAN web server is kill():ed before we wait()
3914 * onion-grater: make my_circuits() handle unattached streams correctly
3918 - Compare to None with identity, not equality
3919 - onion-grater: make my_circuits() handle unattached streams correctly
3921 * Turn off capitalization to make passphrase suggestion easier to type.
3925 - Turn off capitalization to make passphrase suggestion easier to type.
3927 * Doc updates for 5.15 (tails/tails!1194)
3930 - More robust UDF signing (tails/tails#19665)
3934 - UDFs signature check
3935 - variables, not constants!
3936 - less bogus usages of cat
3937 - login cmdline option useful in testing again
3938 - more usages for automailer
3939 - fix rc/final check
3940 - automatic manual testing email
3941 - automailer supports attachments
3942 - kernel cmdline options make instructions simpler
3943 - black reformatting
3944 - automailer: set default in configuration file
3946 - clarify what's inside the "If" statement
3947 - Update PO files takes longer than you think
3948 - let's remove useless sections early
3950 - tbb upgrade: clarify norm vs exception
3951 - tbb upgrade: chdir in subshell
3952 - tbb upgrade: add ma1 repository
3954 -- Tails developers <tails@boum.org> Sun, 06 Aug 2023 10:32:57 +0000
3956 tails (5.15.1) unstable; urgency=medium
3958 * Emergency fix: fix whisperback reporting
3960 -- Tails developers <tails@boum.org> Tue, 11 Jul 2023 13:20:32 +0200
3962 tails (5.15) unstable; urgency=medium
3964 * Resolve "Upgrade Tor Browser to 12.5.1" (tails/tails!1195)
3967 - Upgrade Tor Browser to 12.5.1 (tails/tails#19724)
3970 - Fetch Tor Browser from our own archive
3971 - Upgrade Tor Browser to 12.5.1-build1
3973 * onion-grater: fix the stream ownership check (tails/tails!1184)
3976 - onion-grater stream ownership check is very buggy resulting in restrict-stream-
3977 events being broken (tails/tails#19741)
3981 - turn on debug automatically based on cmdline
3982 - no stream belongs to pid-based matching
3983 - onion-grater: log events dropped by restrict-stream-events
3984 - onion-grater: only use address comparison for event ownership
3985 - Test suite: test that Tor Browser's circuit view is working
3986 - Upgrade Tor Browser to 12.5-build2
3987 - Test suite: wait longer for Unsafe Browser's zenity dialogs
3988 - Browsers: deal with another extension directory from TBB 12.5 (refs:
3990 - Browsers: update to new fontconfig path for Tor Browser 12.5 (refs
3992 - Test suite: remove useless torified_browsing.rb
3993 - Test suite: adapt test to Tor Browser's new file download UX (refs:
3995 - Test suite: embed old image next to match in automatic image bumping mode
3996 - Defer lyrebird → obfs4proxy renaming
3997 - Upgrade Tor Browser to 12.5.0-build1 (refs: tails/tails#19724)
3998 - Browsers: add new locales supported by Tor Browser 12.5 (refs:
4000 - Upgrade Tor Browser to 12.5a7 (refs: tails/tails#19724)
4001 - onion-grater: fix the stream ownership check (refs: tails/tails#19741)
4003 * Upgrade Tor Browser to 12.5 (tails/tails!1182)
4006 - Upgrade Tor Browser to 12.5-build2
4007 - Test suite: wait longer for Unsafe Browser's zenity dialogs
4008 - Browsers: deal with another extension directory from TBB 12.5 (refs:
4010 - Browsers: update to new fontconfig path for Tor Browser 12.5 (refs
4012 - Test suite: remove useless torified_browsing.rb
4013 - Test suite: adapt test to Tor Browser's new file download UX (refs:
4015 - Test suite: embed old image next to match in automatic image bumping mode
4016 - Defer lyrebird → obfs4proxy renaming
4017 - Upgrade Tor Browser to 12.5.0-build1 (refs: tails/tails#19724)
4018 - Browsers: add new locales supported by Tor Browser 12.5 (refs:
4020 - Upgrade Tor Browser to 12.5a7 (refs: tails/tails#19724)
4022 * Test suite: avoid writing to script while it may be executing
4026 - "Scenario: I can use a network with captive portal" frequently fails: OSError:
4027 [Errno 26] Text file busy: '/etc/NetworkManager/dispatcher.d/00-firewall.sh'
4028 (RemoteShell::ServerFailure) (tails/tails#19736)
4031 - Test suite: avoid writing to script while it may be executing
4033 * Release calendar available from website (tails/tails!1188)
4036 - Apply 2 suggestion(s) to 2 file(s)
4037 - update instructions for updating calendar
4038 - contribute/calendar points to actual calendar
4039 - Revert "Remove our public calendar"
4041 * tps: Fix LUKS upgraded each boot on some systems (tails/tails!1181)
4044 - Persistent Storage upgraded on every login (tails/tails#19734)
4047 - tps: add more debug logging for #19728 and #19734
4048 - tps: calculate available RAM just as cryptsetup does in is_upgraded()
4049 - reports memory and cpu, too
4050 - include information about disks
4051 - Whisperback: more usb information
4052 - decrease the argon2id minimum memory requirement
4054 - make debug-for-5.15 expire automatically
4055 - Enable debug logging in the tps backend by default
4056 - tps: clarify the whole situation around create() using a lower PBDKF memory
4057 cost that we fix with an upgrade at next boot
4058 - tps: use constant instead of magic number
4059 - tps: also set --pbkdf-force-iterations when createing a new volume
4060 - tps: Fix LUKS upgraded each boot on some systems
4062 * Test suite: Fix flaky step "the displayed clock is less than (\d+) minutes
4063 incorrect" (tails/tails!1180)
4066 - Flaky test "the displayed clock is less than (\d+) minutes incorrect"
4071 - Test suite: Fix flaky step "the displayed clock is less than (\d+) minutes
4073 - Test suite: Fix usage of backslashes in arguments to Dogtail
4075 * Support authenticated v3 Onion Services in Tor Browser (tails/tails!1160)
4078 - Support authenticated v3 Onion Services in Tor Browser (tails/tails#17816)
4081 - Revert bits about persistent onion auth keys
4082 - Tor Browser: hide UI related to persisting onion auth keys
4083 - Tor Browser: also allow viewing and removing onion auth keys.
4084 - ONION_CLIENT_AUTH_ADD must take arguments.
4085 - Use upper case as we normally do.
4086 - Tor: enable ClientOnionAuthDir to be able to remember onion auth keys (refs:
4088 - Onion Grater: update Tor Browser to allow onion authentication (refs:
4090 - Tor: enable ExtendedErrors for Tor Browser's SocksPort
4092 * Welcome Screen: Bump UpgradeLUKS timeout to 240s (tails/tails!1190)
4095 - workaround for tails#19871
4096 - Welcome Screen: Bump UpgradeLUKS timeout to 240s
4098 * Upgrade to Linux 6.1.37-1 (tails/tails!1196)
4101 - Install the Linux kernel from Bookworm (tails/tails#19669)
4102 - Upgrade to Linux 6.1.37-1 (tails/tails#19670)
4105 - Document workaround
4107 - Update the snapshot of the Debian archive to 2023070701
4108 - Upgrade to Linux 6.1.37-1 from bookworm-security
4109 - Stop tracking sid when we can get the package we want from Bookworm
4110 - APT: add fallback pinning for Debian-Security
4111 - APT: add Bookworm sources
4113 * automailer parsing fixed (tails/tails!1193)
4116 - simpler and more effective body parsing
4118 * tails-installer open wrong URI (tails/tails!1191)
4121 - Honor the "debug" kernel cmdline option in Tails Installer (tails/tails#12396)
4122 - Tails Installer open wrong documentation URI (tails/tails#19870)
4125 - rename function to reflect what it does
4126 - verbose is explicitly disabled
4128 - tails-documentation de-localize input links
4129 - tails-documentation supports URLs as arguments
4130 - tails-documentation --dry-run
4131 - tails-installer honors debug cmdline
4132 - refactor debug activation in tails installer
4134 * Fix gitlab-triage-post-release (tails/tails!1186)
4137 - Multiple failures in gitlab-triage-post-release (tails/tails#19723)
4140 - prevent running with unset variables
4141 - let's ignore milestone.due_date
4144 * onion-grater: fix getinfo circuit-status leak (tails/tails!1185)
4147 - onion-grater leaks info about unassociated circuits to Tor Browser
4151 - onion-grater: refactor
4152 - onion-grater: add comments per reviewer request
4153 - onion-grater: log events dropped by restrict-stream-events
4154 - onion-grater: only use address comparison for event ownership
4155 - Test suite: test that Tor Browser's circuit view is working
4156 - WIP fix for refs: tails/tails#19740
4157 - onion-grater: fix the stream ownership check (refs: tails/tails#19741)
4159 * TCA: Fix error not displayed after QR code scanning failure (tails/tails!1183)
4162 - Error not displayed after QR code scanning failure: "TypeError: 'dict' object
4163 is not callable" for "_" (tails/tails#19737)
4166 - TCA: Fix error not displayed after QR code scanning failure
4168 * Replace connect-drop executable (tails/tails!1177)
4171 - simplify --debug handling
4172 - fix: forward INHERIT_FD to tails-installer
4173 - get env var: raise if not present
4174 - fix: forward INHERIT_FD to tps-frontend
4175 - Fix python3-gi missing in test-tailslib job
4176 - connect-socket: Use parser default value for --debug option
4177 - Inline connect-drop-tails-installer in tails-installer
4178 - Inline connect-drop-tps in tails-persistent-storage
4179 - Replace connect-drop with connect-socket
4180 - run-tca-in-netns: Support setting logging level to debug
4181 - tps-frontend: Fix comment
4183 * Welcome Screen: Fix search (tails/tails!1176)
4186 - Improve search in language and keyboard selection widgets (tails/tails#19200)
4189 - Welcome Screen: Also search the language code
4190 - Welcome Screen: Support multiple search strings
4191 - Welcome Screen: Fix search
4193 * post-RM doc updates (tails/tails!1174)
4196 - use automailer at least once in the doc
4198 - make sending emails easier multi-MUA
4199 - blog.torproject.org: link to old MR
4200 - let's validate using check-po-msgfmt, too
4201 - I just want to copy-paste
4202 - discard non-diff lines
4203 - more readable output
4205 * Rename tps executables (tails/tails!1172)
4208 - Rename tps to tpsd (tails/tails#19430)
4211 - Rename tps -> tpsd
4212 - Rename tps-frontend-wrapper -> tails-persistent-storage
4214 * tps: Rename mount -> binding (tails/tails!1171)
4217 - Use the term "binding" instead of "mount" in tps backend code
4222 - tps: Rename mount -> binding
4224 * tps: Make sure that the header correctly unlocks the partition
4228 - Investigate LUKS header restore failure (tails/tails#19718)
4231 - tps: Fix error case in which LUKS header backup is not restored
4234 - tps: Remove unused imports
4235 - tps: Remove unused D-Bus method TestPassphrase
4236 - tps: Don't include UUID in LUKS header backup path
4237 - tps: Make sure that the header correctly unlocks the partition
4239 * Dogtail: re-enable showingOnly by default (tails/tails!1166)
4242 - Re-enable showingOnly by default in the test suite (tails/tails#19717)
4245 - Test suite: fix another Dogtail configuration issue
4246 - Test suite: simplify
4247 - Test suite: deal with test relying on showingOnly not being enabled
4248 - Test suite: drop useless require
4249 - Test suite: deal with test relying on showingOnly not being enabled
4250 - Test suite: actually "simulate" a failing connection during time sync
4251 - Test suite: drop all explicit `showingOnly: true` arguments
4252 - Dogtail: disable debugging output
4253 - Dogtail: enable showingOnly by default (refs: tails/tails#19771)
4255 * test: user can install w/o cloning (tails/tails!1165)
4258 - Tails Installer: test that the user can install without cloning
4262 - rename scenarios consistently
4263 - remove useless step
4264 - Apply 1 suggestion(s) to 1 file(s)
4265 - test: user can install w/o cloning
4267 * Upgrade Linux on devel branch to 6.1.27-1 (tails/tails!1151)
4270 - Upgrade to Linux 6.1.27-1 (devel branch)
4272 * Display the Tails version in the boot loader entry (tails/tails!1137)
4275 - Display the Tails version number during boot (Boot Loader Menu or Welcome
4276 Screen) (tails/tails#16796)
4279 - Display the Tails version number in all GRUB menu entries
4281 - Display the Tails version in the boot loader entry
4283 -- Tails developers <tails@boum.org> Mon, 10 Jul 2023 12:04:32 +0200
4285 tails (5.14) unstable; urgency=medium
4287 * tailslib: Fix spawn_tps_frontend (tails/tails!1168)
4290 - tailslib: Fix spawn_tps_frontend
4291 - run-with-user-env: Support the --systemd-run option
4292 - userenv.py: Allow passing the DEBUG environment variable
4294 * Upgrade Tor Browser to 12.0.7 (tails/tails!1159)
4297 - Upgrade Tor Browser to 12.0.7 (tails/tails#19662)
4300 - Fetch Tor Browser from our own archive
4301 - Upgrade Tor Browser to 12.0.7
4303 * Upgrade to Bullseye 11.7 and Linux 6.1.25-1 (stable branch) (tails/tails!1121)
4306 - Switch to open-ath9k-htc-firmware (tails/tails#19625)
4307 - Consider allowing initramfs size > 32 MiB (tails/tails#19663)
4308 - Upgrade to Bullseye 11.7 (tails/tails#19555)
4309 - Upgrade to Linux 6.1.25-1 (tails/tails#19608)
4312 - Upgrade to Bullseye 11.7 and Linux 6.1.25-1 (stable branch)
4313 - Allow initramfs size larger than 32 MiB
4314 - Revert "initramfs: remove amdgpu and nvidia drivers"
4315 - initramfs: remove amdgpu and nvidia drivers
4316 - Install the free firmware firmware-ath9k-htc
4318 * Test suite: Fix flaky low-memory test (tails/tails!1161)
4321 - Cannot create Persistent Storage when the system is low on memory on Bookworm
4326 - Test suite: Fix flaky low-memory test
4328 * Test suite: Paste bridge via Dogtail (tails/tails!1156)
4331 - Test suite: Paste bridge via Dogtail
4333 * Test suite: make --image-bumping-mode work with find_any() (tails/tails!1154)
4336 - `run_test_suite --image-bumping-mode` fails sometimes: 'NoneType' object has no
4337 attribute 'shape' (tails/tails#19055)
4340 - Test suite: simplify the return value for the *_any() methods
4341 - Test suite: make --image-bumping-mode work with find_any()
4343 * Test suite: fix corruption in the OpenCV helper script output
4347 - run_test_suite --image-bumping-mode fails: wrong number of arguments (given 13,
4348 expected 6) (ArgumentError) (tails/tails#19243)
4351 - Test suite: add assertion
4352 - Test suite: deal with OpenCV errors more reliably
4353 - Test suite: properly separate stdout and stderr in OpenCV helper script
4355 * Welcome Screen: Replace "Create Persistent Storage" button with switch
4359 - Confusing UX of Persistent Storage onboarding in Welcome Screen
4363 - Welcome Screen: Replace "Create Persistent Storage" button with switch
4365 * Test suite: Use Dogtail to shut down / reboot the system (tails/tails!1150)
4368 - Test suite: Use Dogtail to shut down / reboot the system
4370 * Mention Kleopatra in the name of the Persistent Storage features
4374 - Mention Kleopatra in Persistent Storage settings (tails/tails#19675)
4377 - Mention Kleotra in Persistent Storage settings
4379 * Improve labels while creating Persistent Storage (tails/tails!1148)
4382 - Improve labels during creation of Persistent Storage (tails/tails#19674)
4386 - Integrate tps Python files into our l10n framework
4387 - Improve labels while creating Persistent Storage
4389 * Test suite: Use Dogtail to open additional settings dialog (tails/tails!1146)
4392 - Test suite: remove images that are not used anymore
4393 - Test suite: Use Dogtail to open additional settings dialog
4395 * Replace 'tails.boum.org' by 'tails.net' (except for wiki/src)
4399 - Use the new domain when checking for invalid hosts
4400 - Keep checking for translatable URLs using the old domain
4401 - Fix expected length for GPU-related error message
4402 - Replace 'tails.boum.org' by 'tails.net' (except for wiki/src)
4404 * tps: Avoid triggering OOM killer (tails/tails!1144)
4407 - Creating Persistent Storage can cause OOM killer to kill gnome-shell
4411 - Test suite: Test creating Persistent Storage with low memory
4412 - tps: Avoid triggering OOM killer
4414 * Test suite: Use dogtail in step 'I (dis)?connect the network through GNOME'
4418 - Test suite: Use dogtail in step 'I (dis)?connect the network through GNOME'
4420 * Whisperback warning (tails/tails!1133)
4423 - reformat with black
4424 - Fix SyntaxWarning in whisperback
4426 * Persistent Storage feature descriptions (tails/tails!1131)
4429 - Implement missing descriptions of Persistent Storage features
4433 - tps-frontend: Fix label style context "error" not reset
4434 - tps-frontend: Improve subtitle of Persistent Folder
4435 - tps-frontend: Add subtitle for Persistent Folder
4436 - tps-frontend: Fix subtitles not shown
4438 * tps: Hide mounts from the desktop environment (tails/tails!1130)
4441 - The Persistent Folder should not appear as an external device in the Files
4442 browser (tails/tails#19646)
4445 - tps: Hide mounts from the desktop environment
4447 * Test suite: Replace more usages of fragile @screen.paste (tails/tails!1127)
4450 - Test suite: Replace more usages of fragile @screen.paste
4452 * Electrum: Ask for donations in 1/20 of cases (tails/tails!1117)
4455 - Have an incentive to donate to Tails from Electrum in Tails (tails/tails#18023)
4458 - Remove unused import
4459 - electrum: Fix dialog not closed when process exits
4460 - electrum: Use different donation addresses
4461 - Store Bitcoin addresses for Electrum incentive
4462 - Implement changes proposed by segfault and bokonon
4463 - Electrum: Change effect of the ELECTRUM_DONATION_MESSAGE variable
4464 - Add link to our donation page
4466 - Improve notification message
4467 - Add vertical space
4468 - Add default description for transfer
4469 - Electrum: Ask for donations in 1/20 of cases
4470 - Electrum: Don't show message dialog if called with arguments
4472 * Use argon2id and support upgrading to LUKS2 and argon2id (tails/tails!1116)
4475 - tps: Explain why we use the UUID in the backup file name
4476 - Test suite: Add comment
4478 - Welcome Screen: Upgrade Persistent Storage explicitly
4479 - tps: Also restore backup LUKS header if the UUID can't be read
4480 - tps: Test the backup header before upgrading the original header
4481 - tps: Always use shred to delete backup LUKS header
4482 - Test suite: Fix flaky scenario "Feature activation fails"
4483 - Test suite: Test automatically upgrading LUKS header
4484 - Welcome Screen: Set label back to "Unlock Encryption"
4485 - Test suite: Fix step 'I enable persistence' returning early
4486 - Test suite: Fix usage of Gherkin keyword
4487 - tps: Add note about wear leveling to UpgradeLUKS docstring
4488 - tps: Use shred to delete backup LUKS header
4489 - tps: Also update memory cost of Argon2id
4490 - tps: Add type hint
4491 - tps: Rename the Partition class to TPSPartition
4492 - tps: Fix stacklevel of log functions
4493 - tps: Automatically upgrade LUKS header when unlocking
4494 - tps: Support upgrading to LUKS2 and argon2id
4496 * Detect captive portals (tails/tails!1107)
4499 - use iptables --wait in test suite (tails/tails#19698)
4500 - tails-get-network-time sets different User-Agent than NetworkManager
4502 - Bring the Tor Connection user story to a state where it should not be our top
4503 priority anymore (tails/tails#19473)
4504 - Detect captive portals (tails/tails#5785)
4507 - iptables waits for lock
4509 - Test suite: Replace some usages of "Tor is ready"
4510 - Test suite: Check time sync headers
4511 - Test suite: Change how we imitate a captive portal
4512 - Test suite: Replace httpbin.org with our own web server
4513 - Test suite: Catch errors when copying Chutney data
4514 - Revert "while at it, remove all usages of "Tor is ready""
4515 - Test suite: Replace usage of httpbin.org
4516 - Test suite: Check that TCA knows when a portal was detected
4517 - tails-get-network-time: Restructure
4518 - tails-get-network-time: Fix case that not enough data was received
4519 - tails-get-network-time: Print curl debug output in debug mode
4520 - tails-get-network-time: Support config file
4521 - tails-get-network-time: Don't fail if response code is other than 200 and 204
4522 - tails-get-network-time: Fix handling of extra bytes after expected response
4523 - tails-get-network-time: Fix handling of empty body
4524 - tails-get-network-time: Fix typo
4525 - tails-get-network-time: Remove unused variable
4526 - tails-get-network-time: Remove unreachable code
4527 - tails-get-network-time: Ignore case of X-NetworkManager-Status value
4528 - keep the comment near to relevant code block
4529 - Apply 1 suggestion(s) to 1 file(s)
4531 - while at it, remove all usages of "Tor is ready"
4532 - use the non-deprecated step
4533 - captive portal automated test
4534 - More generic error, because we're not sure
4535 - User-visible captive portal detection
4536 - actually detect captive portal
4537 - type hint for callbacks
4538 - pass additional data in case of errors
4539 - fix error response code
4540 - override for GetNetworkTimeCommand
4541 - Refactor code to allow per-command override
4542 - define shared constant in module
4543 - tails-get-network-time: Don't set any User-Agent
4545 -- Tails developers <tails@boum.org> Mon, 12 Jun 2023 14:53:26 +0200
4547 tails (5.13) unstable; urgency=medium
4549 * Resolve "Upgrade Tor Browser to 12.0.6, based on Firefox 102.11"
4553 - Upgrade Tor Browser to 12.0.6, based on Firefox 102.11 (tails/tails#19621)
4556 - Fetch Tor Browser from our own archive
4557 - Upgrade Tor Browser to 12.0.6-build1
4559 * unsafe-browser: Explain why our use of flock is not vulnerable
4563 - Unsafe Browser - Local Privilege Escalation (LPE) via symlink - Arbitrary File
4564 Content Delete (tails/tails#19616)
4567 - Use /run/lock instead of /var/lock
4568 - unsafe-browser: Explain why our use of flock is not vulnerable
4570 * Make curl use Tor (tails/tails!1123)
4573 - Make curl work out of the box (tails/tails#19488)
4576 - test that curl works out of the box
4579 * udisks2: Use LUKS2 by default (tails/tails!1115)
4582 - Persistent Storage: Use LUKS2 (tails/tails#15450)
4585 - Test suite: Increase timeout for changing the LUKS passphrase
4586 - Test suite: Check that Persistent Storage uses LUKS2
4587 - Test suite: record old version when installing one to disk
4588 - Test suite: move step definition to a more suitable place
4589 - udisks2: Use LUKS2 by default
4591 * tails-documentation: Check that joined path is below website path
4595 - tails-documentation - Limited Path Traversal (tails/tails#19576)
4598 - tails-documentation: Check that joined path is below website path
4600 * Test suite: Don't check for "Display output is not active" screen
4604 - Tests sometimes fail with "Display output is not active" after clicking login
4605 button in Welcome Screen (tails/tails#19639)
4608 - Test suite: Don't check for "Display output is not active" screen
4609 - Test suite: Print step status
4610 - Welcome Screen: Make error message more useful
4612 * Remove our public calendar (tails/tails!1125)
4617 - Remove our public calendar
4619 * tps: Use argon2id (tails/tails!1120)
4622 - Persistent Storage: Use argon2id (tails/tails#19633)
4625 - Test suite: Check that Persistent Storage uses argon2id
4626 - tps: Reduce the number of triggered udev events
4627 - tps: Fix creation sometimes failing because udisks object is not ready
4628 - tps: Fix `udevadm trigger --settle` sometimes blocking forever
4629 - tps-frontend: Fix first job update sometimes ignored
4630 - tps: Send only one PropertiesChanged signal per job update
4631 - tps: Don't restrict CPU usage during Persistent Storage creation
4632 - tps: Keep the system responsive while creating Persistent Storage
4635 * tps: Fix stderr of failed commands not printed (tails/tails!1118)
4638 - tps: Fix stderr of failed commands not printed
4640 * Test suite: Avoid TCA scenario failing if the error panel is briefly shown
4644 - Fix "Scenario: The same Tor configuration is applied when the network is
4645 reconnected" failing (tails/tails#19591)
4648 - Test suite: Avoid TCA scenario failing if the error panel is briefly shown
4650 * tps: Fix InvalidBootDeviceError raised in finally block (tails/tails!1103)
4653 - "Persistent Greeter options" test suite scenario always fails
4655 - tps reports the need for "USB stick installed with a USB image or Tails
4656 Installer" in unrelated failure modes (tails/tails#19588)
4659 - tps: Fix InvalidBootDeviceError raised in finally block
4660 - tps: Remove unused exception
4662 -- Tails developers <tails@boum.org> Mon, 15 May 2023 12:22:05 +0200
4664 tails (5.12) unstable; urgency=medium
4666 * Test suite: Try to catch another case of "Display output is not active"
4670 - Test suite breakage when restoring an old Bullseye snapshot: "Guest disabled
4671 display", "Display output is not active" (tails/tails#18953)
4674 - Test suite: Try to catch another case of "Display output is not active"
4676 * Test suite: Press escape to wake up the display (tails/tails!1089)
4679 - Test suite breakage when restoring an old Bullseye snapshot: "Guest disabled
4680 display", "Display output is not active" (tails/tails#18953)
4683 - Test suite: Retry restoring snapshot 3 times
4684 - Test suite: Press escape up wake up the display
4686 * Upgrade to Linux 6.1.20-1 (stable branch) (tails/tails!1080)
4689 - Upgrade to Linux 6.1.15 (tails/tails#19484)
4690 - Upgrade to Linux 6.1.20+ (tails/tails#19556)
4693 - Upgrade to Linux 6.1.20-1 from sid
4695 * Upgrade to Linux 6.1.20-1 from sid (devel branch) (tails/tails!1079)
4698 - Upgrade to Linux 6.1.20-1 from sid
4700 * Add icon for tails-backup (tails/tails!1111)
4703 - Have an icon for the backup utility (tails/tails#19363)
4706 - Update icon for Persistent Storage settings
4707 - Add icon for tails-backup
4709 * Additional Software: Fix launched apps not accessible via Dogtail
4713 - tca-portal, tails-additional-software: don't run apps as amnesia under the
4714 scope of the (root) systemd service (tails/tails#19131)
4715 - Additional Software is in English when launched from a notification
4717 - tails-additional-software-config and gedit started from a notification are not
4718 accessible ⇒ breaks test suite (tails/tails#19233)
4721 - Additional Software: Make tails-additional-software-config D-Bus activatable
4722 - Additional Software: Launch apps with gtk-launch
4724 * Resolve "myspace.com has become incompatible with our htpdate setup"
4728 - myspace.com has become incompatible with our htpdate setup (tails/tails#19561)
4731 - test-iuk: list 1 package per line, for nicer future diffs
4732 - test-iuk: make it breathe
4733 - test-iuk: refuse running unless in a throw-away container
4734 - convert shell script to set -eu
4735 - move test-iuk to its own file
4736 - refactor: put in its own file
4738 - replace myspace.com with facebook.com
4740 * Test suite: Fix step "persistent Greeter options were restored"
4744 - "Persistent Greeter options" test suite scenario always fails
4748 - Test suite: Avoid an unnecessary reboot
4749 - Test suite: Make clicking "Connect to Tor" button more robust
4750 - Test suite: Add alternative persian comma image
4751 - Test suite: Fix step "persistent Greeter options were restored"
4752 - Test suite: Translate Dogtail args to $lang_code
4753 - Remote shell: Support setting environment variables in remote commands
4754 - Test suite: Support configuring chutney start time
4756 * tps: Fix hook execution with --profiling option (tails/tails!1112)
4759 - tps: Fix hook execution with --profiling option
4761 * Shell library: Validate LANG before using it (tails/tails!1110)
4764 - Validate LANG in localization.sh (tails/tails#19576)
4767 - Shell library: Validate LANG before using it
4769 * Remove obsolete disabling of nf_conntrack_helper (tails/tails!1109)
4772 - Update disabling of netfilter's automatic conntrack helper assignment
4776 - Remove obsolete disabling of nf_conntrack_helper
4778 * Test suite: Fix Electrum test (tails/tails!1105)
4781 - Electrum test suite broken by !1010 (tails/tails#19589)
4784 - Test suite: Fix Electrum test
4786 * Test suite: Fix additional software scenario (tails/tails!1102)
4789 - Test suite: Scenario "Recovering in offline mode after Additional Software
4790 previously failed to upgrade and then succeed to upgrade when online" fails
4794 - Remove @fragile tags that were only justified by #19233, which was solved via
4796 - Test suite: Fix additional software scenario
4798 * Additional Software: Use valid D-Bus name as app name (tails/tails!1099)
4801 - `gtk-launch org.boum.tails.additional-software-config.desktop` is broken
4805 - Design doc: update path
4806 - Additional Software: Use valid D-Bus name as app name
4808 * Test suite: allow the pattern to cover slightly less of the write cache
4812 - Test Suite: Feature "System memory erasure on shutdown" is fragile
4816 - Test suite: allow the pattern to cover even less of the write cache
4817 - Test suite: allow the pattern to cover slightly less of the write cache
4819 * Upgrade Tor Browser to 12.0.5 (tails/tails!1097)
4822 - Upgrade to Tor Browser 12.0.5, based on Firefox 102.10 (tails/tails#19559)
4825 - Fetch Tor Browser from our own archive
4826 - Upgrade Tor Browser to 12.0.5-build2
4827 - Upgrade Tor Browser to 12.0.5-build1
4829 * tps: Fix "python.UnknownError" returned for builtin errors (tails/tails!1095)
4832 - Buggy error handling in tps: OSError is not a valid D-Bus name
4836 - tps: Fix "python.UnknownError" returned for builtin errors
4838 * Welcome Screen: Support login kernel command-line option (tails/tails!1093)
4841 - Welcome Screen: Support login kernel command-line option
4843 * Welcome Screen: Don't allow unlocking with empty passphrase by pressing Enter
4847 - Welcome Screen: Don't allow unlocking with empty passphrase by pressing Enter
4851 - Welcome Screen: Don't allow unlocking with empty passphrase by pressing Enter
4853 * systemd: Use name in unit status messages (tails/tails!1088)
4856 - systemd: Use name instead of description in unit status messages
4860 - systemd: Use both name and description in unit status messages
4862 * Display a diceware suggestion when creating the Persistent Storage
4866 - Display a diceware suggestion when creating the Persistent Storage
4870 - tps-frontend: Move passphrase suggestion code to passphrase_view.py
4871 - tps-frontend: Fix local variable 'passphrase' might be referenced before
4873 - tps-frontend: Increase spacing between suggested passphrase and refresh button
4874 - tps-frontend: Add missing space to error message
4875 - tps-frontend: Fix indentation
4876 - tps-frontend: hide relevant UI elements when diceware fails
4877 - tps-frontend: give attribute an expressive name
4878 - Wait Bookworm to use the non-English wordlists
4879 - Determine passphrase suggestion width automatically
4880 - tps-frontend: Remove default passphrase suggestion
4881 - tps-frontend: refactoring
4882 - tps-frontend: hide 'for example' label when diceware suggestion fails
4883 - tps-frontend: don't break when wordlist directory doesn't exist
4884 - tps-frontend: Use a method to set a new passphrase hint
4885 - tps-frontend: Log the exceptions caused by diceware suggestion
4886 - tps-frontend: print stderr when diceware fails
4887 - tps-frontend: use a wordlist in the currently configured language when
4889 - tps-frontend: adjust passphrase view UI
4890 - Display a diceware suggestion when creating the Persistent Storage
4892 * Fix race when starting tails-ibus-proxy.service (tails/tails!1086)
4895 - tails-dbus-proxy: Add missing PIDFile= property to systemd services
4896 - tails-ibus-proxy: Busy wait on ibus-daemon
4897 - tails-ibus-proxy: Fix missing whitespace (PEP-8)
4898 - Fix race when starting tails-ibus-proxy.service
4900 * Don't translate "known security vulnerabilities" (tails/tails!1081)
4903 - Don't translate "known security vulnerabilities"
4905 * Fix progress information inconsistencies when resuming an automatic upgrade
4906 download (tails/tails!1071)
4909 - Upgrader sometimes fails: Negative number not allowed in format_bytes at
4910 /usr/local/share/perl/5.32.1/Tails/IUK/Role/FormatByte.pm line 45 (Fix progress
4911 information inconsistencies when resuming an automatic upgrade download)
4915 - Revert "Upgrader: Avoid display the progress dialog initial text"
4917 - Make code style more consistent
4919 - Upgrader: Avoid display the progress dialog initial text
4920 - Tails::IUK::LWP::UserAgent::WithProgress: check if the temp file exists
4921 - Tails::IUK::LWP::UserAgent::WithProgress: always display the total amount of
4924 * Persistent Storage design docs (tails/tails!1035)
4927 - Persistent Storage: Update design doc (tails/tails#19223)
4930 - Remove XXX comments
4931 - Remove glossary entry for tails-persistence-setup
4932 - Link to contribute/Persistent_Storage in contribute.mdwn
4933 - Persistent Storage design doc: Don't link to line numbers
4934 - Revert "Rename persistence.mdwn -> Persistent_Storage.mdwn"
4935 - Follow style guide
4938 - Improve Persistent Storage contribute doc
4939 - Rename persistence.mdwn -> Persistent_Storage.mdwn
4940 - Move persistent-storage/HACKING.md to website
4941 - Update Additional Software design doc
4942 - Persistent Storage design doc: Add section on symlink attacks
4943 - Improve Persistent Storage design doc
4944 - better draft of Persistent Storage design docs
4946 * tps: Fix activation of feature in inconsistent state (tails/tails!1010)
4949 - Consider sync'ing data to disk after copying it to Persistent Storage when
4950 activating a feature (tails/tails#19368)
4951 - Seemingly spurious tps.configuration.mount.IsActiveException when deactivating
4952 a Persistent Storage feature (tails/tails#19331)
4953 - Delete corresponding data when a feature of the Persistent Storage is turned
4954 off in the settings (tails/tails#8447)
4955 - Switches of the new Persistent Storage are too slow to respond on some USB
4956 sticks (tails/tails#19291)
4957 - tps: Fix activation failing when in inconsistent state (tails/tails#19376)
4960 - Test suite: Update string
4961 - less ambiguous variable name
4962 - libtps.sh: Print JSON output
4963 - Apply 1 suggestion(s) to 1 file(s)
4964 - libtps.sh: Describe format returned by tps_get_features()
4965 - Apply 1 suggestion(s) to 1 file(s)
4966 - Make code easier to review
4967 - tps-frontend: Check if action row is defined
4969 - Explain stacklevel option
4970 - Use normal string instead of f-string
4974 - tps: Delete feature data via `rm -rf`
4975 - tps: Set HasData to True if we can't figure it out
4976 - tps-frontend: Ensure that the delete data button has the correct visibility
4977 - tps-frontend: Fix feature deactivated when IsActive changes to False
4978 - tps: Ensure that all feature properties are refreshed
4979 - Welcome Screen: Improve error message
4980 - Test suite: Use tpscli instead of parsing persistence.conf
4981 - Test suite: Fix "Given" used instead of "Then"
4982 - Test suite: Improve scenario "Feature activation fails"
4983 - Test suite: Use consistent wording
4984 - tps: Support reloading the service
4985 - Test suite: Improve comment and variable names
4986 - Test suite: Add another check that tps feature is deactivated immediately
4987 - Test suite: Use "active" instead of "enabled" for Persistent Storage
4988 - Test suite: Add scenario "Feature activation fails"
4989 - Welcome Screen: Show unlocked message when features failed to activate
4990 - Integrate tps-frontend Python files into our l10n framework
4991 - tps: Don't return an error in Unlock when features have unexpected state
4993 - tps-frontend: Don't insert hyphens when breaking lines in the error message
4994 - Test suite: Add scenario "Deleting data of a Persistent Storage feature"
4995 - tps-frontend: Remove unused imports
4996 - tps-frontend: Add accessible name to delete data button
4997 - tps-frontend: Make title of error dialogs bold
4998 - tps: Print stderr of failed commands in error messages
4999 - Test suite: Improve Gherkin of "Activating and deactivating Persistent Storage
5001 - tps: Strip the "GDBus.Error:" prefix from errors displayed to users
5002 - tps: Check that enabling/disabling feature worked
5003 - tps: Fix ActivationFailedError raised instead of DeactivationFailedError
5004 - tps: Fix incorrect PropertiesChanged signal
5005 - tps: Add behave test for deleting feature
5006 - tps: Fix behave tests failing
5007 - tps: Fix no PropertiesChanged emitted for HasData
5008 - tps: Remove Error property
5009 - tps-frontend: Use IsEnabled property
5010 - tps: Don't raise AlreadyActivatedError and NotActivatedError
5011 - tps: Fix race condition when adding/removing features from config file
5012 - tps: Add new property Feature.IsEnabled
5013 - Welcome Screen: Mention which features failed to activate
5014 - tps-frontend: Move delete data button into first row
5015 - tps-frontend: Remove separator between first and second row
5016 - Welcome Screen: Document GtkInspector
5018 - tps: Sync data copied to Persistent Storage
5019 - tps: Improve error in Welcome Screen when features failed to activate
5020 - tps-frontend: Show warning for features which failed to activate
5021 - tps: Remove features which failed to activate
5022 - tps: Store errors during service activation
5023 - tps: Make error message label selectable
5024 - tps-frontend: Use … instead of ... in button labels
5025 - tps-frontend: Confirm data deletion
5026 - tps: Treat Persistent directory with empty "Tor Browser" directory as empty
5027 - tps: Fix "return" used instead of "raise"
5029 - tps: Support deleting data
5030 - tps-frontend: Show a spinner while activating/deactivating features
5031 - tps-frontend: Hide persistent folder button when feature is inactive
5032 - Also make on-deactived hooks work when run twice
5033 - tps behave-tests: Test deactivating feature with inconsistent state
5034 - tps: Make on-activated hooks work when run twice
5035 - Fix shellcheck source comments
5036 - tps: Fix deactivation of feature in inconsistent state
5037 - tps behave-tests: Test activating feature with inconsistent state
5038 - Revert "Don't try (and fail) to refresh features' IsActive when unlocking"
5039 - tps: Fix activation of feature in inconsistent state
5041 -- Tails developers <tails@boum.org> Tue, 18 Apr 2023 16:54:56 +0000
5043 tails (5.11) unstable; urgency=medium
5045 * Upgrade Thunderbird to 102.9.0-1~deb11u1
5047 * Upgrade Tor Browser to 12.0.4-build2 (tails/tails!1082)
5050 - Upgrade to Tor Browser 12.0.4 based on Firefox 102.9 (tails/tails#19450)
5053 - Fetch Tor Browser from our own archive
5054 - Upgrade Tor Browser to 12.0.4-build2
5056 * Upgrade Tor Browser to 12.0.4-build1 (tails/tails!1078)
5059 - Upgrade to Tor Browser 12.0.4 based on Firefox 102.9 (tails/tails#19450)
5062 - workaround failure
5063 - Fetch Tor Browser from our own archive
5064 - Upgrade Tor Browser to 12.0.4-build1
5066 * Fix root exporting unsafe env (tails/tails!1067)
5069 - LPE via Environment Key Injection (tails/tails#19464)
5072 - remove inaccurate type hint
5073 - Revert "tails-additional-software: Fix string returned instead of int"
5074 - tails-additional-software: Fix logging command
5075 - tails-additional-software: Fix string returned instead of int
5076 - tails-additional-software: Log stderr of the executed command to Journal
5077 - tails-additional-software: Fix _ (gettext.gettext) not defined
5078 - tails-additional-software: Add type hints
5079 - tails-additional-software: Print logs of apt hooks to journal
5080 - Remote shell: Don't capture stderr of "sh_spawn" commands
5081 - tailslib: Make code easier to read
5082 - Start tails-dump-user-env.service automatically again
5083 - Revert "workaround failure"
5084 - 10-tor.sh: Remove obsolete wait loops
5085 - run-with-user-env: Depend on tails-dump-user-env.service
5086 - run-with-env: Fix current environment not passed to the command
5087 - tails-additional-software: Log stderr of the executed command
5088 - let's use standard logging methods
5089 - Remote shell: Fix some log output not printed to stderr
5090 - Apply 1 suggestion(s) to 1 file(s)
5091 - Rename exec-with-env -> run-with-env
5092 - INHERIT_FD is needed for connect-drop to work
5093 - port exec-with-env to argparse
5095 - Use exec in some places
5096 - tails-dump-user-env.service: Be explicit about which users the service should
5098 - userenv.py: Don't use current env in read_allowed_env_vars_from_file
5099 - dump-user-env: Use logging module
5100 - userenv.py: Fix all env vars from the current env passed
5101 - exec-with-env: Move read_allowed_env_vars_from_file() to userenv.py
5102 - exec-with-env: Only export allow-listed environment variables
5103 - tailslib: Move NOSYMFOLLOW_MOUNTPOINT back to tps package
5104 - exec-with-env: Fix error message
5105 - dump-user-env: Fix error message
5106 - dump-user-env: Don't set $EUID
5107 - userenv.py: Log invalid environment variables
5108 - dump-user-env: Only dump specific environment variables
5109 - Remote shell: Remove unused imports
5110 - Test Suite: Use "systemctl poweroff" instead of "poweroff"
5111 - Remote shell: Don't fail if user env is not found
5112 - Remote shell: Use user env in commands executed as root
5113 - refactor: Rename loadenv-exec -> exec-with-env
5114 - Run tails-additional-software-notify as amnesia with user env
5115 - exec-with-user-env: Fix comment and add usage message
5116 - refactor: Rename launch_x_application -> run_with_user_env
5117 - refactor: Rename gnome-env -> user-env
5118 - dump-user-env: Print error message when required variables could not be set
5119 - tps-frontend-wrapper: Pass current user environment
5120 - Reimplement loadenv-exec in Python
5121 - Replace most usages of gnome_env in Python scripts
5122 - netnsdrop.py: Remove unused argument user
5123 - tails-additional-software-notify: Fix error when printing usage message
5124 - tails-additional-software-notify: Fix unresolved reference '_'
5125 - Replace systemctl-user with exec-in-gnome-env
5126 - Avoid exporting gnome environment file in privileged processes
5127 - Dump gnome-shell env as amnesia
5128 - tails-notify-user: Use consistent indentation
5129 - 20-time.sh: Don't export amnesia-controlled gnome env
5130 - tailslib: Don't export gnome env
5131 - Test suite: Fix unset environment variables evaluating to true
5132 - tca-portal: Support setting debug log level via environment and kernel cmdline
5134 * Sanitize input (tails/tails!1058)
5137 - LPE via Environment Key Injection (tails/tails#19464)
5140 - sanitize WAYLAND_DISPLAY
5143 * Test new tps functionality (tails/tails!1052)
5146 - Ensure Cucumber tests cover new tps functionality (tails/tails#19225)
5149 - Quote variable used in shell command
5150 - rubocop --auto-correct
5151 - Test Suite: Improve Gherkin of "Creating a Persistent Storage" scenario
5152 - Test Suite: Add scenario "Changing the Persistent Storage passphrase"
5153 - Test Suite: Add scenario "Activating and deactivating Persistent Storage
5155 - Test Suite: Add scenario "Creating a Persistent Storage"
5157 * Test suite: Fix step "the clearnet user has not sent packets out to the
5158 Internet" (tails/tails!1074)
5161 - Test suite step "the clearnet user has not sent packets out to the Internet" is
5162 now irrelevant to Unsafe Browser (tails/tails#19370)
5166 - Test suite: Add anti test for packets sent by the Unsafe Browser
5167 - Test suite: Fix step "the clearnet user has not sent packets out to the
5170 * Remove custom window-center extension (tails/tails!1072)
5173 - Consider replacing our custom window-center GNOME Shell extension with the
5174 center-new-windows Mutter option (tails/tails#19489)
5177 - Remove custom window-center extension
5179 * 10-tor.sh: Add log output (tails/tails!1070)
5182 - Remote shell: Improve log output
5183 - 10-tor.sh: Add log output
5185 * Use zram (tails/tails!1064)
5188 - Consider using zram (tails/tails#5740)
5191 - remove unused variable
5192 - chdir / makes paths more predictable
5193 - move swapon.tails in its own file
5194 - 05-replace_swapon: Use exec to run the original swapon
5195 - 05-replace_swapon: Improve device check
5196 - 05-replace_swapon: Fail if any argument contains non-zram device
5200 * Welcome Screen: UI changes (tails/tails!1063)
5203 - Help new users understand better the encryption model (#18732)
5204 - Test suite: Make output easier to search for
5205 - Remote Shell: Automatically restart service when it fails
5206 - Test Suite: Use Dogtail to check if the Greeter has started
5207 - Test Suite: Avoid spamming log with stacktrace of the same error
5208 - Test Suite: Fix failure because of outdated screenshot
5209 - Test Suite: Use Dogtail to open GNOME Shell menus
5210 - Test Suite: Use Dogtail for some Greeter steps
5211 - Welcome Screen: Fix excessive height
5212 - Welcome Screen: Replace passphrase entry placeholder with a label
5213 - Welcome Screen: Align section header icons / link buttons
5214 - Welcome Screen: Remove unnecessary GtkBox
5215 - Welcome Screen: Update label
5216 - Welcome Screen: Update string shown when Persistent Storage is unlocked
5218 * Upgrade to Linux 6.1.12-1 from sid (stable branch) (tails/tails!1062)
5221 - Upgrade Linux kernel to 6.1.7+ (tails/tails#19444)
5224 - Test suite: disable bridge QR code automated tests
5225 - Upgrade to Linux 6.1.12-1 from sid
5227 * Welcome Screen: Don't allow unlocking with empty passphrase (tails/tails!1059)
5230 - Disable "Unlock" button until a passphrase has been entered (tails/tails#19357)
5233 - Welcome Screen: Don't allow unlocking with empty passphrase
5235 * Upgrade to Linux 6.1.12-1 from sid (devel branch) (tails/tails!1055)
5238 - Test suite: relax timeout
5239 - Test suite: disable bridge QR code automated tests
5240 - Upgrade to Linux 6.1.12-1 from sid
5242 * tps: Fix strings not translatable (tails/tails!1053)
5245 - Missing translations of UI strings about Persistent Storage (tails/tails#19415)
5248 - tails-backup: Fix strings not translatable
5249 - tps: Fix strings not translatable
5251 * Set screencast feature to never stop automatically (#12723) (tails/tails!1049)
5254 - Set screencast feature to never stop automatically (#12723)
5256 * Avoid double negation (tails/tails!1048)
5260 - Avoid double negation
5262 * Unlock VeraCrypt Volumes: Use Gtk.show_uri_on_window to open directories
5266 - Opening VeraCrypt volume spawns zombie process (tails/tails#19423)
5269 - Unlock VeraCrypt Volumes: Use Gtk.show_uri_on_window to open directories
5271 * Enable non-free-firmware archive area for distributions that support it
5275 - devel FTBFS (tails/tails#19456)
5276 - devel branch FTBFS: uBlock diff (tails/tails#19398)
5277 - Enable non-free-firmware APT component (tails/tails#19411)
5280 - fix FTBFS: patch wasnt applying
5281 - Fix FTBFS by installing b43-fwcutter from bullseye instead of sid
5282 - Bump the debian APT snapshot to one that supports the non-free-firmware archive
5284 - Enable non-free-firmware archive area for distributions that support it
5286 -- Tails developers <tails@boum.org> Sat, 18 Mar 2023 15:21:33 +0000
5288 tails (5.10) unstable; urgency=medium
5290 * Upgrade Tor Browser to 12.0.3-build1 (tails/tails!1046)
5293 - Upgrade to Tor Browser based on Firefox 102.8 (tails/tails#19412)
5296 - Fetch Tor Browser from our own archive
5297 - Upgrade Tor Browser to 12.0.3-build1
5299 * Avoid symlink attack when writing amnesia owned file as root (tails/tails!1038)
5301 Dennis Brinkrolf discovered a privilege escalation in Tails 5.9:
5302 an adversary, who can already run arbitrary code as the amnesia user,
5303 could escalate their privileges to reading arbitrary files on the
5304 system. It might be possible to use this as part of an exploit chain
5305 to gain full root privileges.
5308 - Privilege escalation via Dotfiles, sudo, and gnome-shell-save-environment
5312 - clarify/acknowledge security limitations
5314 - Avoid symlink attack when writing amnesia owned file as root
5316 * Stop some dbus proxies when they are unneeded (tails/tails!1019)
5319 - Keyboard input sometimes not working in Tor Connection and Tor Browser
5323 - Rewrite dbus proxy code
5324 - Only run Tor Browser dbus proxy services when needed
5325 - Only run Onion Circuits dbus proxy service when needed
5326 - Automatically start dbus proxy service when Onion Circuits is started
5327 - Automatically start dbus proxy service when Tor Browser is started
5329 * tps: Treat unmounted partition as locked (tails/tails!1043)
5332 - tps-frontend lets user activate features when the Persistent Storage LUKS was
5333 not fully set up (tails/tails#19352)
5336 - tps: Treat unmounted partition as locked
5338 * Upgrader: don't crash when a download is interrupted and then resumed
5342 - Upgrader: don't crash when a download is interrupted and then resumed
5344 * tps: Bump the unlocking timeout to 120 seconds (tails/tails!1039)
5347 - Persistent Storage fails to unlock: timeout (tails/tails#19432)
5350 - tps: Bump the unlocking timeout to 120 seconds
5352 * Test suite: adjust to updated Tor Browser localization in German
5356 - Test suite step "the support documentation page opens in Tor Browser" is broken
5357 in German (tails/tails#19419)
5360 - Test suite: relax our expectations, again
5361 - Test suite: adjust to updated Tor Browser localization in German
5363 * Small fixes on Persistent Storage UI (tails/tails!1032)
5368 - Update doc-source-relationships.yml
5369 - Replace: 'doc/first_steps/persistence' with 'doc/persistent_storage'
5371 - Avoid confusing future tense
5376 - Improve error message
5377 - Be more helpful in UI
5379 * GitLab CI: remove lint-latest-po job (tails/tails!1031)
5382 - Fix lint-latest-po (tails/tails#19378)
5385 - GitLab CI: remove lint-latest-po job
5387 * Welcome Screen: Avoid starting Persistent Storage app on each login
5391 - Remove Welcome Screen persistent settings hack (tails/tails#19062)
5392 - Persistent Storage settings always opened after login (tails/tails#19410)
5395 - still renaming directories
5396 - Improve comment documenting Welcome Screen settings design
5397 - Rename Welcome Screen settings directories
5398 - document Welcome Screen settings design
5399 - Remove workaround for persistent Welcome Screen settings directory
5400 - Welcome Screen: Avoid starting Persistent Storage app on each login
5402 * Update our doc to the new Persistent Storage (tails/tails!1024)
5406 - Remove old issue and work around
5408 - Add a bit more doubt
5409 - Add dummy changelog entry for 5.10.
5410 - Remove UDFs for versions we'll never release
5414 - This file is not about persistence anymore
5415 - Update cross-references
5418 - Update cross-references
5420 - Give more visibility
5421 - Reorder by importance
5423 - Integrate FAQ into doc
5425 - Remove Persistent Storage from installation doc
5426 - Move last warning to a better place
5428 - Remove useless warning
5429 - Integrate warning in doc
5431 - Remove screenshots
5432 - Layer the information
5433 - Remove CSS classes
5434 - Complete procedure
5435 - Update list of features
5436 - Rewrite in Markdown and improve style
5438 - Update to new Persistent Storage
5439 - Move instructions to use the Persistent Storage to a dedicated page
5442 - Add subsections and TOC
5443 - Reorder features as in new interface
5444 - Update to new Persistent Storage
5445 - Update to new Persistent Storage
5446 - Rename as Markdown file
5447 - Deduplicate content
5449 - Add missing alt tags
5450 - Update to new Persistent Storage
5451 - Update doc to #19338
5452 - Add missing alt tags
5453 - Use more consistent terminology
5456 - Remove unused page
5458 - Rename more pages and images
5459 - Merge inline in the only place where it was used
5460 - Create a dedicated doc section about the Persistent Storage
5461 - Deactivate trail plugin
5462 - Remove CSS about traillink
5463 - Remove traillink from templates
5464 - Remove HTML tags in Markdown
5465 - Remove traillink directives (#18951)
5466 - Explain better how to exchange with another Linux
5467 - Move long warning and FAQ to a dedicated page
5468 - Improve warning on opening from another OS
5469 - Remove unactionable warning
5471 - Improve style guide
5475 - Split Persistent Storage creation and configuration
5477 * FIX Persistent Greeter options scenario (tails/tails!1021)
5480 - "Persistent Greeter options" test case is broken (tails/tails#19397)
5484 - login button in german, too
5485 - fix more images for German greeter
5486 - Fix test suite regexp
5487 - new images for persistent language
5488 - FIX Persistent Greeter options scenario
5490 * No predictable names in /tmp (tails/tails!1018)
5493 - Don't use predictable names in /tmp (tails/tails#19389)
5496 - Don't use predictable names in /tmp
5497 - Use service name without variables
5499 * tps: Ask for confirmation when Persistent Storage exists but is not unlocked
5503 - Confirm when starting without unlocking the Persistent Storage
5507 - Test Suite: Check if the confirmation dialog is displayed
5508 - Test suite: Fix "I log in to a new session" step failing
5509 - tps: Ask for confirmation when Persistent Storage exists but is not unlocked
5511 -- Tails developers <tails@boum.org> Wed, 15 Feb 2023 09:44:33 +0000
5513 tails (5.9) unstable; urgency=medium
5515 * Update tor to 0.4.7.13 (tails/tails!1013)
5518 - Upgrade to Tor 0.4.7.13 (tails/tails#19377)
5521 - Update tor to 0.4.7.13
5523 * Resolve "Upgrade to Tor Browser based on Firefox 102.7" (tails/tails!1012)
5526 - Upgrade to Tor Browser based on Firefox 102.7 (tails/tails#19360)
5529 - Fetch Tor Browser from our own archive
5530 - Upgrade Tor Browser to 12.0.2-build1
5532 * tps: Increase timeout of activate call (tails/tails!1006)
5535 - tps logs passphrase in cleartext in debug mode (tails/tails#19350)
5536 - Persistent Storage fails to activate: timeout (tails/tails#19347)
5539 - tps: Don't print status of NetworkManager.service to stdout
5540 - tps: Bump the activation timeout to 120 seconds
5541 - tps: Add log messages
5542 - tps: Log line which called executil helper functions
5544 * Troubleshooting mode: stop passing options that can only break stuff
5548 - Reconsider Troubleshooting Mode kernel command line wrt. Wayland
5552 - Troubleshooting mode (syslinux): stop passing options that can only break stuff
5553 - Troubleshooting mode (EFI): stop passing options that can only break stuff
5555 * Upgrade to Linux 6.0 (tails/tails!996)
5558 - Add randomize_kstack_offset=1 to boot parameters (tails/tails#19023)
5559 - Enable BPF JIT hardening (tails/tails#19345)
5560 - Upgrade to Linux 6.0 (tails/tails#18467)
5563 - Test suite: allow the pattern to cover slightly less of the write cache
5564 - Revert renaming of /etc/amnesia/version to /etc/tails/version
5565 - Move "set -eu" to a better location
5566 - Test suite: remove dead code
5567 - Test suite: drop check about tails-version output
5568 - Upgrade to Linux 6.0.12-1~bpo11+1
5569 - early_patch: implement the initramfs-tools' "prereqs" interface
5570 - initramfs: stop including SCSI drivers
5571 - initramfs: bring back including all DRM modules
5572 - Always log the size of the initramfs
5573 - initramfs: remove support for AFS and CIFS
5574 - initramfs: remove support for PCMCIA and parallel port
5575 - initramfs: don't include firmware for drivers we removed
5576 - initramfs: remove sunrpc support
5577 - initramfs: remove a bunch more SCSI drivers
5580 - Include fewer modules in the initramfs
5581 - Compress the initramfs with the most space-efficient XZ compression level
5582 - Simplify how we set initramfs compression algorithm
5583 - Hardening: turn on BPF JIT hardening, if the JIT is enabled.
5584 - Fix headings levels
5585 - Hardening: randomize kernel stack offset on syscall entry
5586 - initrd: install privacy screen provider drivers
5587 - Upgrade to Linux 6.0.3-1~bpo11+1 from bullseye-backports
5588 - Enable bullseye-backports APT source
5589 - Rename config/amnesia to config/variables
5590 - Rename /etc/amnesia to /etc/tails
5591 - Deprecate /usr/share/doc/amnesia/
5592 - The thing is called Tails
5593 - Drop support for config/amnesia.local
5595 - Rename $AMNESIA_* variables
5596 - Remove unused variables
5598 * Tor Connection: Hide "Fix clock", "Proxy", and "Captive Portal" when time sync
5599 was successful already (tails/tails!986)
5602 - Add label to bridge line on the error screen (tails/tails#19332)
5603 - Hide "Fix clock", "Proxy", and "Captive Portal" when time sync was successful
5604 already (tails/tails#19171)
5607 - Make it easier to reason about state transitions
5608 - Tor Connection: simplify test
5609 - Tor Connection: improve phrasing
5610 - Tor Connection: make phrasing consistent
5611 - Tor Connection: tell the user when we know their network is blocking access to
5613 - Tor Connection: explain what bridges are on the error screen
5614 - Tor Connection: rename "Bridge by email" section on the error screen
5615 - Tor Connection: add label to bridge line on the error screen too
5616 - Tor Connection: fix alignment of "Send an empty email" string
5617 - Tor Connection: Hide "Fix clock", "Proxy", and "Captive Portal" when time sync
5618 was successful already
5619 - Name widgets so we can act on them
5620 - Tor Connection: make log message somewhat clearer
5621 - Tor Connection: remember the result of tails-get-network-time
5623 * tps: Fix handling of symlink bindings (tails/tails!1009)
5626 - Persistent Storage sometimes fails to activate Dotfiles (tails/tails#19346)
5629 - tps behave-tests: Support passing flags to behave
5630 - tps behave-tests: Test source directory with symlink
5631 - tps behave-tests: Add README
5632 - tps: Fix BEHAVE_DEBUG_ON_ERROR feature of the behave tests
5633 - tps: Improve log messages
5634 - tps-frontend: Improve log and error messages
5635 - tps-frontend: Fix log level of message
5636 - tps: Fix activation of symlink bindings failing
5637 - tps: Fix log message
5638 - tps: Improve error message
5639 - tps: Fix Activate call failing with spurious error
5640 - tps: More useful error message
5642 * tps: Don't log parameters which can contain secrets (tails/tails!1005)
5645 - tps logs passphrase in cleartext in debug mode (tails/tails#19350)
5648 - tps: Don't log parameters which can contain secrets
5650 * Do not hide the GTK3 “application menu” button in title bars (tails/tails!1004)
5653 - Cannot access GTK3 application menus in Tails 5.8 / Wayland (tails/tails#19371)
5656 - Do not hide the GTK3 “application menu” button in title bars
5658 * Fix Tor Browser homepage localization when started from Tor Connection
5662 - Tor Browser homepage is not localized when started from Tor Connection
5668 - Fix Tor Browser homepage localization when started from Tor Connection
5670 * Update tails@ key (tails/tails!1001)
5673 - Test suite: ensure OpenPGP keys test is run when the only change on the branch
5677 * Pull non-website PO files from Weblate (tails/tails!1000)
5680 - Pull non-website PO files from Weblate (tails/tails#19322)
5683 - import-translations: remove obsolete reference to Transifex
5684 - import-translations: drop support for excluding languages
5685 - generate-languages-list: workaround the fact we can't distinguish reviewed
5686 translations from non-reviewed ones
5687 - Pull non-website PO files from Weblate
5689 * Make a few user-facing strings localizable (tails/tails!998)
5692 - Not localized (internationalized) strings (tails/tails#19349)
5695 - Integrate the Welcome Screen's main_window.py into our l10n framework
5697 - Make a few user-facing strings localizable
5699 * Autocorrect Rubocop violations (tails/tails!997)
5703 - Test suite: run rubocop --autocorrect
5705 * Improve wording of backup utility (tails/tails!995)
5708 - Improve wording of backup utility (tails/tails#19348)
5711 - Test suite: adjust to new UI wording
5712 - Use more consistent wording
5716 * Fix newly discovered shellcheck violations (tails/tails!994)
5719 - Fix "lb build" exit code reporting
5720 - Add missing quotes
5722 * Remove scrollbar in Favorites (tails/tails!992)
5725 - Need to scroll to see all Favorites (tails/tails#19338)
5728 - Apply 1 suggestion(s) to 1 file(s)
5729 - Test suite: fix "the screen keyboard works in Tor Browser"
5731 - Test suite: remove dead code
5732 - Test suite: retry opening new tab
5733 - Test suite: ensure Tor Browser has loaded the home page before we continue
5734 - Test suite: spam Tor Browser less intensively
5735 - Test suite: remove unused code
5736 - Test suite: start Tor Browser and Thunderbird by typing their name
5737 - Test suite: fix typo in comment
5738 - Remove scrollbar in Favorites
5740 * Remove dead code about TAILS_WIKI_SUPPORTED_LANGUAGES (tails/tails!991)
5743 - WhisperBack: don't try to include non-existing tails-greeter.errors file
5744 - WhisperBack: don't try to include non-existing xorg.conf
5745 - Remove l10n plumbing for WhisperBack configuration file
5746 - Remove obsolete .xsessionrc
5748 - WhisperBack config: remove dead code
5750 * Test suite: fix Unsafe Browser localization test in French (tails/tails!988)
5753 - Test suite: fix Unsafe Browser localization test in French
5755 * Revert "Run Qt applications as native Wayland by default" (tails/tails!987)
5758 - Remove obsolete config/chroot_local-includes/usr/share/live/config/xserver-
5759 xorg/*.ids (tails/tails#19330)
5760 - Qt AppImages broken on Tails 5.8 (tails/tails#19326)
5761 - Clipboard encryption/decryption with Kleopatra is broken on Wayland
5763 - can't paste into unlock password field in KeepassXC in Tails 5.8
5767 - Remove obsolete per-device X.Org driver override via live-config
5768 - Revert "Don't run OnionShare as a native Wayland app"
5769 - Revert "Run Qt applications as native Wayland by default"
5771 * Remove the warning dialog when starting the Unsafe Browser (tails/tails!985)
5774 - Explain better the Unsafe Browser from Tor Connection (tails/tails#19168)
5777 - Test suite: adjust to removed warning dialog
5778 - Remove the warning dialog when starting the Unsafe Browser
5780 * Make the Upgrader use the mirror redirector (tails/tails!983)
5783 - Upgrader: use dedicated SocksPort with no stream isolation
5784 - Test suite: remove test whose cost/benefit has become very high
5785 - Test suite: apply user-facing terminology
5786 - Design doc: remove outdated details
5787 - Remove now unused mirror-pool-dispatcher submodule
5788 - Design doc: update what the fallback DNS pool is used for
5789 - Drop dead code, obsolete dependencies, and obsolete tweaks
5790 - Upgrader: Drop the "replace URL with a random one from the mirror pool JSON"
5791 and "fallback to DNS pool" mechanisms
5792 - Upgrader: bring back explanation when impossible to do an incremental upgrade
5793 - IUK test suite: adjust to 888b78811bcd156284d01a063d448f6bd693db22
5794 - Design doc: use new download URI in example UDFs
5795 - Generate UDFs that point to the mirror redirector for ISO and IUK downloads
5797 * Welcome Screen: restore ability to login with default settings by pressing
5798 "Enter" (tails/tails!982)
5801 - Login with default settings now requires pressing "Enter" twice in the Welcome
5802 Screen (tails/tails#19323)
5805 - Welcome Screen: restore ability to login with default settings by pressing
5808 * switch Persistent Storage icon to SVG (tails/tails!980)
5811 - Replace Persistent Storage icon with SVG version (tails/tails#19316)
5814 - Also use the SVG icon in the Welcome Screen
5815 - Switch Persistent Storage icon to SVG
5817 -- Tails developers <tails@boum.org> Mon, 23 Jan 2023 11:53:31 +0100
5819 tails (5.8) unstable; urgency=medium
5821 * Upgrade Thunderbird to 102.6.0-1~deb11u1
5823 * Fix FTBFS: refresh patch (tails/tails!965)
5828 - Fix FTBFS: refresh patch
5830 * Update tor browser to 12.0.1 (tails/tails!979)
5835 - Fetch Tor Browser from our own archive
5836 - Upgrade Tor Browser to 12.0.1-build1
5838 * Enable bullseye-proposed-updates (to test Bullseye 11.6 before it's released),
5839 upgrade to Linux 5.10.158 (tails/tails!975)
5841 Closes #19301, #19293
5844 - After disabling the Tor Configuration persistence feature, only start Tor
5845 Connection if we're connected to a local network
5846 - Also consider the Linux kernel from bullseye-updates
5847 - Install the Linux kernel from bullseye-proposed-updates, if that suite is
5849 - Test suite: remove unused image
5850 - Upgrade to Linux 5.10.158-1
5851 - Enable bullseye-proposed-updates, to test Bullseye 11.6 before it's released
5852 - Bump snapshot of the Debian archive to 2022121302, so we can use proposed-
5853 updates for Bullseye 11.6
5855 * Test suite: make keyboard input more reliable (tails/tails!971)
5858 - Test suite: increase sleep time at the end of Screen#type
5859 - Test suite: correct comment
5860 - Test suite: keep keys pressed for 40 ms
5861 - Test suite: improve comment
5862 - Test suite: keep keys pressed for 20 ms instead of 10 ms
5863 - Test suite: update comment
5865 * Fix Dotfiles access for non-root users (tails/tails!968)
5870 - Fix dotfiles access for non-root users
5872 * Adapt to Wayland our error reporting mechanism when GDM fails to start
5878 - resorting to X.Org → crash → better UX!
5879 - Adapt to Wayland our error reporting mechanism when GDM fails to start
5881 * Switch from bullseye-proposed-updates to Bullseye 11.6 (tails/tails!978)
5886 - Revert "Enable bullseye-proposed-updates, to test Bullseye 11.6 before it's
5888 - Bump APT snapshots
5890 * Tor Connection UI improvements (tails/tails!977)
5892 Closes #19238, #19256, #19169, #19172
5895 - Tor Connection: fix window size
5896 - Fix links from Tor Connection to the offline documentation
5897 - Tor Connection: fix typo in string
5898 - Tor Connection: display QR code scanning error below the scanning button
5899 - Add label to bridge line
5901 * Persistent Storage: use new icon (tails/tails!976)
5904 - Use the new Persistent Storage icon on the Welcome Screen when the Persistent
5905 Storage does not exist yet
5906 - Persistent Storage: use new icon
5908 * Allow persisting bridge scanned from QR code, take 1 (tails/tails!973)
5913 - Allow persisting bridge scanned from QR code, take 1
5915 * Update tor to 0.4.7.12 (tails/tails!972)
5920 - Update tor to 0.4.7.12
5922 * fix window centering (tails/tails!970)
5927 - Ensure extension description matches what it actually does
5928 - gdm-tails is a GDM session, with extension support
5929 - more comments to clarify subtleties
5930 - check which session we're in is more to the point
5932 - Apply 1 suggestion(s) to 1 file(s)
5933 - stop "when it's done" , not predefined time
5934 - window-centering only runs in GDM
5936 - rounding is needed to avoid false moves
5937 - better comments and log messages
5938 - Revert "avoid useless CPU work"
5939 - avoid useless CPU work
5940 - extensions are disabled in GDM: workaround
5941 - window centering in Greeter
5943 * Remove static suggestion of diceware passphrase (tails/tails!969)
5948 - Remove static suggestion of diceware passphrase
5950 * Allow disabling the Unsafe Browser (tails/tails!967)
5955 - fix "I disable the Unsafe Browser" in corner cases
5956 - adapt Greeter options persistence
5957 - fix test suite for new wording
5958 - Adjust to the Unsafe Browser being disabled by default
5960 - Enable Unsafe Browser by default
5961 - Revert "Welcome Screen: always enable the Unsafe Browser and make the setting
5964 * Misc Persistent Storage fixes for 5.8 (tails/tails!966)
5966 Closes #19220, #19279, #19280, #19148, #19294
5969 - Don't run OnionShare as a native Wayland app
5970 - Run Qt applications as native Wayland by default
5971 - Allow running Qt applications as native Wayland
5972 - Remove Dasher (broken on Wayland)
5973 - Tell the user what's going on while deleting Persistent Storage
5974 - When Persistent Storage is unlocked, instruct how to delete it
5975 - Persistent Storage: add missing link to doc on the features screen
5977 * FIX --disable-chutney (tails/tails!961)
5980 - FIX --disable-chutney
5982 * Tor Connection: select "Ask for a bridge by email" by default when "Hiding"
5988 - Make it easier to scan a QR code
5989 - Tor Connection: select "Ask for a bridge by email" by default when "Hiding"
5991 * Tor Connection: display percentage on the connection progress bar
5995 - Tor Connection: display percentage on the connection progress bar
5997 * TPS explanation strings, and more (tails/tails!947)
6002 - remove vague comment
6005 - explanation strings for relevant TPS features
6007 * Additional Software: ensure APT is not broken after being interrupted
6013 - Additional Software: ensure APT is not broken after being interrupted
6015 * Test suite: relax our expectations for coverage of the known pattern in memory
6019 - Test suite: relax our expectations for coverage of the known pattern in memory
6021 * create persistent storage from the greeter (tails/tails!922)
6026 - change wording following the new style
6027 - comment to explain flag files
6029 - Apply 3 suggestion(s) to 3 file(s)
6031 - greeter test suite code refactor
6032 - checking early is useless and ineffective
6033 - FIX look at the actual value
6034 - big code refactoring
6035 - actually handle button
6036 - better size and margins for padlock
6037 - make label the same in glade and python
6038 - remove suggested-action
6039 - Reorder in greeter
6040 - Better real estate use
6041 - draft: automated tests
6042 - "don't create" is not a suggested-action
6043 - Clearer state management in UI
6044 - actually start persistent storage setup
6045 - draft: create persistent storage from greeter
6047 * Upgrade Tor Browser to 12.0 (tails/tails!921)
6049 Closes #19135, #19085
6052 - Test suite: bump timeout
6053 - Make code more readable
6054 - Fetch Tor Browser from our own archive
6055 - Upgrade Tor Browser to 12.0
6056 - Test suite: fix "Downloading files with the Tor Browser" scenario with Tor
6057 Browser 12 on Wayland
6058 - Test suite: improve comment phrasing
6059 - Test suite: only compute keymap once in Screen#press
6060 - Test suite (mouse_location): remove unused method parameters
6061 - Fix buggy (invisible) conflict resolution from rebase
6062 - Turn off shellcheck false positive
6063 - Drop obsolete mentions of $TBB_EXT
6064 - Drop import of library that's not needed anymore
6065 - Update handling of Tor Browser locales
6066 - Fix location for Burmese
6067 - Declare newly added Tor Browser locales
6068 - Don't try to install non-existing langpacks
6069 - Tor Browser update process: there's no langpacks anymore
6070 - Fetch Tor Browser from our own archive
6071 - Upgrade Tor Browser to 12.0a5
6072 - Upgrade Tor Browser to nightly.2022.11.22
6073 - Thunderbird: avoid proxy bypass, same as Tor Browser
6074 - Test suite: Unsafe Browser has no bookmarks at all anymore
6075 - Unsafe Browser: delete default bookmarks
6076 - Test suite: update expected images
6077 - Test suite: update expected images
6078 - Upgrade Tor Browser to 12.0a4
6079 - Thunderbird: replace network.security.ports.banned pref with
6080 network.proxy.allow_hijacking_localhost
6081 - Tor Browser: remove network.security.ports.banned pref, which does more harm
6083 - Update AppArmor policy for Tor Browser 12
6084 - Test suite: update expected images for Tor Browser 12
6085 - Test suite: update expected Unsafe Browser images for Tor Browser 12
6087 - Remove unused variable
6088 - Test suite: update expected images for Tor Browser 12
6089 - Test suite: remove obsolete complexity
6090 - Test suite: update for new "New Identity" UX in Tor Browser 12
6091 - Test suite: spam Tor Browser less intensively
6092 - Test suite: refactoring (DRY)
6093 - Test suite: update expected image
6094 - Test suite: spam Tor Browser less intensively
6095 - Test suite: add support for Tor Browser nightly builds
6098 - Drop unused flexibility
6099 - Remove obsolete variable
6100 - Adjust to multilingual Tor Browser tarball
6101 - Adjust to script being renamed upstream
6102 - Upgrade Tor Browser to nightly.2022.10.19
6103 - Tor Browser upgrade doc: support nightly builds, assume multilingual tarball
6104 - Upgrade Tor Browser to 12.0a3
6105 - Unsafe Browser: also apply branding to brand.properties
6106 - Fix grammar in comment
6107 - Unsafe Browser: don't ask confirmation when quitting with CTRL+q
6108 - Test suite: update Unsafe Browser images
6109 - Test suite: add expected unused Tor Browser library
6110 - Test suite: adjust to Tor Browser 12's (Firefox 102) new download flow
6111 - Upgrade Tor Browser to 12.0a2
6114 -- Tails developers <tails@boum.org> Mon, 19 Dec 2022 09:43:26 +0000
6116 tails (5.8~beta1) unstable; urgency=medium
6118 * Rewrite the Persistent Storage settings in Python (tails/tails!897)
6120 Closes: #17803, #15142, #11529, #15827, #7002, #18008, #17331, #7503, #19130, #16061, #15313
6123 - Change test case to reflect what we wanted
6124 - Really disable broken Thunderbird test
6125 - fix reload-connections hook during greeter
6126 - clarify Mount.__str__ from persistence.conf format
6127 - one more type hint
6128 - remove a (never used) systemd alias
6129 - symlink_to ignores the second argument.
6130 - sort hook execution
6133 - Reset Tor configuration when deactivating the corresponding Persistent Storage
6135 - Don't install/upgrade Additional Software unless the corresponding persistent
6136 directories are mounted
6137 - Don't try to create Persistent Storage when the system partition is not called
6139 - Don't try to create Persistent Storage on non-GPT device
6140 - Persistent Storage creation: use UI strings from the design
6141 - Add ssh as a conflict app for the SSH client feature
6142 - Move "Tor Browser Bookmarks" to Applications section of Persistent Storage
6144 - Save with Glade 3.40.0
6145 - Reload NetworkManager connections when activating/deactivating the
6146 corresponding Persistent Storage feature
6147 - tps-frontend: fix icons path
6148 - Stop setting custom permissions on /var/lib/live/config
6149 - WhisperBack: don't include obsolete file in the attached technical info
6150 - CUPS: update configuration files as soon as possible
6151 - Restart CUPS after enabling/disabling the Printers persistent storage feature
6152 - Remove incorrect comment
6153 - Remove function that's not used anymore
6154 - tails-additional-software-config: adjust to new Persistent Storage
6156 - Refactoring: move method to library
6157 - Revert "Test suite: workaround regression in Additional Software"
6158 - tails-additional-software: don't wait for tps-frontend to complete before
6159 writing contents to live-additional-software.conf
6161 - launch_x_application: drop feature we don't need anymore
6162 - Add exceptions for Bandit false positives
6163 - Use long option name
6164 - Harden sudo configuration
6165 - Revert "Test suite: add temporary workaround for tps buggy user story wrt.
6167 - Fix the user story for Dotfiles
6169 - tps: document behavior that can be surprising
6170 - TCA: fix setup of persistent bridge switch widget
6171 - Remove unused script and service
6172 - Test suite: remove obsolete workaround
6173 - TCA: drop useless code
6174 - TCA: fix localization of window title
6175 - Remove unused copied'n'pasted constant
6176 - TCA: mediate reading/writing from/to tca.conf via tca-portal
6177 - Update logger's name: "tor-launcher" does not mean anything in this context
6179 - Remove unused import
6180 - TCA: remove unused import
6181 - TCA: fix type of argument
6182 - Don't allow deleting an unlocked Persistent Storage
6183 - Drop incomplete attempt to support unlocking Persistent Storage after login
6184 - Unsafe Browser: adjust to the removal of persistence_is_enabled in tails-
6187 - Remove useless customization
6188 - Fix typo in docstring
6189 - Add Synaptic, apt-get, and dpkg as conflicting apps for the Additional Software
6190 persistent storage feature
6191 - Remove "XXX" comment: this is about further improving a feature that was not
6192 even planned in the design
6193 - Remove "XXX" comment: already tracked on the issue
6195 - Remove "XXX" comment: moved to the issue
6197 - Fix variable type mismatch
6198 - Remove "XXX" comment: moved to the issue
6199 - Remove "XXX" comment
6201 - Remove "XXX" comment: let's not translate stuff that the user has no chance to
6203 - Remove "XXX" comment: moved to the issue
6204 - Test suite: fix Gherkin When/Then semantics
6205 - Test suite: fix backup scenario
6206 - Remove unused import
6207 - Test suite: refactoring (extract code to method)
6208 - Revert "Test suite: adjust for increased TimeoutStopsec= (refs: #17278)"
6209 - Test suite: check earlier that Additional Software is correctly configured
6210 - Test suite: workaround regression in Additional Software
6211 - Test suite: minor refactoring
6212 - Additional Software: add more accurate wait loop
6214 - Additional Software: don't run tps a second time
6215 - Additional Software: drop unsupported and now useless options
6216 - mypy: enable a few more checks
6217 - mypy: ignore gi and gi.repository
6218 - Help mypy discover our Python libraries
6220 - Fix comment phrasing
6221 - Fix activating Additional Software with an unlocked persistent storage
6222 - Test suite: use shortcut
6223 - Test suite: continue adapting to new UI
6224 - Remove obsolete scripts
6225 - Test suite: drop the Persistent Storage configuration file unit tests
6227 - Ignore flake8 false positives
6228 - tps test suite: make config_file_test support the case when udisks is not
6230 - Fix typo in comment
6231 - GitLab CI: drop test-persistent-storage-behave
6232 - Fix tps behave tests when a dedicated filesystem is mounted on /tmp
6233 - Add support for debug output without a debugger installed
6237 - Test suite: finish adapting "I delete the persistent partition" to new UI
6238 - Use string from the design
6239 - Fix inverted boolean logic
6240 - Fix typo in comment
6241 - Make it possible to run config_file_test.py without a tails-persistent-storage
6243 - Revert "tps: Change owner of persistence.conf to root"
6244 - Move class docstring where it belongs
6245 - Fix typo in comment
6246 - Test suite: don't test for persistence.conf.bak existence
6247 - Test suite: run the persistence storage behave and config file unit tests
6248 - GitLab CI: add missing dependencies
6249 - GitLab CI: run persistent storage tests in separate jobs
6250 - tps test suite: use larger filesystem to that mke2fs can create a Journal
6251 - Fix typo in comment
6252 - Declare mount flags used by the tps test suite
6253 - tps test suite: use the same mount flags as production
6254 - Sort ExecStartPre before ExecStart, just like their execution order
6255 - Maintain directories with systemd-tmpfiles
6256 - Forbid usage as non-amnesia: this would break stuff
6257 - Simplify code and make bookmark removal an atomic operation
6258 - Do all GNOME bookmarks changes as the amnesia user
6259 - Use canonical directory location
6260 - Protect grep command against special regexp chars
6261 - Revert incomplete split of the Welcome Screen persistence feature
6262 - Welcome Screen: don't allow login until we're fully done activating the
6264 - Remove unused import
6265 - Welcome Screen: point to new issue that tracks a cleanup that's now possible
6266 - Remove unused imports
6268 - Remove unused import
6269 - Don't let tempfile try to delete file that we just renamed
6270 - Don't try (and fail) to refresh features' IsActive when unlocking
6271 - Use different variables names when we're using them to store different data
6273 - Fix comment grammar and clarify
6274 - Test suite: add temporary workaround for tps buggy user story wrt. dotfiles
6275 - Add shellcheck exception
6276 - Test suite: actually enable all persistence presets.
6277 - tps: Remove config file backup functionality
6278 - tps: Make writes to the configuration file atomic
6279 - tps: Fix "invalid boot device" message not shown
6280 - tps: Fix state handling
6281 - tps: Handle expected error that deletion fails because device is busy
6282 - tps: Don't unmount with force
6283 - Remove unused IncorrectOwnerException and IncorrectOwnerError
6284 - Rename test directory
6285 - tps: Remove the obsolete mount test
6286 - GitLab CI: Run the tps config file test
6287 - tps: Fix config file test
6288 - tps: Change owner of persistence.conf to root
6289 - tps: Deactivate features before deleting
6290 - Test suite: start porting to new implementation of Persistent Storage
6291 - Test suite: update referenced class name
6292 - tps: Don't make the tps service exit when closing the app
6293 - tps: Add button to open tails-additional-software-config
6294 - tps: Add labelled-by property to list boxes in features_view.ui
6296 - tps: Print debug log messages when running behave tests
6297 - tps: Make features view accessible to screen readers
6298 - tps: Format features_view.ui with glade
6299 - tps: Use connect-drop
6300 - connect-drop: Avoid opening an additional file descriptor
6301 - actually authenticate to dbus
6302 - Test suite: remove obsolete images
6303 - Persistent Storage frontend: add accessibility relationships
6304 - connect-drop: fix style
6305 - connect-drop: --dbus has help line
6306 - connect-drop: option groups
6307 - connect-drop --env-keep
6308 - connect-drop is now DBus-aware
6309 - WIP: Update Persistent Storage design document
6310 - Update Persistent Storage design document
6311 - tps: Add basic support for custom features
6312 - Clarify branded names
6313 - tps: Add some accessibility information
6314 - tps: Improve layout
6315 - Set executable bit on unlock-veracrypt-volumes
6316 - tps: Use tails-documentation to open doc links
6317 - tps: Add a HACKING.md
6318 - tps: Try again using get_block_for_dev
6319 - tps: Add Tor Configuration feature
6320 - tps: Remove Language and Region feature
6321 - tps: Start implementing language and region feature
6322 - Rewrite Persistent Storage settings in Python (refs: #17803)
6324 * Tor bridges QR code scanning (tails/tails!874)
6329 - match labels between code and tests
6330 - do whatever dogtail wants
6331 - fix labeling in tca
6332 - Test suite: update to new string
6333 - Apply GNOME style guide
6334 - Implement sajolida's new design for bridges input on the error screen
6335 - Polish new bridge input UI
6336 - infobar works in error page, too
6338 - MessageDialog → InfoBar
6339 - scanning QR from error page is tested, too
6340 - test suite refactoring
6341 - adapt QR code automated test to new mockup
6342 - using QR code sets state
6343 - the new mockup now seems to behave
6344 - scan qrcode: new mockup
6345 - change wording for QR code errors
6346 - Test suite: ensure we see the QR code on the screen
6347 - run_test_suite: check recently added dependencies
6348 - WIP: Test suite: add test for QR code scanning feature in Tor Connection
6349 - Reference issue that has more details instead of a commit that lacks context
6350 - Don't load library that we don't use anymore
6351 - show no dialog if the user closes zbarcam
6352 - Ignore zbarcam output if it arrives too late
6353 - Add the v4l2loopback kernel module
6354 - improve labels before UX does :)
6355 - Tor Connection: disable the "Scan a QR code" button until "Enter a bridge that
6356 you already know" is selected
6357 - gettext for dialog
6358 - implement Scan QR code from error step, too
6359 - better error handling
6360 - QR code content is parsed/validated
6361 - doctests for parse_qr_content
6362 - Convert the contents of the QR code into bridge lines
6363 - clicking on "Scan QR code" does something...
6364 - glade: clicked callback + naming convention
6365 - Tor Connection: add button to scan QR code
6366 - scanning Tor bridges QR codes: building blocks
6368 * Migrate from X.Org to Wayland (tails/tails!838)
6370 Closes: #12213, #19042, #14623, #15635, #19008, #16795, #18020, #17284, #5422, #9767, #7502, #18339
6373 - Test suite: don't expect the application title seen on the accessibility bus to
6375 - Glade: AtkObject::accessible-role properties should not be translatable
6376 - Test suite: fix clearing notifications
6377 - FIX sandbox check for some parts of the test suite
6378 - Test suite: simplify
6379 - workaround an a11y bug preventing test suite
6380 - one more test suite fix
6381 - Test suite: migrate to input techniques that work on Wayland
6382 - TPS is on Wayland, a11y, ibus...
6383 - remove unused import
6385 - more explicit block clearnet → internal services
6386 - FIX proxy test for unsafebrowser
6387 - Really disable broken Thunderbird test
6388 - no incoming connections to UnsafeBrowser
6389 - tails-add-session-firewall-rune work without --apply
6391 - Test suite: make test work in non-English locales
6392 - Test suite: rename step to match what it currently checks
6393 - Fix typos in comment
6394 - Test suite: remove workaround
6395 - Test suite: fix race condition
6396 - Test suite: add missing space between words in error message
6397 - Extract Python code to an external script
6399 - Drop unnecessary /g regexp modifiers
6400 - Use extended regexps
6401 - Don't install unneeded systemd-container
6403 - Remove obsolete comment
6404 - Fix typo in comment
6406 - Improve user-facing string
6407 - Use install(1) instead of mkdir + chown
6408 - Make variable name correctly reflect its value
6409 - Make variable name correctly reflect its value
6410 - Add missing word in error message
6411 - Test suite: drop unnecessary step
6412 - Test suite: move and warn about xdotool using code
6413 - Fix a bunch of issues identified by shellcheck
6414 - Unsafe Browser: drop workarounds.
6415 - Test suite: clarify/simplify code
6416 - Test suite: fix recovery
6417 - Test suite: fix robustness issue
6418 - Test suite: verify that browser address bar images exist
6419 - Test suite: adjust path
6420 - Test suite: fix sanity check
6421 - Test suite: drop comment
6422 - Unsafe Browser: move code
6423 - Unsafe Browser: drop unnecessary mount for container
6424 - Test suite: adapt firewall sanity check to the clearnet network namespace
6425 - Test suite: adapt test after dropping the greeter's Unsafe Browser setting
6426 - Test suite: adapt regex to new command line
6427 - Test suite: deal with Unsafe Browser permission error
6428 - Test suite: export Unsafe Browser bookmarks into an accessible directory
6429 - Unsafe Browser: allow access to /etc/hosts in AppArmor profile
6430 - Test suite: use correct step
6431 - Welcome Screen: really hide the "Add" button for obsolete settings
6432 - Welcome Screen: always enable the Unsafe Browser and make the setting obsolete
6433 - Revert "Unsafe Browser: prevent accidental/malicious operation under Xorg"
6434 - Unsafe Browser: further isolate from the root filesystem
6435 - Unsafe Browser: drop duplicated mount
6436 - Fix incorrect merge conflict resolution.
6437 - Unsafe Browser: expose the real /home
6438 - Unsafe Browser: confine with AppArmor
6439 - Unsafe Browser: prevent accidental/malicious operation under Xorg
6440 - Unsafe Browser: work around issue with ibus/a11y proxy stopping
6441 - Make necessary firewall rules in tails-create-netns persist throughout the
6443 - Unsafe Browser: migrate to tails-create-netns
6444 - Unsafe Browser: run as native Wayland application
6445 - Unsafe Browser: start with tailslib.netnsdrop.run_in_netns()
6446 - Add missing double quotes
6447 - Use $() to get a command's output, not backticks
6448 - Add missing double quotes
6449 - Drop unused argument
6450 - Disable shellcheck false positive
6451 - Test suite: work around the Screen Keyboard not appearing as it should on
6453 - Patch Thunderbird AppArmor profile so it works in Wayland.
6454 - Thunderbird: enable Wayland support
6455 - Test suite: fix a bunch of incorrect/buggy Dogtail click actions
6456 - Tor Browser: enable Wayland support
6457 - Test suite: fix a bunch of incorrect Dogtail "click" actions
6458 - Test suite: make test more robust.
6459 - Unsafe Browser: enable ibus and accessibility!
6460 - Test suite: actually disable TOR_TRANSPROXY for the Unsafe Browser
6461 - Test suite: optimization
6462 - Test suite: fix chroot vs pmap mismatch.
6463 - Test suite: fix Dogtail for non-amneisia users
6464 - Test suite vs Wayland: fix another issue when clicking crashes accessibility
6465 - Remote shell: get the GNOME environment from the python library instead
6466 - Fix environment so accessibility is working with launch_x_application()
6467 - Test suite vs Wayland: deal with several issues when installing packages in
6469 - Test suite: deal with XWayland vs Dogtail issue for synaptic run as root
6470 - Test suite: enable the accessibility toolkit for the root user
6471 - Remote shell: set XAUTHORITY, which isn't set by export_gnome_env() any more
6472 - Wayland vs export_gnome_env(): drop variables not dumped into /run/gnome-shell-
6474 - Test suite: deal with Wayland vs Dogtail issue
6475 - Test suite: deal with GNOME notification buttons being unclickable through
6477 - Test suite: work around another instance where Dogtail breaks after clicking a
6479 - Test suite: use correct activation for some particular push buttons.
6480 - Test suite: deal with Wayland vs Dogtail issue.
6481 - Test suite: some radio buttons want 'click', some want 'select'.
6482 - Test suite: work around AT-SPI action bug
6483 - Test suite: apparently some buttons want "click" while others want "press"
6484 - Test suite: fix Electrum test vs Wayland migration.
6485 - Test suite: use appropriate Dogtail actions for push/radio buttons.
6486 - Test suite: use better image when waiting for snapshots to be restored fully.
6487 - Unsafe Browser: hook zenity dialogs to at-spi bus.
6488 - stop installing xorg packages
6489 - Test suite: handle Unsafe Browser exiting with an error code after being
6491 - Test suite: adapt Unsafe Browser tests since migrating to Wayland.
6492 - Test suite: adapt to Wayland
6493 - Test suite: adapt to Wayland
6494 - Revert "Remove unused exec_unconfined_firefox()."
6495 - Update GNOME Shell user service name for Wayland
6496 - Test suite: migrate more tests to input techniques that work on Wayland
6497 - Remote shell: ensure $DISPLAY is set
6498 - Test suite: don't import dogtail.rawinput that can't work on Wayland
6499 - Test suite: generate methods with meta-programming
6500 - Test suite: migrate to input techniques that work on Wayland
6501 - Test suite: remove X.Org-specific workaround
6502 - Fix typo in comment
6503 - Test suite: click in a way that works on Wayland
6504 - Test suite: remove unused method that's broken on Wayland
6505 - Unsafe Browser: set up networking via a new namespace.
6506 - Revert "Unsafe Browser: crappy attempt to sort of get networking up."
6507 - Unsafe Browser: crappy attempt to sort of get networking up.
6508 - Unsafe Browser: bind-mount resolv.conf as read-only.
6509 - Unsafe Browser: experiment for running as the amnesia user.
6510 - Stop disabling Wayland in GDM (refs: #12213).
6511 - Revert "Use X.Org in amnesia's GNOME session (refs: #12213)."
6513 -- Tails developers <tails@boum.org> Wed, 02 Nov 2022 09:47:35 +0000
6515 tails (5.7) unstable; urgency=medium
6517 * fix FTBFS: don't remove, just hold (tails/tails!960)
6520 - Tails FTBFS: grub-pc is not configured (tails/tails#19290)
6523 - don't remove, just hold
6525 * Resolve "Upgrade to Tor Browser 11.5.8" (tails/tails!962)
6528 - Upgrade to Tor Browser 11.5.8 (tails/tails#19295)
6531 - Fetch Tor Browser from our own archive
6532 - Upgrade Tor Browser to 11.5.8-build1
6534 * Add Metadata Cleaner (#18101) (tails/tails!959)
6537 - Mention MAT and metadata on /about (tails/tails#19206)
6538 - Add Metadata Cleaner (tails/tails#18101)
6541 - Mention Metadata Cleaner from /about (#19206)
6542 - Document Metadata Cleaner (#18101)
6543 - Add Metadata Cleaner (#18101)
6545 * WhisperBack debugging info: have df ignore filesystems of type fuse.portal
6549 - Can't start WhisperBack when /root/.cache/doc is mounted (tails/tails#19282)
6552 - WhisperBack debugging info: have df ignore filesystems of type fuse.portal
6554 * Update htpdate pool: secure.flickr.com → flickr.com (tails/tails!954)
6557 - Update htpdate pool: secure.flickr.com → flickr.com
6559 * Update tor to 0.4.7.11 (tails/tails!953)
6562 - Upgrade to tor 0.4.7.11 (tails/tails#19276)
6565 - Update tor to 0.4.7.11
6567 * Remove broken pdf-redact-tools (tails/tails!950)
6570 - pdf-redact-tools broken (tails/tails#19250)
6573 - Remove broken pdf-redact-tools
6575 * Resolve "Explain better the Unsafe Browser from Tor Connection"
6579 - Test suite: update wrt. new UI strings
6580 - Insist on signing in, then closing (#19168)
6581 - Be more clear (#19168)
6583 * Remove (easier) and (safer) label from consent question (#19166)
6587 - Remove (easier) and (safer) label from consent question (tails/tails#19166)
6590 - Test suite: update wrt. new UI strings
6591 - Remove (easier) and (safer) label from consent question (#19166)
6593 * fix snakeoil certificates in Thunderbird test suite (tails/tails!943)
6596 - Fix and re-enable "I can send emails, and receive emails over IMAP" automated
6597 test: Certificate handling on Jenkins needs updating for Thunderbird 102
6601 - add snakeoil to thunderbird using certutil
6602 - reneable test by default
6603 - Revert "Really disable broken Thunderbird test"
6605 * extend validity time check for OpenPGP keys (tails/tails!939)
6608 - Extend period for "The included OpenPGP keys are up-to-date"
6612 - extend validity time check for OpenPGP keys
6614 * Fetch Tor Browser from our own archive (tails/tails!938)
6617 - Fetch Tor Browser from our own archive
6619 -- Tails developers <tails@boum.org> Mon, 21 Nov 2022 11:13:06 +0100
6621 tails (5.6) unstable; urgency=medium
6623 * Upgrade Linux to 5.10.149 (tails/tails!935)
6626 - Fix beacown (tails/tails#19210)
6629 - Release process: bring back test that we can run locally, but not on Jenkins
6630 - Really disable broken Thunderbird test
6631 - Upgrade Linux to 5.10.149-1
6633 * Disable broken Thunderbird test (tails/tails!934)
6636 - Disable broken Thunderbird test
6638 * Upgrade Tor Browser to 11.5.5 (tails/tails!936)
6641 - Upgrade to Tor Browser 11.5.5 (ESR 91.13 + ESR 102.4 backports)
6645 - Upgrade Tor Browser to 11.5.5
6647 * post-release misc updates (tails/tails!932)
6650 - easier transmission-remote instructions
6651 - avoid re-downloading if restarting
6652 - better instructions for automated test suite
6654 * Thunderbird: remove obsolete oauth2 pref (tails/tails!929)
6657 - Thunderbird: remove obsolete oauth2 pref
6659 * Upgrader: when a manual upgrade is needed, point to the news & manual upgrade
6660 doc without specifying a (probably incorrect) version (tails/tails!915)
6663 - Tails Upgrader recommends manual upgrades to deprecated versions
6667 - Make /latest inline the translated version of the release notes
6668 - Rewrite in Markdown
6669 - Move latest release notes out of /news
6671 - Point to release notes of latest version only
6672 - Upgrader: when a manual upgrade is needed, point to the news & manual upgrade
6673 doc without specifying a version
6675 -- Tails developers <tails@boum.org> Mon, 24 Oct 2022 08:06:36 +0000
6677 tails (5.5) unstable; urgency=medium
6679 * Upgrade to Tor Browser 11.5.4 (ESR 91.13 + ESR 102.3 backports)
6683 - Upgrade to Tor Browser 11.5.4 (ESR 91.13 + ESR 102.3 backports)
6687 - Fetch Tor Browser from our own archive
6688 - Upgrade Tor Browser to 11.5.4-build2
6690 * Upgrade to Thunderbird 102 (tails/tails!928)
6693 - Upgrade to Thunderbird 102 (tails/tails#19156)
6696 - adapt test suite to new UI
6697 - JS hardening in Thunderbird
6699 - Update Thunderbird patches from
6700 tails/thunderbird@4efe2ce285c552c1808120d54a11f4be9e57527f
6701 - Update Thunderbird patches from
6702 tails/thunderbird@4efe2ce285c552c1808120d54a11f4be9e57527f
6703 - Thunderbird patches update doc: update examples
6704 - Thunderbird patches update doc: push upstream tags too
6705 - Thunderbird patches update doc: document how to verify
6706 - Thunderbird patches update doc: add missing commit and push steps
6707 - Thunderbird patches update doc: don't suggest we're still trying to upstream
6709 - Thunderbird patches update doc: adjust to Bullseye
6712 * import-translations: use new remote (tails/tails!927)
6715 - App translations supported by Tor Project moving from Transifex to weblate
6719 - import-translations: drop support for standalone WhisperBack project
6720 - import-translations: use new remote
6722 * GitLab CI: ensure all website core pages exist (tails/tails!926)
6725 - Make code more readable
6726 - GitLab CI: ensure all website core pages exist
6728 * GitLab CI: build our website on master and branches targeting master
6732 - GitLab CI: build our website on master and branches targeting master
6733 - build-website: remove check now done in GitLab CI
6735 * Test suite: remove Cucumber test scenarios and build website checks that are
6736 now covered by GitLab CI (tails/tails!923)
6739 - Remove Cucumber test scenarios that are now covered by GitLab CI
6743 - build-website: remove check now done in GitLab CI
6744 - Test suite: remove Cucumber test scenarios that are now covered by GitLab CI
6746 * Upgrade to Bullseye 11.5 and Linux 5.10.140 (tails/tails!920)
6749 - Upgrade Linux to 5.10.140 (tails/tails#19127)
6750 - Upgrade to Bullseye 11.5 (tails/tails#19082)
6753 - Test suite: relax timeouts
6754 - Test suite: bump timeout
6756 - Upgrade to Bullseye 11.5 and Linux 5.10.140
6758 * Test suite: fix virt-viewer active?() check to work with all versions
6762 - virt-viewer 11.0 breaks our test suite (tails/tails#19064)
6765 - Test suite: fix virt-viewer active?() check to work with all versions
6767 * Fix screen lock keyboard shortcut (tails/tails!918)
6770 - Super+L sometimes starts the screensaver when it should ask for a screen lock
6771 password (tails/tails#19090)
6774 - Fix screen lock keyboard shortcut
6776 * Test suite: make localized Unsafe Browser tests faster and easier to maintain
6780 - Localized Unsafe Browser tests are slow and hard to maintain
6784 - Test suite: add comment
6785 - Make Gherkin scenario outline placeholder more descriptive
6786 - Test suite: make localized Unsafe Browser tests faster and easier to maintain
6787 - Test suite: remove dead code
6789 * Add standard fields to /etc/os-release (tails/tails!914)
6792 - Add standard fields to /etc/os-release
6794 * Build system: make our website cache volume smaller (tails/tails!913)
6797 - Build system: make our website cache volume smaller
6799 * Use "torsocks --isolate" everywhere we use torsocks (tails/tails!912)
6802 - Use "torsocks --isolate" everywhere we use torsocks
6804 * Fix devel FTBFS with uBlock 1.44.0+dfsg-1 (tails/tails!910)
6809 * Post-release doc updates (tails/tails!907)
6812 - call for testers has meaningful date
6813 - warning: tb-build-05 not serving files over HTTP
6814 - cleanup script that waits for new TBB release
6816 * GitLab CI: run the Bandit security oriented static analyzer for Python
6820 - Check re.match's return value in a way that always returns a boolean
6821 - Add typing information
6822 - GitLab CI: also check shell and Python files that have no shebang
6823 - GitLab CI: run the Bandit security oriented static analyzer for Python
6824 - Lint comments format
6825 - Ignore Bandit false positives
6826 - Remove obsolete Emacs "coding: UTF-8" configuration
6827 - WhisperBack: only load global configuration file
6828 - Add configuration for the Bandit security oriented static analyzer for Python
6830 * Make it easy to re-run failed test suite scenarios (tails/tails!901)
6833 - run_test_suite wrapper that retries failed tests (tails/tails#19072)
6836 - RM tip: run all test scenarios
6837 - RM tip: multiple test suite runs overnight
6838 - set rerun file from ruby
6840 -- Tails developers <tails@boum.org> Thu, 13 Oct 2022 11:55:08 +0200
6842 tails (5.4) unstable; urgency=medium
6844 * Upgrade Tor Browser to 11.5.2 (tails/tails!908)
6847 - Upgrade to Tor Browser based on 91.13 (tails/tails#19073)
6850 - automatic redirect to HTTPS, here we meet again
6851 - Upgrade Tor Browser to UNVERIFIED 11.5.2-build1
6853 * Upgrade Linux packages to 5.10.0-17, currently at version 5.10.136
6857 - Handle CVE-2022-2585 (POSIX CPU timer UAF) (tails/tails#19081)
6860 - Upgrade Linux packages to 5.10.0-17, currnetly at version 5.10.136
6862 * Disable HTTPS-only mode in Unsafe Browser (tails/tails!906)
6865 - Disable HTTPS-only mode in Unsafe Browser (tails/tails#19095)
6868 - disable HTTPS-only mode for unsafe browser
6870 * Upgrade tor to 0.4.7.10 (tails/tails!903)
6873 - Upgrade to tor 0.4.7.10 (tails/tails#19083)
6876 - Don't mention irrelevant implementation detail
6877 - Avoid initially pushed branch failing its pipeline
6878 - Drop obsolete step
6879 - Upgrade tor to 0.4.7.10
6881 * Resolve "Some time sync related automated tests fail when run on a system whose
6882 system clock is not in UTC" (tails/tails!902)
6885 - Some time sync related automated tests fail when run on a system whose system
6886 clock is not in UTC (tails/tails#19070)
6889 - uses UTC time even on non-UTC systems
6891 * Misc kernel hardening (tails/tails!899)
6894 - Kernel hardening: restricts loading TTY line disciplines (tails/tails#18302)
6895 - Enable page allocator freelist randomization (tails/tails#18886)
6896 - Consider dropping slub_debug=P and page_poison=1 options and let init_on_free
6897 wipe slab and page allocations (tails/tails#18858)
6900 - Kernel hardening: restricts loading TTY line disciplines
6901 - Kernel: enable page allocator freelist randomization
6902 - Remove obsolete kernel command line options
6904 * Actually stop NetworkManager before applying an upgrade (tails/tails!896)
6907 - Remove obsolete comment
6908 - Use systemctl(1) instead of service(8)
6909 - Actually stop NetworkManager before applying an upgrade
6911 * Test suite: fix Unsafe Browser localization tests (tails/tails!867)
6914 - testing unsafebrowser is more deterministic
6915 - add spanish start page image for unsafe browser
6916 - add portuguese start page image for unsafe browser
6917 - debug unsafe browser errors
6919 -- Tails developers <tails@boum.org> Wed, 24 Aug 2022 13:18:27 +0200
6921 tails (5.3.1) unstable; urgency=medium
6923 * Upgrade Linux to 5.10.127-2 (DSA-5191)
6924 * Upgrade Thunderbird to 91.12.0 (DSA-5195)
6926 -- Tails developers <tails@boum.org> Mon, 01 Aug 2022 23:19:49 +0000
6928 tails (5.3) unstable; urgency=medium
6930 * Upgrade to Tor Browser 11.5.1, bring back uBlock, and fix the Unsafe Browser's
6931 window title (tails/tails!894)
6934 - uBlock is not enabled in Tor Browser (tails/tails#19059)
6935 - Upgrade to Tor Browser based on ESR 91.12 (tails/tails#19058)
6936 - Window title of Unsafe Browser reads "Tor Browser" (tails/tails#18603)
6939 - Tor Browser: use the system's libstdc++.so.6 like upstream would on a Bullseye
6941 - update-acng-config: get ready for 6.x
6942 - Remove hack that's not needed on Bullseye anymore
6944 - Make cp behavior deterministic
6945 - htpdate pool 2: replace fragile thepiratebay.org with www.gnome.org
6946 - Bring back code needed to install uBlock
6947 - Create directory before copying into it
6948 - Browsers: also pass --name to Firefox
6949 - Reformat code: make room for more options and nicer Git diffs
6950 - Unsafe Browser: also set brandProductName to "Unsafe Browser", for consistency
6951 - Unsafe Browser: set the branding in the file that's actually used in current
6953 - Fetch Tor Browser from our own archive
6954 - Upgrade Tor Browser to 11.5.1-build1
6956 * Test suite: misc. improvements (tails/tails!892)
6959 - Test suite sometimes fails to find a picture (e.g. TailsGreeterLoginButton.png)
6960 while it's present on screen (tails/tails#19044)
6963 - Test suite: also display stdout on vmcommand failure
6964 - Test suite: bump timeout
6965 - Test suite: fix typo in comment
6966 - Welcome Screen: remove unused import
6967 - Test suite: point to relevant issue
6968 - Test suite: wait more for some images
6969 - Test suite: have Screen#find wait longer
6970 - Test suite: add debug logging to investigate #19044
6971 - Test suite: fix variable name
6972 - Test suite: give some time to the persistence passphrase widget to get focus
6973 - Use named constants instead of magic numbers
6974 - Don't catch unrelated IndexError exceptions
6976 - Remove unused import
6977 - Test suite: fix, improve, and update comments
6978 - Test suite: set the time in the guest using timedatectl
6979 - Make host_to_guest_time_sync raise an exception on failure
6982 * Upgrade to Debian Bullseye 11.4, Linux 5.10.127, and Network Manager 1.30.6
6986 - Upgrade to Debian Bullseye 11.4 (tails/tails#19046)
6990 - Update Vagrant box to Debian Bullseye 11.4
6991 - Enable the 19046-bullseye-11.4-force-all-tests APT overlay (refs: #19046).
6992 - Upgrade to Linux 5.10.0-16 (currently at 5.10.127-1)
6993 - Upgrade to Debian Bullseye 11.4
6995 * Upgrade mat2 to 0.12.1-2+deb11u1
6997 -- Tails developers <tails@boum.org> Mon, 25 Jul 2022 13:45:07 +0200
6999 tails (5.2) unstable; urgency=medium
7001 * Upgrade Thunderbird to 91.11.0
7003 * Upgrade Tor Browser to 11.5 (tails/tails!889)
7006 - Upgrade to Tor Browser based on Firefox 91.11 (tails/tails#19029)
7009 - more bumping tor browser
7010 - bump torbrowser images
7012 - manual bump TorBrowserOverviewIcon.png
7013 - some more image bumping
7014 - l10n screenshot updated
7015 - bump duckduckgo prompt image
7016 - adapt tor browser screenshot
7017 - Fetch Tor Browser from our own archive
7018 - Upgrade Tor Browser to 11.5
7019 - Revert "NIGHTLY ONLY! REMOVE ME!"
7020 - clean nightly dirt
7021 - install langpacks for nightlies, too (if possible)
7022 - NIGHTLY ONLY! REMOVE ME!
7023 - Revert "disable OnionAliases for Unsafe Browser"
7024 - use new TBB setting to disable onionrewrites altogether
7025 - take tbb 11.5 from nightlies
7026 - disable OnionAliases for Unsafe Browser
7027 - Upgrade Tor Browser to 11.5a13-build2
7029 * Adapt release process to new Tor blog platform (tails/tails!887)
7032 - Change release process details for blog.torproject.org (tails/tails#18963)
7036 - Release process: suggest publishing a Tor blog even for bugfix releases
7037 - Release process: improve Tor blog post instructions
7038 - generate-Tor-blog-post: use actual template and also generate the Lektor header
7039 - generate-Tor-blog-post: refactor (extract code to function)
7040 - generate-Tor-blog-post: remove inline images too
7041 - Release process: adapt the Tor blog post process to Lektor
7042 - generate-Tor-blog-post: fix ikiwiki command
7044 * GitLab CI: clean up and refactor https-get-expired jobs (tails/tails!884)
7047 - GitLab CI: force running jobs when updating .gitlab-ci.yml
7048 - GitLab CI: factorize
7049 - GitLab CI: install golang in the same way we do during a Tails build
7050 - GitLab CI: remove duplicate call to "apt-get update"
7051 - GitLab CI: drop obsolete pinning to Buster
7053 * Git: ignore the early_patch= (aka. --early-patch) hook (tails/tails!882)
7056 - Git: ignore the early_patch= (aka. --early-patch) hook
7058 * Resolve "IUK test suite: features/frontend is broken (tails-transform-mirror-
7059 url fails)" (tails/tails!880)
7062 - IUK test suite: features/frontend is broken (tails-transform-mirror-url fails)
7066 - IUk test suite: Set Torsocks to allow outbound connections to the loopback
7068 - IUK test suite: Add test file
7069 - IUK test suite: disable certificate verification
7071 * Test suite: fix copying a new directory with late patch (tails/tails!877)
7074 - Test suite: fix copying a new directory with late patch
7076 * Resolve "Test "The included APT repository keys are up-to-date" does not check
7077 subkeys" (tails/tails!876)
7080 - Test "The included APT repository keys are up-to-date" does not check subkeys
7084 - check we have at least one *relevant* subkey
7085 - gpg checks deeper: both master keys and subkeys
7087 - Revert "Revert "check APT subkeys, too""
7089 * Test suite: misc bugfixes (tails/tails!872)
7092 - Test suite: also set the guest's time when connected to the LAN but not to Tor
7093 - Test suite: move sleep where it was supposed to be
7095 * workaround persistent Tor bridges bug (tails/tails!870)
7098 - Tor Bridges persistence sometimes fails to save bridges during initial setup on
7099 Bullseye, at least in our test suite (tails/tails#18926)
7102 - workaround for bug only present in test suite
7104 * check APT subkeys, too (tails/tails!869)
7107 - Test "The included APT repository keys are up-to-date" does not check subkeys
7111 - check APT subkeys, too
7113 * Set Samba workgroup used by GTK applications to "localhost" (tails/tails!865)
7116 - Several applications ask Tor to resolve the "workgroup" hostname
7120 - Set Samba workgroup used by GTK applications to "localhost"
7122 -- Tails developers <tails@boum.org> Mon, 11 Jul 2022 08:13:08 +0000
7124 tails (5.1.1) unstable; urgency=medium
7126 * Upgrade Linux to 5.10.120-1 and tor to 0.4.7.8 (tails/tails!863)
7129 - Upgrade to tor 0.4.7.8 (tails/tails#19035)
7130 - Upgrade Linux to 5.10.120-1 (tails/tails#19036)
7133 - Upgrade Linux kernel packages to 5.10.0-15 (currently at version 5.10.120-1)
7134 - Upgrade to tor 0.4.7.8
7136 * Upgrade to Thunderbird 91.10.0
7138 * Fix htpdate pool: https://www.mozilla.org returns incorrects Date header
7142 - Fix htpdate pool: https://www.mozilla.org returns incorrects Date header
7146 - Fix htpdate pool: https://www.mozilla.org returns incorrects Date header
7148 * Test suite: update the set of @fragile tags (tails/tails!862)
7151 - "Persistent browser bookmarks" is fragile (tails/tails#11585)
7152 - "The persistent Tor Browser directory is usable" test suite scenario is fragile
7154 - The "is properly stream isolated" test suite mechanism is fragile
7156 - Step "a screenshot is saved to the live user's Pictures directory" is fragile
7158 - "I can view and print a PDF file" scenarios are fragile (tails/tails#10994)
7159 - Memory erasure on boot medium removal is fragile (tails/tails#13462)
7160 - Test suite: update the set of @fragile tags (tails/tails#19007)
7163 - add @fragile tags when it's useful
7164 - Remove many @feature tags
7166 * follow up again on tca audit: clarify comments (tails/tails!860)
7169 - Audit tca-portal (tails/tails#18374)
7172 - acknowledge jvoisin's comments
7174 * Test suite: exercise the screen keyboard with a key that won't auto-complete
7178 - "the screen keyboard works in Tor Browser" fails in Arabic (tails/tails#19013)
7181 - Test suite: exercise the screen keyboard with a key that won't auto-complete
7183 * GitLab CI: improve jobs rules (tails/tails!856)
7186 - GitLab CI: don't run code tests on the master branch
7187 - GitLab CI: also run https-get-expired* jobs when we modify our htpdate
7189 - GitLab CI: only run https-get-expired when relevant
7191 * Inline strtobool function (tails/tails!855)
7194 - Inline strtobool function
7196 * Test suite: improve robustness (tails/tails!851)
7199 - Developers need to apply workaround in order to build Tails during the release
7200 process (tails/tails#18998)
7201 - Test scenario "htpdate is using the Tails-specific SocksPort" is broken
7205 - Test suite: avoid missed clicks retry when opening the calendar & notifications
7207 - Test suite: give the Upgrader time to fill the zenity dialog
7208 - Test suite: give the Greeter some time to re-enable the login button
7209 - Fix building from dev branches during the release process
7210 - Test suite: don't reset virtual X display between clients
7211 - Test suite: hopefully increase chances we catch the process we want
7213 - Test suite: ensure we write every line extracted from "ss -taupen" as soon as
7215 - Test suite: migrate from service(8) to directly using systemctl
7216 - Test suite: adapt to new HTTPS client used by htpdate
7217 - Test suite: make setting up a Pidgin account more robust
7218 - Test suite: make interaction with GNOME Disks title bar buttons more robust
7219 - Test suite: make copying'n'pasting into a Terminal more robust
7221 * Have a better footer (tails/tails!756)
7224 - Translate a couple strings to check sidebar2 vs. PO plugin
7227 - Link to accessibility from footer
7228 - Rescue translations
7231 - Use sidebar2 to replace translation hacks in templates
7232 - Integrate sidebar2 in the local build
7233 - Add missing ARIA label
7234 - Make the label bold
7235 - Improve the appeal to the newsletter (#16888)
7236 - Translate footer into Spanish
7238 - Move jobs from top navigation to footer
7239 - Use more consistent margin system
7240 - Have a better footer (#17699)
7241 - Create dedicated page for testimonials
7242 - Don't use all capitals (#16137)
7244 * early-patch: live-patch at initramfs's time (tails/tails!696)
7248 - Fix documentation wrt. the name of the option actually passed
7249 - Document --late-patch
7250 - more documentation
7251 - works even if hook fails
7252 - early_patch from test suite umounts immediately
7253 - pass 9p fs to TailsToaster: --early-patch works
7254 - live-patch → late-patch
7255 - early-live-patch → early-patch
7256 - Test suite: make EARLY_LIVE_PATCH a boolean
7257 - Disable obsolete shellcheck override
7258 - Don't enable live_patch by default
7259 - Make headings levels consistent with the rest of our website
7261 - Apply 4 suggestion(s) to 1 file(s)
7262 - run_test_suite --early-live-patch
7263 - developer documentation for live_patch
7264 - live_patch: early-patching system
7266 -- Tails developers <tails@boum.org> Wed, 22 Jun 2022 11:31:52 +0000
7268 tails (5.1) unstable; urgency=medium
7270 * Upgrade to Thunderbird 91.9.0
7272 * Upgrade to Tor Browser 11.0.14 based on Firefox 91.10 (tails/tails!852)
7275 - Upgrade to Tor Browser 11.0.14 based on Firefox 91.10 (tails/tails#18979)
7278 - htpdate: replace tachanka.org with www.autistici.org
7279 - Mark security advisory against 5.0 as fixed
7280 - Fetch Tor Browser from our own archive
7281 - Upgrade Tor Browser to 11.0.14-build1
7283 * Resolve "displayed_time_str fails in test suite" (tails/tails!839)
7286 - displayed_time_str fails in test suite (tails/tails#18991)
7289 - Ignore advisories when looking for displayed time
7292 * FIX Clock disappearing when the user sets UTC as their local timezone
7296 - Clock disappears from the GNOME top bar after "Fix the clock" and choosing UTC
7297 timezone (tails/tails#18993)
7300 - safety net for future problems
7301 - handle UTC special-case
7303 * Test suite: workaround lost and duplicate key presses by pasting long strings
7304 instead of typing them (tails/tails!821)
7307 - Test suite: merge step used only by another step into its caller
7308 - Test suite: paste long strings instead of typing them
7309 - Test suite: drop useless step
7310 - Test suite: refactor (extract code to method)
7312 * Test suite: Make opening GNOME menus more robust (tails/tails!816)
7315 - Opening GNOME menus in the test suite on Bullseye is very fragile
7319 - Test suite: try harder to open GNOME menus
7320 - Test suite: drop unnecessary delay
7321 - Test suite: use Dogtail to check presence of GNOME bookmarks
7322 - Test suite: use Dogtail to open the GNOME menus
7323 - Test suite: wait for the desktop to be visible before we interact with it after
7324 restoring a snapshot
7327 * Upgrade to Linux 5.10.113-1 (DSA 5127-1) (tails/tails!813)
7330 - Upgrade Linux to 5.10.113-1 (DSA 5127-1) (tails/tails#18962)
7333 - Upgrade to Linux 5.10.113-1 (DSA 5127-1)
7335 * Make console-setup.service startup non-racy (tails/tails!811)
7338 - console-setup.service fails sometimes, which breaks "Tor is ready" in test
7339 suite (tails/tails#18636)
7342 - Make console-setup.service startup non-racy
7344 * Test suite: support running on Ruby 3.0 (tails/tails!810)
7347 - Test suite misbehaves on Ruby 3.0, e.g. "the Tor Connection Assistant connects
7348 to Tor" step always incorrectly fails (tails/tails#18904)
7351 - Test suite: ensure we don't try to click the "Restore Disk Image" button before
7353 - Test suite: support Bookworm host system's improved UEFI graphics
7354 - Test suite: enable Ruby deprecation warnings
7355 - Test suite: adjust to separation of positional and keyword arguments in Ruby
7357 - Test suite: update button label for Bullseye
7358 - Remove duplicate word in comment
7359 - Test suite: drop workaround for Ruby < 2.7
7360 - Test suite: migrate from deprecated luks_open and luks_close to
7361 cryptsetup_{open,close}
7363 * test https-get-expired with sid's Go (tails/tails!849)
7366 - GitLab CI: only run https-get-expired-sid job when relevant
7367 - GitLab CI: factorize
7368 - GitLab CI: test https-get-expired with sid's Go on a sid image
7369 - also test https-get-expired with sid's golang
7371 * Vagrant: install ikiwiki that fixes #18992 (tails/tails!847)
7374 - ikiwiki generates buggy PO files with po4a 0.62 (tails/tails#18992)
7377 - Vagrant: stop using the obsolete builder-jessie APT suite
7378 - Vagrant: install ikiwiki that fixes #18992
7380 * tca-portal: stricter validation (tails/tails!846)
7383 - test: right length, valid for date(1), but invalid format
7384 - drop test case for "minutes" timespec
7385 - be more explicit about the format we want
7386 - seconds always included
7387 - stricter validation for SetTimeCommand
7389 * ignore advisories + better debug (tails/tails!845)
7395 * Test suite: fix regression when testing Tor Connection in non-English locale
7399 - Test suite: fix regression when testing Tor Connection in non-English locale
7401 * FIX sharing via onionshare from nautilus (tails/tails!840)
7404 - "Share via OnionShare" does nothing (tails/tails#18990)
7407 - FIX sharing via onionshare from nautilus
7409 * lint_po: ignore unknown-message-flag errors (tails/tails!836)
7412 - lint_po: ignore unknown-message-flag errors
7414 * Don't enable "configure a bridge" just because the user looked at the hide mode
7418 - “Configure a Bridge” is enabled when rolling back from hiding Tor
7422 - regression test for #18546
7423 - enable easymode-bridges only in easy mode
7425 * Vagrant build box: upgrade to po4a 0.62-1 (tails/tails!834)
7428 - Vagrant build box: drop APT configuration for Buster
7429 - Vagrant build box: upgrade to po4a 0.62-1
7431 * Installer: create system partition 2 MiB from the beginning of the drive
7435 - Installer: create system partition 2 MiB from the beginning of the drive
7437 * Various Tor Connection UX improvements (tails/tails!831)
7440 - Tor Connection: Give the same instructions on both bridge screens
7442 - Always tell whether bridges are used in the success screen (tails/tails#18547)
7446 - Test suite: update expected images
7447 - Make phrasing consistent
7449 - refactor: properties allow our code to be clearer
7450 - bridges: same instructions on both screens
7451 - Success message conditional to bridges
7453 * Rewrite the home pages of the Unsafe Browser + Have different homes for the
7454 Unsafe Browser depending on whether we're connected to Tor already
7458 - Have different homes for the Unsafe Browser depending on whether we're
7459 connected to Tor already (tails/tails#18601)
7460 - Rewrite the home pages of the Unsafe Browser (tails/tails#18602)
7469 - Add illustration by Andrés
7470 - Test suite: remove obsolete localized images
7471 - Test suite: update expected image
7472 - Test suite: add missing @doc tag
7473 - FIX wrong path was checked
7474 - Clarify that the image is an example
7475 - Clarify use of CSS (Take 2)
7476 - Unsafe browser: home page if non connected to Tor
7477 - Clarify use of CSS
7480 - Write a dedicated page for captive portals
7481 - Improve instructions
7482 - Give examples of websites to use
7483 - Use our own image and remove the login and password
7486 * Test suite: misc. robustness improvements (tails/tails!827)
7489 - Tests for backup are fragile (tails/tails#18727)
7492 - Test suite: add localized expected image for Unsafe Browser start page in pt_BR
7493 - Test suite: enable debug logging for Screen#wait
7494 - Test suite: Fix frequent "cannot find TailsGreeterLoginButton.png" failures
7495 - Test suite: update expected image for Bullseye
7496 - Test suite: give the XMPP server some time to create the room
7497 - Test suite: update expected Pidgin images
7498 - Test suite: fix error message
7499 - Test suite: Improve error reporting
7500 - Test suite: Fix clock upper bound calculation
7501 - Test suite: refactoring (save value to variable)
7502 - Test suite: Drop most debugging info for issue that does not happen anymore
7503 - Test suite: Drop spurious verb in debug log
7504 - Revert "Mark test scenario as fragile"
7505 - Test suite (backup): Wait for Zenity to have filled its widgets with the
7508 * Upgrade apt-cacher-ng to bullseye-backports - fixes issue #18931
7512 - rake build fails - apt-get works erratically ( 502 connection closed
7513 [IP:127.0.0.1:3142] ) - No build artifacts were found! (tails/tails#18931)
7516 - Upgrade apt-cacher-ng to bullseye-backports.
7518 * Disable search providers in the Activities Overview: Calculator, Nautilus,
7519 Terminal (tails/tails!824)
7522 - Disable some GNOME Overview search providers (tails/tails#18952)
7525 - Disable search providers in the Activities Overview: Calculator, Contacts,
7526 Documents, Nautilus, Terminal
7528 * Test suite: ignore failures to destroy a stopped domain (tails/tails!822)
7531 - Scenario: "Upgrading an old Tails USB installation from another Tails USB
7532 drive" after-hook is racy (tails/tails#18972)
7535 - Test suite: ignore failures to destroy a stopped domain
7537 * Associate OpenPGP-encrypted files with Kleopatra (tails/tails!820)
7540 - Tails 5 does not decrypt .gpg files when double-clicking them
7544 - Associate OpenPGP-encrypted files with Kleopatra
7546 * safely get gnome_env_vars (tails/tails!819)
7549 - clarify about which environment is being dumped
7551 - Fix typo in comment
7552 - comments clarify why we think we are safe
7554 - gnome_env_vars look at the gnome-shell env dump
7555 - gnome-shell dumps its conf in a root-owned file
7557 * Avoid user confusion wrt. name of the default KeePassXC database
7561 - KeePassXC offers to rename the default database on non-English locales
7565 - Silence false positive
7566 - Drop obsolete reason
7567 - Don't allow translating Passwords.kdbx
7569 * Use Bullseye debootstrap configuration (tails/tails!817)
7572 - Use Bullseye debootstrap configuration
7574 * FIX IUK verification when we have 2 series at the same time (tails/tails!815)
7577 - bin/copy-iuks-to-rsync-server-and-verify failing because of old releases
7581 - Apply 1 suggestion(s) to 1 file(s)
7582 - document how the RM should use this command
7583 - don't fail when 404s have been ignored
7584 - proper exit code on failure
7585 - refactor --ignore-404
7588 - 404s found -> non-zero exit code
7589 - --ignore-404 and --dry-run
7591 * Fix FTBFS with uBlock 1.42 (tails/tails!814)
7596 * Upgrade to tor 0.4.7.7 (tails/tails!812)
7599 - Upgrade to tor 0.4.7.x (tails/tails#18932)
7602 - Upgrade to tor 0.4.7.7
7604 * Add translation files for Qt5 (#18958) (tails/tails!808)
7607 - Translations of basic Qt5 strings are missing (tails/tails#18958)
7610 - Add translation files for Qt
7612 * Make news/version_3* non-translatable (#16758) (tails/tails!805)
7615 - Make news/version_3* non-translatable (#16758)
7617 * Add Kleopatra to the Favorites (tails/tails!802)
7620 - Test suite: make expected image a tiny bit smaller
7621 - Add Kleopatra to the Favorites submenu
7623 * Test suite: drop pre-Bullseye compatibility (tails/tails!789)
7626 - Test suite: drop workaround for Ruby < 2.7
7627 - Test suite: migrate from deprecated luks_open and luks_close to
7628 cryptsetup_{open,close}
7630 * Add to confirm before restarting (#18912) (tails/tails!782)
7633 - New dialog when Unsafe Browser is not enabled makes it too easy to lose work
7637 - Make code more readable
7638 - Make function's responsibility tighter to simplify its code
7639 - Handle new code branch that was forgotten
7640 - Fix local variables declaration
7641 - Use 'Cancel' as default button (#18912)
7642 - 'Cancel' is more standard
7643 - Add to confirm before restarting (#18912)
7645 * Display time in the timezone that the user has chosen in Tor Connection
7649 - Display time in the timezone that the user has chosen in Tor Connection
7653 - Design doc: Explain security trade-off
7654 - Test suite: Explain that Asia/Shanghai == +08:00
7655 - tails-get-date: use Python instead of date(1)
7656 - Fix typo in error message
7657 - Test suite: ensure the displayed clock is in the user's timezone
7658 - Test suite: remove workaround
7659 - Test suite: refactor (extract code do method)
7660 - Test suite: be more defensive to give better error output
7661 - Test suite: send debug info to the debug log
7662 - Test suite: make step name clearer
7663 - Design doc: mention timezone status and plans
7664 - Apply 1 suggestion(s) to 1 file(s)
7665 - Fix typo in comment
7668 - Remove unnecessary comma
7669 - try to fix the vertical misalignment
7671 - Link back to main page
7672 - https://www.merriam-webster.com/dictionary/time%20zone
7673 - Move FAQ to a dedicated page
7675 - Don't potentially overwrite TZ key in dict with environment's value.
7676 - Cleanup dead code, fix formatting.
7677 - Consistently display GMT instead of UTC.
7678 - Use the same time format as GNOME's clock.
7679 - use date to format the date
7680 - date@ extension does The Right Thing
7681 - DRAFT: display time in local timezone
7683 * Follow-up on "Audit tca-portal" (tails/tails!723)
7686 - useless shellcheck directive
7687 - Apply 2 suggestion(s) to 2 file(s)
7688 - Fix typo in comment
7689 - clarify how we believe pgrep --ns 1 will help us
7690 - PersistenceSetupCommand: gnome_env_vars not needed
7691 - export_gnome_env hardening
7692 - some more validation when setting system time
7693 - gnome.py executes later; required for testing
7694 - add some doctests to tca-portal
7695 - more tuples, less lists
7696 - clarify: we are fine with the TOCTOU
7697 - --systemd-socket is exclusive with --listen
7698 - be more explicit about stdout/stderr handling
7699 - clarify handle_* comments
7700 - clarify what is the role of handle_line
7701 - anchor SetTimeCommand regexp
7702 - clarify comment about validate_args
7703 - use full path to commands whenever possible
7705 * Automatic time sync before connecting to Tor in automatic mode
7709 - Mitigate attack by active network adversary on automated time sync + replayed
7710 Tor consensus (tails/tails#18830)
7711 - Automatic time sync before connecting to Tor in automatic mode
7715 - Test suite: rename step to make it closer to what a user would do
7716 - use the non-deprecated version of "Tor is ready"
7718 - Add missing word in comment
7719 - Update comment: this now build reproducibly
7721 - fix undefined local variable
7722 - tails-get-network-time better syslog
7723 - tails-get-network-time has timeout
7724 - refactor old test case based on new functions
7725 - new test: time sync times out
7726 - tor connection runs even if timesync fails
7728 - some info is shown during network time sync
7730 - wait for time to be retrieved before starting Tor
7731 - use APT preferences, not --target-release
7732 - gitlab tests run with the correct Go version
7733 - public key type check
7734 - Explain why these if statements don't apply to us
7736 - Design doc: 2 out of 3 is enough since we're using the median
7738 - test all urls in htpdate.pools
7739 - https-get-expired gets more testing
7740 - https-get-expired: explain how this compares to Go implementation
7741 - Test suite: explain why scenarios pass in a somewhat surprisingly manner
7744 - Design doc: explain why we accept a risk
7745 - Design doc: improve phrasing
7746 - Design doc: drop conditional
7747 - Design doc: explain why we're protected
7748 - Design doc: clarify phrasing
7749 - Update design doc: this is not a problem anymore
7750 - reproducibility: clean cache after compiling
7752 - htpdate performs the median
7753 - design doc: explain https-get-expired
7755 - Pick Go from buster-backports
7756 - try to make go build reproducible: -trimpath
7757 - Test suite: mark fragile scenario as such
7758 - https-get-expired: CI tests now
7759 - test https-get-expired building
7760 - https-get-expired gains -proxy option
7761 - port htpdate to https-get-expired
7762 - https-get-expired: more similar to htpdate's curl
7763 - https-get-expired output headers, not body
7764 - fix go compilation
7765 - add https-get-expired: will need for time sync
7766 - "date in past" check is more robust
7767 - sanity check: the new date cannot be in the past
7768 - unsafe browser is checked for tor leaks
7769 - UnsafeBrowser correctly detects if we're online
7770 - checking DisableNetowrk is #18293-aware
7771 - Merge the new scenario with the old one
7772 - FIX restore: some snapshot has network but no Tor
7773 - UnsafeBrowser tests don't need Tor; scenarios--
7774 - FIX we don't even need to check Tor
7775 - Test suite: clarify what we're actually testing
7779 - Update doc to automatic time sync (#18717)
7780 - Improve structure of design doc
7782 - Design doc: copy more detailed explanation from the blueprint
7783 - Design doc: improve structure
7784 - Design doc: document new automatic time sync mechanism
7785 - Remove very old explanation
7786 - wording: we're looking for unneeded *exceptions*
7787 - Apply 5 suggestion(s) to 2 file(s)
7788 - FIX test case: allow it to use time sync
7789 - "flow through" supports fake connectivity check
7790 - FIX globally setting allowed DNS queries
7791 - refactor check for leaks
7792 - debugging leaks is easier
7793 - fix DNS query for easy mode
7794 - test suite self-correction warning
7795 - dns queries are allowed only when needed
7796 - +debug "traffic has only flowed through"
7797 - break the "Tor is ready" step in two
7799 - easy-mode allowed_hosts are set in tca_configure
7800 - explicitly allow connectivity check in many tests
7801 - fix time sync error simulation
7802 - fix exception wording
7803 - use DNS inspection to check for leaks
7804 - the FirewallHelper is DNS-aware
7806 - test "traffic only flows through" supports timesync
7807 - Add tests for time sync before Tor connects
7808 - Improve TCA test suite code
7809 - add vm script to upload/download files
7810 - tails-get-network-time: don't assume anything about body encoding
7811 - Raise exception instance, not class
7813 - tails-get-network-time: emulate NetworkManager's behavior more closely
7814 - Move hard-coded string to constant
7816 - tails-get-network-time: refactor
7818 - tails-get-network-time: migrate to pycurl, to make our fingerprint closer to
7820 - Store the network time server in a configuration file
7821 - Move code to main() function
7822 - Test suite: adjust to new automatic time sync feature
7823 - Test suite: drop workaround
7824 - Tor Connection: in automatic mode, set the system time from the network
7825 - tca-portal: implement a new get-network-time command
7826 - tca-portal: include stdout in responses
7828 -- Tails developers <tails@boum.org> Sat, 04 Jun 2022 08:11:47 +0000
7830 tails (5.0) unstable; urgency=medium
7832 * Upgrade Thunderbird to 91.8
7834 * Upgrade Tor Browser to 11.0.11 (based on esr91.9) (tails/tails!804)
7837 - Test suite: update expected image
7838 - Test suite: update expected web page title
7839 - Fetch Tor Browser from our own archive
7840 - Upgrade Tor Browser to 11.0.11-build1
7842 * Fix Additional Software test suite on Bullseye (tails/tails!794)
7845 - Test suite: use popularity-contest as a test package instead of sslh
7847 * Fix devel branch FTBFS (tails/tails!773)
7850 - Preserve UIDs/GIDs stability
7851 - Refresh list of standard packages
7853 * Drop obsolete patch (tails/tails!690)
7856 - Drop obsolete patch
7858 * all languages are listed (tails/tails!683)
7861 - all formats are shown
7862 - translations appear again in Greeter
7863 - when native l10n is not available, use english
7864 - all languages are listed
7866 * Fix the Tails Installer in bullseye (tails/tails!679)
7869 - retry has shorter sleep times
7870 - FIX self.sleep never existed
7871 - retry getting udisks object upon failure
7872 - don't rescan devices: we already know!
7873 - partition_device returns a UDI
7874 - refactor detect_supported_drives
7875 - retrying getting system partition helps
7876 - race conditions? let's increase sleep time!
7878 * Document Kleopatra (tails/tails!803)
7887 - Mention Kleopatra in the Persistent Storage settings
7888 - Remove not-so-useful note
7889 - Document Kleopatra (Closes: #18933)
7890 - Remove Seahorse from the doc
7891 - Remove screenshots that need updating
7892 - Remove OpenPGP Applet from the doc
7893 - Patch screenshots for the removal of the OpenPGP Applet
7895 * Fix opening links and attachments from Thunderbird, disable LibreOffice tip of
7896 the day (tails/tails!793)
7899 - AppArmor Thunderbird profile: allow executing /bin/dash with inherited policy
7900 - Disable LibreOffice's tip of the day
7902 * fix whisperback sending error (tails/tails!787)
7905 - Thread.isAlive -> is_alive
7907 * Fix Scenario: Upgrading an old Tails USB installation from another Tails USB
7908 drive (tails/tails!765)
7911 - apparently fix tails/tails#18840
7912 - send tails installer log to syslog
7914 * Additional Software: synchronize APT data when needed directly from t-p-s
7918 - Test suite: restart Tails in the same way we expect the user to
7919 - Test suite: don't exit the persistence wizard once done, make saving settings
7921 - Test suite: refactoring (convert step to method)
7922 - Additional Software: synchronize APT data when needed directly from t-p-s
7923 - Remove XXX:Bullseye: this is not going to happen
7925 * Persistence: enable Additional Software by default (tails/tails!800)
7928 - Persistence Setup: adjust test suite to Additional Software being enabled by
7930 - Persistence: enable Additional Software by default
7932 * Let the user know they should wait while we are copying Additional Software to
7933 a new Persistent Storage (tails/tails!799)
7936 - Use phrasing proposed by sajolida
7937 - t-p-s: ensure the GUI is updated while we synchronize data to the new
7939 - Persistence setup: forbid clicking "Restart Now" twice in a row
7940 - Test suite: save a file listing of /var/cache/apt when a Additional Software
7942 - Let the user know they should wait while we are copying Additional Software
7943 data to a new Persistent Storage
7945 * htpdate.service is always started (tails/tails!796)
7948 - be more explicit about what we are testing
7949 - htpdate is started every time
7950 - some tests can be excluded from feature branches
7951 - add regression test for #18868
7952 - start htpdate.service earlier
7954 * Replace Seahorse and OpenPGP Applet with Kleopatra (tails/tails!792)
7957 - Ensure Seahorse icons are present when running the persistence-setup test suite
7958 - Persistent Storage: re-add custom icons for the GnuPG and SSH Client features
7959 - FT role definition: remove seahorse-nautilus
7960 - Contributors & design doc: drop OpenPGP Applet
7961 - Remove the topIcons GNOME Shell extension
7962 - Test suite: remove OpenPGP Applet tests, and the code & images they used
7963 - Re-add and update explanation for disabling ssh-agent
7964 - Remove broken patch
7965 - Remove Gettext stuff for Seahorse
7966 - Remove hooks about Seahorse and OpenPGP Applet
7967 - Replace our PGP tools with Kleopatra
7969 * Fix Bullseye-based Tails booting 20% slower than 4.x (tails/tails!791)
7972 - Freeze the AppArmor kernel feature set too
7974 * Stop trusting our old APT signing key (tails/tails!788)
7977 - Bump APT snapshots to versions signed with our new key
7978 - Test suite: stop ignoring our old APT key
7979 - Stop trusting our old APT signing key
7981 * Update live-build to include the local packages fix. (tails/tails!776)
7984 - Update live-build to include the local packages fix.
7986 * Tails Installer: retry getting partition table (tails/tails!767)
7989 - retry getting partition table
7991 * Update gdm-tails.json for Bullseye (tails/tails!689)
7994 - Add pointer accessibility support to gdm-tails.json
7995 - gdm-tails.json: remove panelStyle
7997 * Update VeraCrypt test suite for Bullseye (tails/tails!686)
8000 - Test suite: trim expected image to account for GNOME mounted volume
8002 - Give exchange USB drive more space
8003 - Test suite: update to new GNOME Disks UI
8004 - Test suite: update Nautilus application name
8005 - Test suite: update expected picture
8007 -- Tails developers <tails@boum.org> Mon, 02 May 2022 12:03:37 +0200
8009 tails (5.0~beta1) unstable; urgency=medium
8011 * Upgrade to Debian 11 (Bullseye).
8012 - Fixes opening a Veracrypt volume with a long passphrase (tails#17474)
8013 - NetworkManager now uses its internal DHCP client
8015 - Software upgrades:
8018 - bookletimposer 0.3
8022 - NetworkManager 1.30.0
8025 - Thunderbird 91.7.0-2~deb11u1
8028 * Upgrade Tor Browser to 11.0.10-build1 (tails#777)
8030 * Enable driverless printing and scanning (tails#18521)
8032 * Fix locales translation in the Welcome Screen (tails#18199, tails/tails!683)
8035 - all formats are shown
8036 - translations appear again in Greeter
8037 - when native l10n is not available, use english
8038 - all languages are listed
8040 * Drop hack to kill GDM on login, not necessary anymore on Bullseye (tails#17952)
8042 * Have tor log to the Journal (tails#18842)
8044 * Have NetworkManager and MAC spoofing ignore veth* network interfaces (tails#18443)
8046 * Drop deprecated printer-driver-hpijs (tails#18225)
8048 * Fix devel branch FTBFS (tails/tails!773)
8051 - Preserve UIDs/GIDs stability
8052 - Refresh list of standard packages
8054 * Drop obsolete patch (tails/tails!690)
8057 - Drop obsolete patch
8059 * Fix the Tails Installer in bullseye (tails/tails!679)
8062 - retry has shorter sleep times
8063 - FIX self.sleep never existed
8064 - retry getting udisks object upon failure
8065 - don't rescan devices: we already know!
8066 - partition_device returns a UDI
8067 - refactor detect_supported_drives
8068 - retrying getting system partition helps
8069 - race conditions? let's increase sleep time!
8071 * Fix Scenario: Upgrading an old Tails USB installation from another Tails USB
8072 drive (tails/tails!765)
8075 - apparently fix tails/tails#18840
8076 - send tails installer log to syslog
8078 * Additional Software: synchronize APT data when needed directly from t-p-s
8082 - Test suite: restart Tails in the same way we expect the user to
8083 - Test suite: don't exit the persistence wizard once done, make saving settings
8085 - Test suite: refactoring (convert step to method)
8086 - Additional Software: synchronize APT data when needed directly from t-p-s
8087 - Remove XXX:Bullseye: this is not going to happen
8089 * Update gdm-tails.json for Bullseye (tails/tails!689)
8092 - Add pointer accessibility support to gdm-tails.json
8093 - gdm-tails.json: remove panelStyle
8095 * Update VeraCrypt test suite for Bullseye (tails/tails!686)
8098 - Test suite: trim expected image to account for GNOME mounted volume
8100 - Give exchange USB drive more space
8101 - Test suite: update to new GNOME Disks UI
8102 - Test suite: update Nautilus application name
8103 - Test suite: update expected picture
8105 -- Tails developers <tails@boum.org> Mon, 04 Apr 2022 09:25:25 +0000
8107 tails (4.29) unstable; urgency=medium
8109 * Upgrade to Tor Browser 11.0.x based on Firefox 91.8 (tails/tails!777)
8112 - Upgrade to Tor Browser 11.0.x based on Firefox 91.8 (tails/tails#18874)
8115 - Fetch Tor Browser from our own archive
8116 - Upgrade Tor Browser to 11.0.10-build1
8118 * Upgrade Thunderbird to 91.7
8120 * Upgrade to obfs4proxy 0.0.12 (Elligator2 bug) (tails/tails!728)
8123 - Fix bug in obfs4proxy (Elligator2), upgrading to 0.0.12+ (tails/tails#18800)
8126 - Revert "Downgrade obfs4proxy to 0.0.12-dev from the Tor Browser 11.0.4 tarball"
8128 * htpdate: log to stdout even when a log file is specified (tails/tails!772)
8131 - htpdate: also log to the Journal (tails/tails#18895)
8134 - htpdate: log to stdout even when a log file is specified
8136 * Upgrade to Buster 10.12 and Linux 5.10.103-1 (tails/tails!771)
8139 - Upgrade to Buster 10.12 (tails/tails#18885)
8140 - Upgrade Linux to 5.10.103-1 (DSA-5095-1) (tails/tails#18877)
8143 - Drop unused KERNEL_SOURCE_VERSION variable
8144 - Upgrade to Buster 10.12 and Linux 5.10.106-1
8146 * Test suite: drop OTR tests (tails/tails!769)
8149 - "Pidgin automatically generates an OTR key" test suite step fails when host
8150 system is Bullseye (tails/tails#18866)
8153 - Test suite: rename otr-bot to xmpp-bot
8154 - Test suite: drop support for OTR
8155 - Test suite: drop OTR tests
8157 * Provide HTTPS link when JavaScript is disabled (#18559) (tails/tails!755)
8160 - Update release process
8162 - Provide HTTPS link when JavaScript is disabled (#18559)
8164 * Clarify purpose and timeline (tails/tails!744)
8167 - Add link to release notes on GitLab
8168 - Include technical writers in the procedure
8171 - Remember Technical Writers where to find the latest stable
8172 - Clarify purpose and timeline
8174 * Upgrade zlib1g to 1:1.2.11.dfsg-1+deb10u1 (DSA-5111-1)
8177 * doc updates after releasing 4.28 (tails/tails!742)
8180 - Use expected location of release notes
8181 - Easier technical-writers notification
8182 - clean RCs from rsync.lizard: command
8183 - twitter: less brain usage, more commands
8184 - clicking links is easier than thinking
8185 - RM: please communicate before clocking off
8186 - more parallelization: do tests while IUKs are building
8187 - lesson learned: read DSA mailing list
8188 - be sure you are on the right branch
8189 - importing PO often fails: let's explain why
8190 - check iuks/v2 exists: scripted
8192 -- Tails developers <tails@boum.org> Mon, 04 Apr 2022 13:21:09 +0200
8194 tails (4.28) unstable; urgency=medium
8196 * Upgrade to Tor Browser 11.0.7-build2 based on Firefox 91.7 (tails/tails!741)
8199 - Upgrade to Tor Browser 11.0.7 based on Firefox 91.7 (tails/tails#18853)
8202 - Fetch Tor Browser from our own archive
8203 - Upgrade Tor Browser to 11.0.7-build2
8205 * Upgrade to Thunderbird 91.6.1
8207 * Upgrade to tor 0.4.6.10 (tails/tails!737)
8210 - Upgrade to tor 0.4.6.10 (tails/tails#18835)
8213 - Upgrade to tor 0.4.6.10 (Closes #18835)
8215 * Enable obfs4proxy logging (tails/tails!734)
8218 - save obfs4proxy logs into artifacts
8219 - enable obfs4proxy debug logging
8220 - "obfs4proxy managed" is an option from the past
8222 * minor fixes to custom-apt-cruft-check (tails/tails!733)
8225 - custom-apt-cruft-check: output nicer Markdown
8226 - Give method a name closer to what it wraps
8228 - fix wrong variable name
8232 * Test suite: collect logs of tor & friends when we timed out waiting for TCA to
8233 connect (tails/tails!732)
8236 - Test suite does not save tor log on "Timed out while waiting for TCA to connect
8237 to Tor (Timeout::Error)" (tails/tails#18850)
8240 - Apply 2 suggestion(s) to 1 file(s)
8241 - Test suite: collect logs of tor & friends when we timed out waiting for TCA to
8244 * Test suite: ignore old APT repository signing key (tails/tails!731)
8247 - Test suite: ignore expiration date of 221F9A3C6FA3E09E182E060BC7988EA7A358D82E
8251 - Test suite: ignore old APT repository signing key
8253 * Test suite can test on the real Tor network (tails/tails!725)
8256 - Test behavior on the real Tor network (tails/tails#18847)
8259 - move Jenkins-only code in the appropriate section
8260 - better debug message
8261 - shell oneliner converted to ruby
8262 - Configure simulated Tor network: step -> function
8263 - rubocop is happier
8264 - Test suite: don't try to save chutney data when it does not exist
8265 - add at least one relevant scenario
8266 - if +real-Tor, select relevant scenarios
8267 - test suite runs with real Tor, if +real-Tor
8268 - "default bridges" honors --disable-chutney
8269 - Check adapted to --disable-chutney
8270 - run_test_suite --disable-chutney
8271 - chutney-specific conf moved into appropriate step
8273 -- Tails developers <tails@boum.org> Mon, 07 Mar 2022 18:16:01 +0100
8275 tails (4.27) unstable; urgency=medium
8277 * Upgrade Tor Browser to 11.0.6-build1, based on Firefox 91.6 (tails!724)
8279 Closes issues: tails#18799
8281 This upgrades obfs4proxy to the version shipped with Tor Browser 11.0.4
8282 (0.0.11 + a few commits).
8284 * Upgrade to Linux 5.10.92 (tails/tails!721)
8287 - devel branch FTBFS with webext-ublock-origin-firefox 1.39.0+dfsg-2
8289 - Upgrade Linux to 5.10.92+ (DSA 5050-1) (tails/tails#18805)
8292 - Refresh uBlock Origin patch
8293 - Dropping VirtualBox guest support for now
8294 - Bump APT snapshot of the Debian archive to 2022012801
8295 - Upgrade to Linux 5.10.0-11 (currently at version 5.10.92-1)
8297 * Upgrade to Thunderbird 91 (tails/tails!720)
8300 - Upgrade to Thunderbird 91 (tails/tails#18069)
8303 - Test suite: update expected images for Thunderbird 91
8304 - Test suite: adjust to Thunderbird 91 UI
8305 - Test suite: drop dead code
8306 - Test suite: lint (thanks Rubocop)
8307 - Test suite: refactor (extract code to method) to solve Rubocop error
8309 - Update path mangling in Thunderbird patches for v91
8310 - Update Thunderbird patches from
8311 tails/thunderbird@bef716a60762b743dce1f48c37a64a99a0707b21
8312 - Upgrade to Thunderbird 91
8314 * Insist on Tor Browser being offline (#18584) (tails/tails!711)
8317 - Change buttons to [Start Tor Browser Offline] [Open Tor Connection] when
8318 starting Tor Browser while not connected to tor (tails/tails#18584)
8321 - Insist on Tor Browser being offline (#18584)
8323 * Install obfs4proxy from the Tor Browser tarball (tails/tails!716)
8326 - Briefly document what config/equivs is for
8327 - Install our dummy obfs4proxy package
8328 - Enable the 18800-obfs4proxy-from-tor-browser-tarball APT overlay (refs:
8330 - Add equivs configuration for our new obfs4proxy dummy package
8331 - AppArmor: allow access that obfs4proxy 0.0.11 needs
8332 - Install obfs4proxy from the Tor Browser tarball
8335 * Test suite: update expected button label (tails/tails!718)
8338 - Test suite: update expected button label
8340 * Re-generate our test IUKs using gensquashfs (tails/tails!715)
8343 - Re-generate our test IUKs using gensquashfs (tails/tails#18654)
8346 - Test suite: use test IUKs generated with gensquashfs
8347 - Release process: never delete test IUKs generated with gensquashfs
8348 - Give new, unique names to test IUKs generated with gensquashfs
8350 * Add generated tails-backup.desktop to .gitignore (tails/tails!714)
8353 - Add generated tails-backup.desktop to .gitignore
8355 * simplify workflow when adding an APT overlay (tails/tails!708)
8358 - waiting now uses a proper tool
8359 - add-APT-overlay can wait for suite creation
8361 * Resolve "Tests for backup are fragile" (tails/tails!706)
8364 - Tests for backup are fragile (tails/tails#18727)
8367 - try to make backup tool test more resilient
8369 * fix wi-fi settings from Tor Connection (tails/tails!692)
8372 - Fix Wi-Fi settings when open from Tor Connection (tails/tails#18587)
8375 - Fix Wi-Fi settings from Tor Connection
8377 -- Tails developers <tails@boum.org> Mon, 07 Feb 2022 13:50:41 +0000
8379 tails (4.26) unstable; urgency=medium
8381 * Resolve "All branches FTBFS since Thunderbird 91 was uploaded"
8385 - All branches FTBFS since Thunderbird 91 was uploaded (tails/tails#18789)
8388 - pin thunderbird l10n packages, too
8389 - Add freeze exceptions for 4.26
8390 - Enable the 18789-fix-ftbfs-thunderbird-91 APT overlay (refs: #18789).
8392 * Upgrade Tor Browser to 11.0.4-build2 (tails/tails!710)
8395 - Upgrade to Tor Browser 11.0. … 4? (tails/tails#18795)
8398 - Fetch Tor Browser from our own archive
8399 - Upgrade Tor Browser to 11.0.4-build2
8401 * Resolve "Change buttons to [Start Tor Browser Offline] [Open Tor Connection]
8402 when starting Tor Browser while not connected to tor" (tails/tails!704)
8405 - Change buttons to [Start Tor Browser Offline] [Open Tor Connection] when
8406 starting Tor Browser while not connected to tor (tails/tails#18584)
8409 - open TorBrowser when offline →opens Tor Connection
8411 * Use DuckDuckGo for search queries on our website (tails/tails!498)
8414 - Don't search on staging.tails.boum.org
8416 - Translate searchbox placeholder
8417 - Factorize the CSS translation hack
8418 - Remove useless template
8419 - Improve search box
8420 - Align better the heart and the label
8421 - Use DuckDuckGo on news as well
8422 - Prevent Search and Donate from touching on small screen
8423 - Fix contrast to WCAG AA
8424 - Use DuckDuckGo for search queries (#17652)
8426 -- Tails developers <tails@boum.org> Mon, 10 Jan 2022 13:15:16 +0100
8428 tails (4.25) unstable; urgency=medium
8430 * Upgrade Tor Browser to 11.0.2-build3 (tails/tails!684)
8433 - Upgrade to Tor Browser 11.0.2 based on Firefox 91.4esr (tails/tails#18726)
8436 - Fetch Tor Browser from our own archive
8437 - FIX sha256sums for TorBrowser
8438 - Upgrade Tor Browser to 11.0.2-build3
8440 * Unsafe Browser: fix buggy GUI after upgrade to Tor Browser 11.0a10
8444 - Buggy GUI in Unsafe Browser after upgrade to Tor Browser 11.0a10
8448 - Unsafe Browser: fix buggy GUI after upgrade to Tor Browser 11.0a10.
8450 * IUK generation: stop using the "extreme" extra compression option
8454 - squashfs-tools-ng is slow (tails/tails#18675)
8457 - IUK generation: stop using the "extreme" extra compression option
8459 * Fix devel FTBFS by dropping VirtualBox guest support for now (tails/tails!652)
8462 - Test suite: the live user is no longer a member of vboxsf.
8463 - Fix FTBFS by dropping VirtualBox for now (Closes #18643)
8465 * APT: trust the new signing key for our APT repositories (tails/tails!682)
8468 - APT: trust the new signing key for our APT repositories (tails/sysadmin#17810)
8470 * Resolve ""I can listen to an Ogg audio track in Tor Browser" test suite step
8471 sometimes fails" (tails/tails!680)
8474 - "I can listen to an Ogg audio track in Tor Browser" test suite step sometimes
8475 fails (tails/tails#18716)
8478 - Test suite: make audio in browser test more robust
8479 - Test suite: simplify
8481 * Refresh uBlock origin patch to fix devel FTBFS (tails/tails!678)
8484 - Refresh uBlock Origin patch
8486 * Fix shellcheck CI job (tails/tails!677)
8489 - Replace unsupported braces expansion with list
8490 - Add missing quotes
8491 - Update shellcheck exclusion for newer shellcheck
8493 * Drop feature/tor-nightly-master branch (tails/tails!676)
8496 - APT time-based snapshots fail: tor-nightly-master-buster suite does not exist
8497 anymore (tails/tails#17877)
8500 - Drop feature/tor-nightly-master branch
8502 * Upgrade Tor Browser to 11.0.1-build1 (tails/tails!675)
8505 - Upgrade to Tor Browser 11.0.1 (based on Firefox 91.3esr) (tails/tails#18641)
8508 - Revert "Unsafe Browser: fix buggy GUI after upgrade to Tor Browser 11.0a10."
8509 - Upgrade Tor Browser to 11.0.1-build1
8511 * run_test_suite --live-patch (and more!) (tails/tails!674)
8514 - one-line if can be made more compact
8515 - enjoy some File module goodness
8516 - avoid using shell, let's Find.find with ruby
8517 - Apply 1 suggestion(s) to 1 file(s)
8518 - correctly handle invocations without --live-patch
8519 - refactoring: live_patch is a VM method
8520 - --live-patch is more powerful
8521 - --live-patch (draft)
8522 - run_test_suite --view-interact
8523 - test suite debug: easier to copy files in the VM
8525 * Test suite: remove unused step definition and the corresponding image
8529 - Test suite: remove unused step definition and the corresponding image
8531 * Test suite: fix reporting of hostname leaks via DHCP (tails/tails!671)
8534 - Test suite: fix reporting of hostname leaks via DHCP
8536 * Fix some GitLab CI tests (tails/tails!669)
8539 - Add missing dependencies
8540 - Add missing dependency
8541 - Maintain the list of Tor Connection dependencies in a single place
8543 * Resolve "Compute years range dynamically in Tor Connection's time setting
8544 dialog" (tails/tails!668)
8547 - Compute years range dynamically in Tor Connection's time setting dialog
8551 - Tor Connection year range derives from build time
8553 * add comments to connect-drop after security audit (tails/tails!666)
8556 - add comments to connect-drop after security audit
8558 * Add a "Tails (External Hard Disk)" boot menu option (tails/tails!665)
8561 - Add a "Tails (External Hard Disk)" option that removes live-media=removable
8563 * Vagrant build box: have hostname resolve to 127.0.0.1 (tails/tails!661)
8566 - Vagrant build box: have hostname resolve to 127.0.0.1
8568 * Test suite: give GNOME Overview more time to process our search
8572 - Test suite: give GNOME Overview more time to process our search
8574 * Upgrade Vagrant build box to Bullseye (tails/tails!653)
8577 - Upgrade Vagrant build box to Bullseye (tails/tails#18660)
8580 - Vagrant: add more debug output
8581 - build-tails: fix submodule initialization
8582 - Use long option name
8583 - Vagrant build box provisioning: don't assume the "debian" and "debian-security"
8584 snapshots have the same serial
8585 - Document when we can drop a workaround
8586 - Upgrade Vagrant build box to Bullseye
8587 - Vagrant build box: bump all APT snapshots
8589 * create-usb-image-from-iso: detect syslinux installation failure
8593 - Builds succeeds even if syslinux failed to install in create-usb-image-from-iso
8598 - create-usb-image-from-iso: remove obsolete comments
8599 - create-usb-image-from-iso: remove obsolete workaround
8600 - create-usb-image-from-iso: detect syslinux installation failure
8602 * Tor Connection: Add link to Troubleshooting doc (tails/tails!650)
8605 - Link to the Tor connection troubleshooting doc from the error screen
8609 - apply UX tip: move link to bottom
8610 - Tor Connection: Add link to Troubleshooting doc
8612 * Trim down SquashFS exclusions: remove obsolete ones, move as much as possible
8613 to chroot_local-hooks (tails/tails!649)
8616 - leading slashes are clearer
8617 - Trim down SquashFS exclusions: remove obsolete ones, move as much as possible
8618 to chroot_local-hooks
8620 * Upgrade to tor 0.4.6.8 (tails/tails!647)
8623 - Upgrade tor to 0.4.6 (tails/tails#18310)
8626 - Upgrade to tor 0.4.6.8, by bumping the snapshot of the torproject APT
8627 repository to 2021110301
8629 * Improve dialog when Unsafe Browser is not enabled (tails/tails!628)
8632 - Improve dialog when Unsafe Browser is not enabled (tails/tails#18598)
8637 - Apply 1 suggestion(s) to 1 file(s)
8638 - Make the link for the Unsafe Browser documentation translatable
8639 - Use a named anchor (refs: #18598)
8640 - Include link for the Unsafe Browser documentation
8641 - Associate text/html with tor-browser (refs: #18598)
8642 - Apply 1 suggestion(s) to 1 file(s)
8643 - Improve dialog when Unsafe Browser is not enabled
8645 * Basic GUI to backup a Persistent Storage to another one (tails/tails!596)
8648 - Retry updating the backup if only mounting the backup Tails is missing
8650 - Basic GUI to backup a Persistent Storage to another one (tails/tails#18504)
8653 - Test suite: improve readability
8654 - Test suite: test that the backup is identical to the source
8655 - Adjust to a04204cba2
8656 - Adjust to 6161e4f823
8657 - Adjust to a77c2425f3
8658 - Adjust to cb7b877fda
8659 - Test suite: use deprecated GuestFS luks_* functions
8662 - tails-backup: avoid issue in non-English locales
8663 - Shellcheck: disable excessive rule
8664 - Test suite: detect disks being plugged using udisks
8665 - Test suite: add elementary scenario for tails-backup.
8666 - tails-backup: implement pinentry retries and cancel
8667 - tails-backup: handle unlocked but unmounted TailsData
8668 - tails-backup: suppress bilibop's message
8669 - tails-backup: detect if rsync fails through pipefail
8670 - Expand rsync short options.
8671 - tails-backup-rsync: defensively check that we copy between mountpoints
8672 - tails-backup: make shellcheck happy
8673 - tails-backup: don't try to unlock and already unlocked and mounted volume
8674 - tails-backup: drop need for admin password
8675 - tails-backup: drop unused parameters
8676 - tails-backup: add back progress bar that doesn't hide rsync's output
8677 - tails-backup: fix up on "Always display the 1st screen"
8679 - Improve feedback (for now)
8681 - Always display the 1st screen if there's any error (#18720)
8682 - Use consistent quotes
8683 - Put the most meaningful word first
8684 - Move together with the other Persistent Storage utilities
8685 - tails-backup: drop unused variables
8686 - tails-backup: use consistent indentation
8687 - tails-backup: unlock and mount the drive automatically
8688 - tails-backup: show pulsating progress while copying
8689 - tails-backup: try to eject automatically
8690 - tails-backup: fix quoting.
8691 - Make tails-backup executable.
8693 - Advice to upgrade from the backup utility
8694 - Update doc to Persistent Storage Backup utility
8696 - Rework interactions and copy
8697 - fix typo in .desktop file
8698 - update to latest version of the script
8701 * Improve robustness of new TCA automated tests (tails/tails!525)
8704 - Test suite: drop unused step.
8705 - Test suite: correctly use "is None" in python script.
8706 - Remove usage of tor.sh's tor_is_working
8707 - Drop most of the tor shell library.
8708 - tor_is_working is stem-based, too
8709 - refactor bash+py stem wrapper into py script
8710 - python ♥ equality to None should use `is` keyword
8711 - python ♥ let's PEP8 everything
8712 - python ♥ remove useless imports
8713 - python ♥ proper argument parser
8714 - python ♥ main function
8716 - Drop unused variable.
8717 - Catch correct exception.
8719 - Rewrite tor_wait_until_bootstrapped() to be more robust.
8720 - Extreme Nitpicking™
8721 - Make tor_wait_until_bootstrapped() handle tor restarts.
8722 - Improve debugging.
8723 - Avoid spamming new python interpreters while waiting for Tor to bootstrap.
8724 - Allow multiline code blocks in tor_control_stem_wrapper().
8725 - Target the 4.22 code base
8726 - XXX debugging for test/18293-improve-tca-test-robustness
8727 - Test suite: adapt to removal of tor_control_send().
8728 - Test suite: test that tor's control port is open for real.
8729 - Tor shell library: improve error handling when the Tor control port is
8731 - Remove mention of unused import.
8732 - Tor shell library: re-implement control interaction with Python and stem.
8733 - Tor shell library: improve parsing and error handling of getinfo/getconf.
8734 - Add missing shell quoting.
8735 - Add forgotten local variables.
8736 - Add proper error handling to the shell library's control port interaction.
8737 - Test suite: wait for tor's ControlPort before using it (refs: #18293).
8739 -- Tails developers <tails@boum.org> Mon, 06 Dec 2021 16:03:22 +0100
8741 tails (4.24) unstable; urgency=medium
8743 * Upgrade to Tor Browser based on Firefox 91 ESR (tails/tails!639)
8746 - Upgrade to Tor Browser based on Firefox 91 ESR (tails/tails#18261)
8749 - Unsafe Browser: disable more "phone home" features
8750 - Unsafe Browser: disable services.settings.server
8751 - Test suite: search for element more widely.
8752 - Test suite: Firefox' Print dialog is now a panel (refs #18261)
8753 - Update the Tor Browser AppArmor policy for Tor Browser 11 (Firefox 91)
8755 - Test suite: make Gherkin test description more honest
8756 - Rubocop: disable a pattern we use all over the place
8757 - Test suite: update expected images and drop obsolete special-case for Chinese
8758 - Test suite: account for different separator used in German
8760 - Test suite: update comment
8761 - Fix typo in comment
8762 - Test suite: adjust to new Firefox print dialog
8763 - Test suite: update expected windows titles
8764 - Test suite: update expected images
8765 - Upgrade Tor Browser to 11.0a9
8767 * Test suite: make "Unsafe Browser has only Firefox's default bookmarks
8768 configured" step more robust (tails/tails!646)
8771 - Fragile test since the upgrade to Tor Browser 11: "Unsafe Browser has only
8772 Firefox's default bookmarks configured" (tails/tails#18658)
8775 - Test suite: wait for menu to really open before looking for menu entry
8776 - Test suite: update expected picture
8778 * APT sources: add Bullseye security (stable) (tails/tails!637)
8781 - APT sources: add Bullseye security (tails/tails#18492)
8784 - APT pinning: ensure we get security updates for the packages we pull from
8786 - APT sources: add Bullseye security repo
8788 * Move tca developer doc to more appropriate places (tails/tails!636)
8791 - Update "Tor network configuration" design doc (tails/tails#18360)
8794 - tips to develop Tor Connection are reachable
8795 - tca doc behavior.md moved to Gherkin
8796 - move tca/HACKING.md to website
8798 * APT sources: add Bullseye security (tails/tails!626)
8801 - APT pinning: ensure we get security updates for the packages we pull from
8803 - APT sources: add Bullseye security repo
8805 * Upgrade kernel to 5.10.46-5 in stable (tails/tails!625)
8808 - Upgrade Linux to 5.10.46-5 (DSA 4978-1) (tails/tails#18613)
8809 - Upgrade to Buster 10.11 (tails/tails#18608)
8812 - Pull libzstd1 from Bullseye: needed by updated squashfs-tools
8813 - Install squashfs-tools from bullseye.
8815 - to get a new kernel in stable, bump debian/serial
8816 - change pinning to get kernel from bullseye
8817 - bump kernel to 5.10.46-5
8819 * Upgrade kernel to 5.10.46-5 in devel (tails/tails!622)
8822 - Pull libzstd1 from Bullseye: needed by updated squashfs-tools
8823 - change pinning to get kernel from bullseye
8824 - bump kernel to 5.10.46-5
8826 * update Tor network configuration design doc (tails/tails!606)
8829 - TCA is not a Tor Launcher wrapper.
8830 - Apply intrigeri's proofreading suggestions.
8831 - explain why tca-portal runs as root
8832 - Document connect-drop security model
8833 - update Tor network configuration design doc
8835 * TCA: clean leftovers (tails/tails!604)
8838 - TCA clean leftovers (tails/tails#18273)
8841 - systemd-notify: move to better way
8842 - we considered this implementation good enough
8844 - move XXX to #18610
8845 - clarify comment after tails/tails!567
8846 - remove code that was never used and never tested
8847 - comment moved to #18609
8849 * Upgrade Tor Browser to 11.0a10-build1 (tails/tails!655)
8852 - Upgrade Tor Browser to 11.0a10-build1
8854 * Remove obsolete freeze exception (tails/tails!648)
8857 - Remove obsolete freeze exception
8859 * Port the iuk test suite from squashfs-tools to squashfs-tools-ng
8863 - Port the iuk test suite from squashfs-tools to squashfs-tools-ng
8867 - IUK test suite: support file names with spaces
8868 - IUK test suite: take into account gensquashfs behavior wrt. SOURCE_DATE_EPOCH
8869 - IUK test suite: add missing import
8870 - IUK test suite: port from squashfs-tools to squashfs-tools-ng
8871 - IUK generation: add assertion
8872 - Upgrader: use apparent size to compute space needed to install an IUK
8874 * Switch to zstd for SquashFS compression in development ISO/USB images
8878 - Switch to zstd for SquashFS compression in development ISO/USB images
8880 * Switch to squashfs-tools-ng to build IUKs (tails/tails!640)
8883 - Switch to squashfs-tools-ng to fix IUKs build reproducibly (tails/tails#18577)
8884 - Failure reproducing IUKs for 4.22~rc1 (tails/tails#18536)
8885 - Failure reproducing IUKs for 4.23 (tails/tails#18627)
8888 - GitLab CI: avoid confusing error message
8889 - Release process: use only the isobuilders that have squashfs-tools-ng
8890 - Switch to squashfs-tools-ng to generate our IUKs
8891 - Update release process requirements for building IUKs
8893 * Resolve "Tor Connection bridge tests fail" (tails/tails!621)
8896 - Tor Connection bridge tests fail (tails/tails#18634)
8899 - FIX tests for 84e047ebd39e too
8900 - fix tests after 68b0e77119e
8902 * Upgrader: avoid high cpu usage when getting download progress info
8906 - tails-upgrade-frontend causes very high CPU load when downloading upgrade
8910 - Upgrader: avoid high cpu usage when getting download progress info
8912 * Explain better how to type a bridge (#18597) (tails/tails!617)
8915 - Explain better "type in a bridge" (tails/tails#18597)
8919 - Use singular as much as possible
8920 - Use 'bridge' in singular as much as possible
8922 - Explain better how to type a bridge (#18597)
8923 - Style guide: not everybody types
8925 * Don't mention local network in Unsafe Browser confirmation (tails/tails!615)
8928 - Don't mention local network in Unsafe Browser confirmation (tails/tails#18600)
8933 * Rephrase intro of Fix Clock dialog (tails/tails!614)
8936 - Rephrase intro of Fix Clock dialog (tails/tails#18572)
8939 - Be consistent with /doc/about/warnings/identity
8941 - Remove duplicate text
8942 - Simplify and be more correct
8944 * Improve time zone selection UX (tails/tails!595)
8947 - Improve time zone selection UX (tails/tails#18514)
8950 - the test suite correctly handles UTC/GMT
8951 - UTC can be selected, too
8952 - test suite enjoys better UX, too
8953 - pressing enter selects topmost entry
8954 - tca gtk errors are logged immediately
8955 - test suite waits for filtering to be applied
8956 - Test suite: replace usage of non-existing Screen.pressKey with Screen.press
8957 - revamp the time selection dialog
8959 - test suite updated for new timezone selection
8960 - FIX matching (lets hope so)
8961 - better UX for timezone selection
8962 - proper logging in asyncutils
8964 * Installer: make the confirmation dialog more scary (tails/tails!593)
8967 - Make the confirmation more scary when reinstalling a USB stick that has a
8968 Persistent Storage (tails/tails#18301)
8971 - Test suite: adjust confirmation label when reinstalling over a usb with a
8973 - Test suite: adjust confirmation dialog label in Installer (refs #18301)
8974 - Installer: inform when there is no target available
8975 - Installer: enforce Persistent Storage detection
8976 - Installer: display if the target device has a Persistence Storage
8977 - Make the confirmation more scary when reinstalling a USB stick that has a
8978 Persistent Storage (refs: #18301)
8980 * TCA: Fix "AttributeError: no attribute persistence_config_failed"
8985 - make the diff smaller
8986 - TCA: Fix "AttributeError: no attribute persistence_config_failed"
8988 -- Tails developers <tails@boum.org> Thu, 04 Nov 2021 14:25:18 +0100
8990 tails (4.23) unstable; urgency=medium
8992 * Upgrade Tor Browser to 10.5.8-build2 (tails/tails!611)
8995 - Upgrade to Tor Browser 10.5.8 (based on Firefox 78.15.0esr) (tails/tails#18623)
8998 - Fetch Tor Browser from our own archive
8999 - Upgrade Tor Browser to 10.5.8-build2
9001 * FIX #18568: wait after killing TBB (tails/tails!607)
9004 - "Tails is localized for every tier-1 language" test fails on iguana
9008 - FIX #18568: wait after killing TBB
9010 * Fix devel FTBFS (tails/tails!601)
9013 - Install squashfs-tools from bullseye.
9014 - Refresh uBlock patch vs version 1.37.0+dfsg-1 (fixes: #18537)
9016 * copy-iuks-to-rsync-server-and-verify: handle arbitrary build agents
9020 - copy-iuks-to-rsync-server-and-verify: needs adjustment for changing isobuilder
9021 names (tails/tails#18574)
9024 - copy-iuks-to-rsync-server-and-verify: handle arbitrary build agents.
9026 -- Tails developers <tails@boum.org> Tue, 05 Oct 2021 08:20:24 +0200
9028 tails (4.22) unstable; urgency=medium
9030 * Upgrade Thunderbird to 78.13.0-1~deb10u1
9032 * Upgrade to Tor Browser 10.5.6 (78.14.0esr) (tails/tails!594)
9035 - Upgrade Tor Browser to 10.5.6-build2 (fixes: #18566)
9037 * Remove Prestera firmware, that's useless in the context of Tails
9041 - Stop setting up a kernel module build environment during the images build
9042 - Remove Prestera firmware, that's useless in the context of Tails
9044 * Only allow typing 1 bridge (tails/tails!587)
9047 - Only allow typing 1 bridge
9049 * Don't pretend tor has bootstrapped when tor@default.service failed to start
9053 - Don't pretend tor has bootstrapped when tor@default.service failed to start
9055 * Upgrade firmware-amd-graphics to 20210818-1 (tails/tails!582)
9058 - Install version 20210818-1 of packages built from src:firmware-nonfree
9059 - Enable the 18556-amd-gpu-firmware APT overlay (refs: #18556).
9061 * Ensure we use a working mirror to download automatic upgrades (tails/tails!581)
9064 - Update mirror-pool-dispatcher submodule
9065 - Allow the Upgrader to use tor, now needed by tails-transform-mirror-url for
9067 - many improvements to mirror-pool-dispatcher
9068 - FIX dependency for tails-transform-mirror-url
9069 - apply suggestion from mirror-pool-dispatcher!2
9070 - mirror-pool-dispatcher tests mirrors
9072 * Test suite: fix Pidgin scenarios with XMPP accounts on a server that requires
9073 going through the "Create New Room" UI (tails/tails!580)
9076 - Some Pidgin test suite scenarios fail when using XMPP accounts on a server that
9077 requires going through the "Create New Room" UI (tails/tails#18560)
9080 - Test suite: update expected Pidgin images
9082 * Test suite: fail if tor reports that DisableNetwork is an empty string
9086 - Test suite: log and fail if tor reports that DisableNetwork is an empty string
9088 * Persistent Bridges, iteration 4: integrate bridges persistence in Tor
9089 Connection (tails/tails!543)
9092 - Tor Connection: remove visible border around scrolled window
9093 - Drop unneeded grep option
9094 - Test suite: be more defensive when interacting with toggle buttons
9095 - Test suite: disable step that does not reflect the current implementation
9097 - Mention alternate implementation idea in comment
9098 - Fix typo in comment
9099 - Make checks closer to our needs
9100 - Move shell code from tca-portal to helper script
9101 - Make tca-portal helper script more generic
9102 - Tor Connection: when pre-filling bridges, adjust the verb from "Type in" to
9104 - Test suite: explain what labelee is
9105 - Test suite: adjust to current UI
9106 - TCA: fix display on low-height screen resolutions
9107 - Test suite: update expected UI text to match current implementation
9108 - TCA: correctly set the bridges persistence switch's initial state
9109 - TCA: adapt to new tca-portal API
9110 - TCA: remove unused imports
9111 - TCA: display error when enabling/disabling persistence failed
9112 - TCA: check success/failure of portal call when enabling/disabling persistence
9114 - Test suite: adjust strings to match current implementation
9115 - TCA: lock the UI and display a spinner while enabling/disabling persistence
9116 - TCA: add another keyboard accelerator
9117 - TCA: when toggling bridges persistence, wait the portal call to return a
9119 - TCA: remove unused import
9120 - Change usages of call_async to new API
9121 - TCA: remove incorrect signal handling
9122 - TCA: actually enable/disable Tor bridges persistence when the user asks us to
9123 - TCA: display vertical scrollbar when contents does not fit
9124 - TCA: hide Network Monitor launcher
9125 - Test suite: use the Tor Connection UI to enable bridges persistence
9126 - TCA: add skeleton implementation for toggling bridges persistence on/off
9127 - TCA: draft bridges Glade UI
9128 - TCA: improve keyboard navigation
9129 - TCA: add accessibility relationships between a bunch of widgets
9130 - TCA: add debug output
9131 - TCA: move persistence detection to the wrapper script
9132 - TCA: avoid throwing an (invisible) KeyError exception on first launch
9135 * Persistent Bridges, iteration 3: allow persisting bridges (tails/tails!539)
9138 - Test suite: lint, again
9139 - Test suite: adjust expected owner to actual implementation
9140 - TCA: check and save persistence status on startup
9141 - tca-portal: add commands to enable/disable persistence of Tor configuration
9142 - Test suite: mock functionality that's not implemented yet
9143 - Test suite: add step implementation
9144 - Test suite: disable incorrect step definition
9145 - Test suite: implement steps
9146 - Test suite: adjust to expected permissions of /var/lib/tca
9147 - Persistence setup: add support for disabling a preset non-interactively
9148 - Persistence setup: add a "Tor Bridges" feature
9149 - On shutdown, copy to Persistent Storage the Tor configuration that should now
9151 - Test suite: implement "I accept Tor Connection's offer to use my persistent
9153 - Test suite: implement "I choose to connect to Tor automatically" step.
9154 - Test suite: extend step to handle configuring persistent bridges.
9155 - TDD: add (unimplemented) steps for Tor bridges persistence
9156 - Test suite: simplify feature name
9158 * Persistent Bridges, iteration 2: use settings from tca.conf on first start
9162 - Revert "Test suite: cope with current actual behavior"
9163 - TCA: rename method to reflect what it now does
9164 - TCA: on first run, pre-seed bridges UI state from configuration
9165 - TCA: add debug logging to help understand what configuration we've loaded
9166 - TCA: add debug output to help figure out whether we loaded tca.conf
9167 - TCA: fix loading an empty or invalid configuration file
9168 - TCA: on first start, load Tor connection configuration from tca.conf
9170 * Persistent Bridges, iteration 1: split transient / potentially persistent state
9174 - Test suite: cope with current actual behavior
9175 - Test suite: adjust to actual implementation
9176 - TCA: don't save the default bridges to tca.conf
9177 - Test suite: fix buggy "tca.conf is empty" test
9178 - Make method name clearer and consistent with read_tca_state()
9179 - TCA: Rename method
9181 - TCA: Migrate transient state information to a dedicated file
9182 - TCA: Rename method
9183 - TCA: Refactoring (extract code to functions)
9184 - Test suite: Implement new steps
9186 - TDD: add (unimplemented) steps for the contents of tca.conf
9187 - TCA: Disable loading proxy settings from the configuration file
9188 - TCA: Set up, pass through, and inherit a new state file
9189 - TCA: Remove unused import
9190 - TCA: Drop unneeded call to expanduser()
9191 - TCA: Only save known-working Tor configuration to tca.conf
9192 - TCA: Minor refactoring (avoid having to reason about double-negations)
9193 - TCA: Make methods names more specific
9195 * Always start tor@default.service at boot, don't restart it after closing the
9196 Unsafe Browser (tails/tails!584)
9199 - Test suite: adjust to the fact tor@default.service is started during boot
9200 - Don't restart tor after exiting the Unsafe Browser
9201 - Always start tor@default.service at boot
9203 * Unsafe Browser: Only mention the Persistent Storage when there is one
9207 - Unsafe Browser: Only mention the Persistent Storage when there is one
9209 * Fix running the test suite on sid (tails/tails!579)
9212 - Drop another instance of the obsolete which(1)
9213 - Test suite: migrate away from obsolete which(1)
9214 - Test suite: switch to virtio graphics
9216 * FIX run_test_suite usage of tor --version for corner-cases (tails/tails!575)
9219 - FIX run_test_suite for corner-cases
9221 * Installer: fix combobox freezes (tails/tails!571)
9224 - Installer: fix combobox freezes (refs: #18531)
9226 * Update Tor Browser AppArmor policy (tails/tails!568)
9229 - Update Tor Browser AppArmor policy
9231 * Tor Connection: decrease "sign of life" timeout, increase bootstrap timeout
9235 - Test suite: DRY clicking "Connect to Tor"
9236 - Test suite: drop obsolete workaround
9238 - Tor Connection: allow the user to retry connecting to Tor from the error screen
9239 with the same settings
9240 - TCA hacking: use numbers that we have a chance to somewhat support
9241 - TCA hacking: drop buggy option
9242 - Add dummy entry for next release
9243 - Tor Connection: decrease "sign of life" timeout, increase bootstrap timeout
9245 * Test suite: use new XMPP chat rooms (tails/tails!566)
9248 - Deal with xmpp.riseup.net going away (tails/tails#17956)
9251 - Test suite: remove dead code
9252 - Test suite: rename argument to match its current usage
9253 - Test suite: use new XMPP chat rooms
9255 * Resolve "TCA does not connect with default bridges when it should"
9259 - Let's use user-centric (first person) phrasing whenever possible
9260 - Always set variables
9261 - better variable names
9262 - test suite: support using bridges w/o needing them
9263 - Gherkin for #18462
9264 - preserve user's choice of using default bridges
9266 * Stop trying to connect to Tor when we reach the Tor Connection error screen
9270 - TCA hacking: add missing sudo
9271 - TCA hacking: make test firewall rule not depend on already having connected to
9273 - TCA hacking: make test firewall rule more accurate
9274 - Test suite: adjust to the new, fixed situation
9275 - Revert "let's wait for the Fix Clock dialog to show up"
9276 - let's wait for the Fix Clock dialog to show up
9277 - state machine docstring
9278 - minor cleaning use of variables
9279 - FIX state machine wrt DisableNetwork
9280 - refactor _decide_right_step
9281 - remove hopefully-obsolete todo comments
9282 - stop trying to connect after timeout
9284 * Move wait_for_working_tor logic from NetworkManager to systemd
9288 - Update links in comment
9289 - Drop useless logging
9290 - Allow NM to start htpdate again if it failed last time
9291 - Clean up implementation of "Does not run htpdate again after success"
9293 - sw upgrade should only run when tor is ready
9294 - waiting for readiness sounds like a pre-command
9295 - Does not run htpdate again after success
9296 - let's use the flag file, instead of asking tor
9297 - systemd-controlled htpdate
9299 * Add Russian to the bundled offline documentation (tails/tails!552)
9302 - enable Russian on our website. will-fix:
9303 https://gitlab.tails.boum.org/tails/tails/-/issues/18454
9305 * vagrant/lib/tails_build_settings.rb: use --no-signature with git log
9309 - vagrant/lib/tails_build_settings.rb: use --no-signature with git log
9310 - .gitignore: ignore vmdb2.log
9312 * GJsonRpcClient.call_async can set a callback (tails/tails!544)
9315 - tca-portal: add missing sentence bits
9316 - Apply 3 suggestion(s) to 1 file(s)
9317 - GJsonRpcClient response handler fix
9318 - tca-portal is now fully asynchronous
9319 - change previous usages of call_async to new API
9320 - call_async can set callbacks
9322 * drop tordate (tails/tails!542)
9325 - ooops, that wasn't useless!
9326 - Tor Connection: make GtkSpinButton's UI consistent
9327 - Tor Connection: add keyboard accelerators
9328 - Tor Connection: use "Wrong clock" instead of "Wrong time" terminology
9329 - Tor Connection: use "Fix Clock" instead of "Set Time" terminology
9331 - Test suite: simplify
9332 - Test suite: use higher-level predicate
9333 - Test suite: remove obsolete exception
9334 - htpdate: increase timeout for working tor
9335 - drop useless stuff from 10-time.sh
9336 - 20-time imports: update comments, fix shellcheck
9337 - remove confusing log line
9338 - htpdate works successfully after manual time set
9339 - tca sends stderr to journal
9340 - no reason to delete the tor log anymore
9341 - testing for tordate in test suite is now useless
9342 - stop mentioning tordate in website
9343 - update time syncing design doc
9344 - remove unused code from 20-time.sh
9345 - be bold: let's drop @fragile from tor bridges!
9348 * Re-enable the tor sandbox when no PTs are used (tails/tails!535)
9351 - Use variable name more readable than $1
9352 - Add missing "set -eu"
9353 - Test suite: fix typo in not-enabled-yet code
9354 - Test suite: prepare sandbox test for when #18470 is fixed
9355 - Test suite: adjust to tor sandbox being disabled when falling back to default
9357 - Remove unused attribute
9358 - Revamp management of the Tor Sandbox configuration option
9360 - Use consistent and less confusing names for attribute and method
9361 - Adjust to new call_async API
9362 - Tor Connection: disable caching of information retrieved from tor by Stem
9363 - Wait for side-effects of async call to complete.
9364 - Improve encapsulation.
9365 - Rename tor-sandbox-helper → tor-pt-configuration-helper.
9366 - Be defensive about arguments.
9367 - Give base-class a better name.
9368 - Drop useless re-definition of method in subclass.
9370 - Apply 1 suggestion(s) to 1 file(s)
9371 - Test suite: re-enable tor sandbox sanity check (refs: #18237).
9372 - Drop unused, out-of-date main() used for testing a library.
9373 - Re-enable the tor sandbox when no PTs are used (refs: #18237)
9375 * TCA: Allow the user to manually set time (tails/tails!531)
9378 - time dialog: spacing + follow mockups better
9379 - reference to how a problem might be solved
9380 - Set time test scenario uses snapshots
9381 - stricter date validation
9383 - Test suite re-introduce linting lost by merge conflict resolution
9385 - more bringing back from devel
9386 - Tor Connection: translate 1 string to test l10n
9387 - Update POT and PO files
9388 - bring back lost changes to tor.rb
9389 - fix datestring validation
9390 - Test suite: revert indentation regression
9391 - Test suite: use user-facing terminology in Gherkin
9392 - fix test suite about time dialog
9393 - loggers are better than prints
9394 - tca remembers user timezone
9395 - bring back "unsuccessfully configure" step
9396 - reorder fixes in the error screen
9397 - set-system-time has early input validation
9398 - tca-portal can validate arguments
9399 - set-system-time errors are handled
9400 - less noisy logging
9401 - tails-set-date cleaned a bit
9402 - tails-set-date checks if the date is valid early
9403 - wait for set time window to be closed
9404 - rewrite Gherkin using more user-centric language
9405 - fix "Apply suggestion"
9406 - Apply 1 suggestion(s) to 1 file(s)
9407 - tca test: combo box faster and cleaner
9408 - Tooltip for combo box
9409 - tca-portal is a bit more verbose
9410 - when changing the time, tor must be restarted
9411 - Test "set the time in tca" does what it says
9413 - FIX: missing .ui file translation support
9414 - Connect to Tor can be clicked
9415 - TCA: adds a dialog to Set Time
9416 - tca-portal allows setting time
9417 - Separate the anti-test from the fix
9418 - reword: "I try to" actually check failure
9419 - 15548 implementation is "simulated"
9420 - test suite: hw clock can be set to relative time
9421 - test: cmd_helper modernized
9422 - DRAFT: Add a Scenario for #15548
9424 * Allow running our test suite on modern AMD CPUs (tails/tails!406)
9427 - document LIBVIRT_CPUMODEL
9428 - amd hack: convert to config file
9429 - modern AMD CPUs apparently benefit from this fix
9431 -- Tails developers <tails@boum.org> Mon, 06 Sep 2021 15:14:57 +0200
9433 tails (4.21) unstable; urgency=medium
9435 * Upgrade to Linux 5.10.46-3 (tails/tails!549)
9438 - Upgrade to Linux 5.10.46-2+ (CVE-2021-33909) (tails/tails#18489)
9441 - Update /etc/group's expected lines ordering
9442 - Ensure UIDs/GIDs don't change
9443 - Remove obsolete dkms logs cleanup
9444 - Don't (attempt to) build VirtualBox guest modules anymore
9445 - Upgrade snapshot of the Debian archive to 2021080201
9447 * Upgrade Thunderbird to 78.12.0-1~deb10u1
9449 * Don't (attempt to) build VirtualBox guest modules anymore (tails/tails!537)
9452 - Update /etc/group's expected lines ordering
9453 - Ensure UIDs/GIDs don't change
9454 - Remove obsolete dkms logs cleanup
9455 - Don't (attempt to) build VirtualBox guest modules anymore
9457 * Installer: allow choose Upgrade option when reinstall is cancelled
9461 - Choosing "Upgrade" option in Tails Installer can delete persistent volume
9465 - Installer: allow choose Upgrade option when reinstall is cancelled
9467 * Upgrade to Tor Browser 10.5.4 (based on Firefox 78.13esr) (tails/tails!555)
9470 - Upgrade to Tor Browser 10.5.4 (based on Firefox 78.13esr) (tails/tails#18479)
9473 - Fetch Tor Browser from our own archive
9474 - Upgrade Tor Browser to 10.5.4-build1
9476 * Clean up code and pre-TCA leftovers (tails/tails!541)
9479 - Clean up pre-TCA leftovers (tails/tails#18365)
9480 - Rename a11y-proxy-netns: it's now used for ibus as well (tails/tails#18366)
9483 - Give function the name we use
9484 - Rename a11y-proxy-netns → netns-bus-proxy.
9485 - Rename TCA's torlaunch network namespace from torlaunch to tca.
9487 - Test suite: drop obsolete workaround.
9488 - Drop already done TODO comment.
9489 - Fix outdated references to Tor Launcher.
9490 - Drop unneeded workaround.
9491 - Test suite: drop code used to support --old-iso for 4.20 release.
9492 - Remove unused exec_unconfined_firefox().
9494 * Refactor and consolidate how we explicitly check for Tor leaks in the automated
9495 test suite (tails/tails!540)
9498 - "all Internet traffic has only flowed through Tor" sometimes fails: does not
9499 allow for varying behavior (fallback to default bridges, or not)
9503 - Test suite: refactor and consolidate how we explicitly check for Tor leaks.
9504 - Revert "Test suite: temporarily disable failing step in scenario."
9506 * Post-RM: doc improvements (tails/tails!528)
9509 - clarify release types
9510 - after releasing: give more guidance
9512 - rm doc: give manual testers the signatures
9513 - some parts are not related to freeze
9514 - refresh-translations explains that it failed
9515 - rm doc: clarify what to do with the package diff
9516 - rm doc: clarify freezing
9518 * Fix usage of mutable default arguments in Python (tails/tails!527)
9521 - Fix usage of mutable default arguments in Python
9523 * More automated testing of TCA for Sponsor08/10 (tails/tails!435)
9529 - Test suite: wait longer for the TCA to report errors.
9530 - Test suite: test that TCA reports an error when reconnecting to a network where
9532 - Test suite: drop unnecessary step.
9533 - Test suite: make blocking Tor survive reconnections.
9534 - Test suite: monitor Tor leaks.
9535 - Fix erroneous camel casing in translation.
9536 - Test suite: test explicitly selecting default bridges in TCA.
9537 - Test suite: test that the same Tor config is applied if TCA reconnects.
9538 - Test suite: test that TCA disallows normal bridges in hide mode.
9540 -- Tails developers <tails@boum.org> Mon, 09 Aug 2021 07:55:57 +0000
9542 tails (4.20) unstable; urgency=medium
9544 * Upgrade Thunderbird to 78.11.0-1~deb10u1
9546 * Upgrade KeePassXC to 2.6.2+dfsg.1-1~bpo10+1
9548 * 20-time.sh: actually abort if Tor has failed to bootstrap (tails/tails!514)
9551 - 20-time.sh: temporarily workaround buggy check
9552 - 20-time.sh: fix success and error handling
9553 - 20-time.sh: simplify control flow
9555 - 20-time.sh: actually abort if Tor has failed to bootstrap
9557 * Resolve "TCA sometimes fails to start: "bwrap: Can't find source path
9558 /tmp/netns-specific/torlaunch: No such file or directory"" (tails/tails!489)
9561 - tails-ibus-proxy-netns@.service: remove now unneeded NotifyAccess=all
9562 - a11y: systemd-notify -> import systemd.daemon
9563 - silence useless information to syslog
9564 - avoid errors when started directly
9565 - clean systemd unit
9566 - more timeout on a11y-proxy-netns
9567 - FIX gnome.sh search for exact name gnome-shell
9570 - wait for user systemd session to be ready
9571 - FIX systemctl path
9572 - remove testing leftover
9573 - a11y/ibus proxy wait socket to signal readiness
9574 - tca-related proxies only active when unneeded
9575 - tails-tor-launcher not needed anymore
9576 - a11y/ibus proxies for TCA only started with TCA
9577 - FIX: call systemctl --user
9578 - tentatively setting TCA as a systemd service
9580 * Resolve "TCA asks consent question when changing network" (tails/tails!460)
9583 - FIX: switching to progress, not success, on connection
9584 - small code cleaning
9586 - tca: FIX success-error-retry
9587 - tca reacts to DisableNetwork changes
9588 - reduce stem logging noise
9589 - tca application monitors DisableNetwork
9591 * tca-portal service (tails/tails!422)
9594 - start tca-portal at boot
9595 - restrict access to tca-portal.socket!
9596 - tca-portal: add open-documentation + refactoring
9597 - FIX FTBFS on tca-portal.service
9598 - gnome-system-monitor opens at network tab
9599 - ooops: enable tca-portal unit
9600 - tca-portal opens onioncircuits
9601 - tca-portal (sic!) has systemd socket-activation
9602 - tca can talk to its portal
9603 - tca-connection-helper based on tinyrpc
9604 - draft of a tor-connection-helper service
9606 * Resolve "TCA: buggy window detection logic on app startup" (tails/tails!457)
9609 - TCA sends startup notification to DE
9611 * Resolve "The amnesia user might have too much power over TCA's configuration
9612 directory" (tails/tails!442)
9615 - change documentation wrt to tca.conf
9616 - tca.conf path changed to /var/lib/tca/
9618 * Install Linux 5.10.46 and upgrade shim (tails/tails!521)
9621 - Update shim* to the version from sid
9622 - Update Linux to 5.10.46
9624 * Don't run a useless IBus proxy for OnionCircuits (tails/tails!510)
9627 - Don't run a useless IBus proxy for OnionCircuits
9629 * Rakefile: actually build with the base branch merged (tails/tails!504)
9632 - Merging the base branch is not effective ⇒ different Git state between
9633 isobuilders and isotesters (tails/tails#18441)
9636 - Rakefile: actually build with the base branch merged
9638 * Rewrite notification when closing TCA on progress bar (tails/tails!496)
9641 - Rewrite notification when closing TCA on progress bar (#18362)
9643 * Implement "Connect to Tor" button in error screen (tails/tails!494)
9646 - Revert "avoid errors when started directly"
9647 - step error correctly indicates that bridges are on
9648 - better textarea alignment
9649 - put the current bridges in the textarea
9650 - keeps more state about bridge configuration
9651 - avoid errors when started directly
9652 - error: step proxy now goes back to error screen
9653 - connect to tor actually does something
9654 - bridges + "connect to tor" on error
9655 - DRAFT of better error screen
9657 * Tor Connection Assistant (tails/tails!375)
9660 - open unsafe-browser (if configured)
9661 - Test suite: properly tear down after cloding TCA.
9662 - Test suite: add some extra error handling.
9663 - Test suite: pass showingOnly even though it should not be needed.
9664 - Test suite: add error message.
9665 - Test suite: fix bad syntax.
9666 - Test suite: add delay between tries in override_child().
9667 - Test suite: add optional delay between retry_action() tries.
9668 - Make is_tor_working() more accurate.
9669 - Test suite: only set default bridges when relevant.
9670 - design change: Tor Launcher is just removed.
9671 - document tca behaviour
9672 - bootstrap/phase may include WARN, too
9673 - Test suite: work around closing TCA too fast.
9674 - more logging to debug test suite
9675 - remove leftover commit
9676 - proper place for hacking tips
9677 - Add icon for the Tor Connection assistant
9678 - Generate the list of default bridges at build time.
9679 - Test suite: drop workaround.
9680 - success indication and fallback to default bridges
9681 - more hacking tips to test tca
9682 - cover corner cases better
9683 - NetworkManager state: signal instead of polling
9684 - tca calls NM immediately
9685 - tca reacts to nm state changes
9686 - Test suite: save Tor journal if TCA fails to start.
9687 - Test suite: bump image.
9688 - Test suite: TCA has a new internal name.
9689 - Test suite: attempt to make try_for() more robust.
9690 - Test suite: adapt to TCA UI change.
9691 - Test suite: fix retring for child() with regexp matching.
9692 - TCA: move to Gtk.Application style
9693 - progress bar get data from bootstrap-phase
9694 - TCA: drop debugging.
9695 - Test suite: convert potentially endless loop to try_for() with timeout.
9696 - Persistent Welcome Screen settings: migrate obsolete network setting to new
9697 offline mode setting.
9698 - Test suite: optimize upgrade check.
9699 - smoother progress bar
9700 - connect-drop: clean unnecessary hacks
9701 - s/amnesia/LIVE_USERNAME/
9702 - drop tor-sandbox-helper: not used right now
9703 - FIX proxy not working
9704 - document tca wrappers
9705 - some css rule to style TCA a bit
9706 - refactoring: utils -> torutils
9707 - more user freedom: consent question can be changed
9708 - current Tor state is observed when filling bridges
9710 - resize window on every change_box
9711 - FIX GAsyncSpawn 100% CPU
9712 - no internet probe anymore: also fix 100% CPU bug
9713 - Welcome Screen: use "airplane mode" icon for Offline mode.
9714 - Test suite: add scenario testing that TCA can connect after an initial
9716 - Test suite: make function usable in more contexts.
9717 - Test suite: also make it possible to block default bridges.
9718 - Test suite: detect TCA errors and fail early.
9719 - Test suite: add scenario testing that TCA falls back to default bridges if Tor
9721 - Test suite: run a dedicated default bridge.
9722 - Test suite: refactor.
9723 - Test suite: adapt to another changed label.
9724 - FIX doc about how to check for non-working Tor
9725 - improve display size detection
9727 - Test suite: refer to the correct variable.
9728 - Test suite: adapt to changed label.
9729 - Test suite: fix syntax error.
9731 - Improve user-visible strings
9732 - Test suite: improve names.
9733 - Test suite: use TCA's "hide Tor usage" path when testing PTs.
9734 - Disable launcher buttons: broken because of netns
9735 - use the 3 images + better layout
9736 - normal bridges are not accepted in Hide Mode
9737 - Bridge validation + better handle IPv6
9738 - Always obfs4 + bridge documentation link
9739 - GitLab CI: tails-documentation
9740 - tails-documentation gains --force-local
9741 - document tips&tricks for tca
9742 - don't kill TCA on network reconnection
9743 - syslog logging really has identity set
9744 - lots of logging to understand bridge bug
9745 - put doctests in gitlab in shape again
9746 - FIX IBus connection for onion-circuits
9747 - more debug about bridge-connection part
9748 - Port TCA to onion-grater-over-netns magic
9749 - TCA will honor debug flag
9751 - a bit less noise for translatable mixin
9752 - TCA logs to syslog/stderr automagically
9753 - gitlab-ci: TCA doctest dependency
9754 - FIX .gitlab-ci.yml (syntax error)
9755 - normal bridges were to be stripped, not expanded
9756 - default bridges imported
9757 - FIX: bridges have ip-port, not only IP!
9758 - put TCA testing in gitlab-ci
9761 - Revert "Test suite: add workaround for TCA not sanitizing bridge input
9763 - Decent validation for bridge lines
9764 - rewrite tca wrapper in python
9765 - Test suite: reorder steps to avoid TCA blocking the desktop.
9766 - Revert "Test suite: wait for TCA's GUI to be available before using it."
9767 - Test suite: work around lost click around TCA start.
9768 - Test suite: refactor.
9769 - Test suite: add workaround for TCA not sanitizing bridge input properly.
9770 - Test suite: wait for TCA's GUI to be available before using it.
9771 - Test suite: add timeout.
9772 - Test suite: work around Ruby <2.7 args vs keywords handling.
9773 - Test suite: fix exception message.
9774 - Test suite: adapt scenario for new "Offline Mode" Greeter setting.
9775 - Welcome Screen: obsolete "Network Connection" and add new "Offline Mode"
9777 - Test suite: rewrite Tor Launcher tests for Tor Connection Assistant.
9778 - Test suite: allow regexp matching in Dogtail's child() method.
9779 - Test suite: drop unnecessary methods from subclass.
9781 - tca: state saved, still to little use
9782 - tca: don't run two times
9784 - tca: side icon will be added from Python
9785 - Temporarily add pluggable transport config to torrc.
9786 - Convert Tor Launcher .desktop file to one for TCA.
9787 - Remove Tor Launcher, for real!
9788 - tca: small text improvement
9789 - connect-drop works fine without environment
9790 - Revert "Remove Tor Launcher"
9791 - tails-tor-launcher actually runs tca
9792 - Remove Tor Launcher
9793 - another workaround for #18123
9794 - onion-grater: quoting matters
9795 - Move very context-specific script out of root's PATH.
9796 - onion-grater: options are case insensitive
9797 - adapt profile to onion-grater's case-sensitiveness
9798 - Temporarily workaround tor bug by always disabling the seccomp sandbox.
9799 - FIX onion-grater tca profile
9800 - run `tca` and it will auto-sudo
9801 - tca can connect to onion-grater
9802 - translations refreshed for TCA
9804 - add tca .ui file to POTFILES.in for l10n
9805 - Test suite: delete obsolete scenario.
9807 - Test suite: use correct bridge/PT terminology.
9808 - Test suite: fix tor seccomp check in the normal bridge case.
9810 - Fix assertion failure message.
9811 - Let's settle for 'normal' bridge when no PT is used.
9812 - Add Tor Launcher to GNOME favorite applications.
9813 - Tor Launcher: allow amnesia to start and add suitable .desktop file.
9814 - Tor Launcher: kill old instances when starting.
9815 - Remove the "Tor is ready" notification.
9817 - small TorConnectionProxy fixes
9819 - tca: --debug-statefile for better simulation
9820 - error page + early proxy config
9822 - main workflows work!
9823 - Step forwards for bridge configuration
9824 - bridge selection: beginning
9825 - easy Tor configuration works!
9826 - sudo tca will do; start Tor integration
9827 - more steps in Tor launcher UI
9828 - GUI: first step implemented (more or less)
9829 - a first attempt at a GUI
9830 - Test suite: always verify that Tor's Sandbox setting.
9831 - Handle multiline GETCONF responses.
9832 - Welcome Screen: add note about the missing bridge mode option.
9833 - Test suite: fix tor Seccomp verification.
9834 - Tor Launcher: enable tor's Seccomp sandbox when not using pluggable transports.
9835 - tor-launcher: repair the --force-net-config feature.
9836 - Drop now unused restart-tor script.
9837 - Unsafe Browser: don't restart tor with restart-tor.
9838 - Drop ugly hook killing Tor Launcher.
9839 - onion-grater: transparently recover lost tor controller connections.
9840 - Work around event handling bug in stem?
9841 - Make dynamic configuration we always do static.
9842 - Test suite: another attempt to deal with lost key press.
9843 - Test suite: deal with lost key press.
9844 - Test suite: adapt to Tor Launcher always starting (refs: #17330)
9846 - tor launcher: set *every* option
9847 - tor-launcher supports proxy authentication
9848 - detect Tor bootstrapping status
9849 - Tor Launcher some more implementation
9850 - WIP: a first attempt at rewriting Tor Launcher
9851 - onion-grater: fix error handling.
9852 - onion-grater: workaround tor bug by switch from control socket to control port.
9853 - Always start Tor Launcher (refs: #17330).
9854 - onion-grater: connect to control socket without control port fallback.
9855 - Improve check by verifying at least one "nameserver" line.
9856 - Drop unused imports.
9858 * Upgrade Tor Browser to 10.5.2 (tails/tails!524)
9861 - Fetch Tor Browser from our own archive
9862 - Tor Browser upgrade process: adjust branch name
9863 - Upgrade Tor Browser to 10.5.2-build1
9864 - Tor Browser upgrade process: adjust instructions to new file names
9865 - Factorize export of TOR_USE_LEGACY_LAUNCHER (fixes: #18459)
9867 * Fix feature branch commit encoded into the artifacts' names (fixes: #18468)
9871 - Built images encode incorrect topic branch commit (tails/tails#18468)
9874 - Fix feature branch commit encoded into the artifacts' names (fixes: #18468)
9876 * Update the jenkins-tools submodule, to fix po.feature (tails/tails!520)
9879 - Update the jenkins-tools submodule, to fix po.feature
9881 * Upgrader: more robust upgrade download and verification failure detection
9885 - Upgrader: confusing download failure but upgrade still applied
9889 - tails-iuk-cancel-download: return exit code as-is if it's neither 0 nor 1
9890 - tails-iuk-cancel-download: fix shell syntax errors
9891 - Avoid that the Upgrader breaks if pgrep won't match any process
9892 - Upgrader: cancell the IUK download if an error appears
9893 - Upgrader: more defensive programming
9894 - Upgrader: ensure we fail closed on download and verification errors
9896 * Test suite: consistently save artifacts for various Tor connection failures
9900 - Test suite: handle case where the htpdate logs do not exist.
9901 - Test suite: add headings to output in Tor failure artifacts.
9902 - Test suite: make save_tor_journal() possible to run without Tor logs.
9903 - Revert "Revert "Test suite: consistently save artifacts for various Tor
9904 connection failures.""
9906 * Upgrade to OnionShare 2.2 (tails/tails!515)
9909 - OnionShare: use ~/Downloads/ as the upload directory in "Receive Files" mode
9910 - AppArmor: allow a few more things that OnionShare v2 needs
9911 - OnionShare config: use the same indentation as what the app saves
9912 - OnionShare config: import new settings
9913 - onion-grater: update rules for OnionShare v2
9914 - OnionShare: hide Tor settings
9915 - Install OnionShare from Bullseye
9917 * Upgrade Tor Browser to 10.5a17 (tails/tails!513)
9920 - Test suite: update expected image
9921 - Unsafe Browser: Disable Tor Browser's tor bootstrapping mechanism
9922 - Test suite: add support for testing Tor Browser alpha versions
9923 - Fetch Tor Browser from our own archive.
9924 - Disable Tor Browser's tor bootstrapping UI
9925 - Upgrade Tor Browser to 10.5a17.
9927 * WhisperBack: set lower expectations for handling of error reports
9931 - Temporarily set low expectations for handling of error reports, via our website
9932 and/or in WhisperBack (tails/tails#18427)
9935 - WhisperBack: set lower expectations
9937 * Fix issues in testing's test suite (tails/tails!509)
9940 - Revert "Test suite: consistently save artifacts for various Tor connection
9942 - Test suite: consistently save artifacts for various Tor connection failures.
9943 - Test suite: work around the desktop icons being obscured by TCA.
9945 - Test suite: correctly identify supported Tor Browser locales (fixes #18319)
9946 - Test suite: drop unknown keyword parameters from translate().
9947 - Test suite: rework translate() to not always use the tails domain (fixes:
9950 * onion-grater: fix support for restrict-stream-events for namespace matched
9951 profiles (tails/tails!508)
9955 - Move hard-coded network address to constant
9956 - onion-grater: fix remote connection check.
9957 - Untangle if-statements a bit.
9958 - onion-grater: fix support for restrict-stream-events for namespace matched
9959 profiles (closes: #18417).
9961 * Upgrade Linux to 5.10.40 (tails/tails!507)
9964 - Upgrade Linux to 5.10.40 (5.10.0-0.bpo.7)
9966 * Upgrade to Debian Buster 10.10 (tails/tails!506)
9969 - Upgrade to Debian Buster 10.10 by bumping APT snapshot of the Debian archive to
9971 - Test suite: don't break if there are multiple Firefox processes
9972 - lint_po: ignore torbrowser-launcher's PO files
9973 - generate-build-manifest: support builds that used no source package
9974 - Switch to a simpler way to maintain our Tor Browser AppArmor profile delta
9975 - Rebase AppArmor profile for Tor Browser on top of torbrowser-launcher 0.3.3-5
9977 * Upgrade Tor to 0.4.5.9 (tails/tails!505)
9980 - Upgrade tor to 0.4.5.9 (tails/tails#18309)
9983 - Upgrade Tor to 0.4.5.9
9985 * build-tails: fix bugs that prevent local submodules from being used
9989 - build-tails: fix resetting the submodules' origin
9990 - build-tails: fix syntax error
9992 * Installer: Make "Reinstall" option not disappear when coming back from
9993 confirmation dialog (tails/tails!502)
9996 - "Reinstall" option disappears when coming back from Upgrade confirmation
9998 - Disable Tails Installer options when there is no target USB stick available
10002 - Installer: disable widgets when there is no target available
10003 - Make "Reinstall" option not disappear when coming back from confirmation dialog
10005 * always start tor (except offline mode) (tails/tails!497)
10008 - FIX comment explaining how we user tor@ units
10009 - always start tor (except offline mode)
10011 * Fix build vmdb2 without http proxy (tails/tails!490)
10014 - variables are better than hardcoded names!
10015 - logs are preserved in case of error
10016 - cleaner temporary files handling
10017 - FIX building without a http_proxy
10019 * Resolve "Run tails-*-proxy-netns@.service only for the amnesia user"
10023 - a11y/ibus: description includes netns name
10024 - a11y/ibus proxy are only enabled for amnesia user
10026 * Jenkins lib: support extracting issue number at the beginning of the branch
10027 name (tails/tails!482)
10030 - adds doctests to ActiveBranches
10031 - Jenkins lib: support extracting issue number at the beginning of the branch
10034 * Resolve "TCA: Implement screen when not connected to a local network"
10038 - open the _real_ wifi settings page
10039 - wording follows wireframe design
10040 - gnome env: add XDG_CURRENT_DESKTOP
10041 - tca can open wi-fi config window
10043 * Test suite: drop low-value tests, add Cucumber tags, improve wording a little
10047 - Test suite: try harder not to click a button before it's active
10048 - Test suite: remove a few low-value USB installation, upgrade, and boot tests
10049 - Test suite: remove wget plaintext http:// test
10050 - fixup! Test suite: remove whois(1) tests
10051 - Test suite: give generic method a more generic name
10052 - Test suite: remove whois(1) tests
10053 - Test suite: merge closely related scenarios to improve performance
10054 - Test suite: use an existing snapshot instead of booting a fresh Tails
10055 - Test suite: improve wording of scenarios and steps
10056 - Test suite: remove Pidgin custom certificates tests
10057 - Test suite: remove basic AppArmor test
10058 - Test suite: remove GnuPG keyserver test
10059 - Test suite: remove browser plugins tests
10060 - Test suite: add @slow and @not_release_blockers Cucumber tags
10061 - Test suite: remove definition for unused step
10062 - Test suite: remove VirtualBox test
10064 * Generate the Vagrant base boxes using vmdb2 instead of vmdebootstrap
10068 - Add shellcheck exception.
10069 - Drop insane backticks.
10070 - Re-introduce some comments that were lost when migrating to vmdb2.
10071 - Build doc: remove obsolete instructions
10072 - vmdb2: remove no-op duplicated mirror parameters
10073 - Fix copy-paste mistakes.
10074 - Use grub.d instead of fighting with sed/perl escaping.
10075 - vmdb2: disable caching
10076 - Drop duplicated work.
10077 - Update docs and instructions for migration from vmdebootstrap to vmdb2.
10078 - Let's stop claiming Tails can be built from Stretch.
10079 - Escape \ in here doc.
10080 - Vagrant: work around Debian#951257.
10081 - Vagrant: abort when the proxy is invalid.
10082 - Vagrant: use IP address for internal proxy.
10083 - Drop leftovers from when we used vmdeboostrap to generate Vagrant boxes.
10084 - Apply policy-rc.d trick to workaround Debian bug when installing udisks2 in a
10086 - tails-builder: install missing udisks2 deps.
10087 - Workaround the fact subshells don't inherit set -e
10089 - Include the .qcow2, not raw image, in the Vagrant box.
10090 - Bump tails-builder image back to 20G.
10092 - Switch to vmdb2-based Vagrant box creation (refs: #15349)
10093 - Split long command over multiple lines.
10094 - Generate .box file.
10095 - Add back --rootfs-tarball argument to vmdb2.
10096 - Use correct sed syntax in replacement to refer to matched groups.
10097 - Use variables in place of hard-coded strings.
10099 - Drop unnecessary `touch`.
10100 - Clean up before and after calling vmdb2.
10101 - Generate image name dynamically.
10102 - Set APT serials dynamically.
10103 - Use mktemp for temporary file.
10104 - Drop unused stuff for generating container images.
10105 - Do `set -u` in script.
10106 - vmdb2: append newline at the end of authorized_keys entry
10107 - vmdb2: add HTTP proxy support
10108 - WIP: Vagrant: script for generating tails-builder images using vmdb2 instead of
10109 vmdebootstrap (refs: #15349)
10111 * Drop obsolete workaround for Jenkins passing mergebasebranch (tails/tails!475)
10114 - Revert "Rakefile: handle jenkins passing the now obsolete mergebasebranch."
10116 * custom-apt-cruft-check: indentify used binary packages where we lack the source
10120 - custom-apt-cruft-check: add support for the testing suite
10121 - custom-apt-cruft-check: indentify used binary packages where we lack the
10124 * GitLab CI (test-tca): add missing python3-dbus dependency (tails/tails!472)
10127 - GitLab CI (test-tca): add missing python3-dbus dependency
10129 * Disable shellcheck false positive (tails/tails!471)
10132 - Disable shellcheck false positive
10134 * Fix the dependencies of tca-portal.service and tca-portal.socket
10138 - Fix tca-portl.{socket,service} dependencies
10139 - Let tca-portal.service be started via systemd socket activation
10141 * Resolve "No spinner when starting Tor Browser from TCA" (tails/tails!459)
10144 - offline step now follows wording from our design
10145 - FIX: going offline should not display error step
10146 - tca-portal open applications using gtk stuff
10148 * Drop monkeysphere configuration (tails/tails!454)
10151 - Drop monkeysphere configuration
10153 * Use v3 Onion Service for the deb.torproject.org APT repository
10157 - Use v3 Onion Service for the deb.torproject.org APT repository
10159 * Test suite: drop Seahorse tests (tails/tails!451)
10162 - Test suite: drop now useless background
10163 - Test suite: update rationale for workaround
10164 - Test suite: drop support for running v2 Onion services in Chutney
10165 - Test suite: drop Seahorse tests
10167 * Maintain our Tor Browser AppArmor profile delta in a simpler way
10171 - Test suite: don't break if there are multiple Firefox processes
10172 - lint_po: ignore torbrowser-launcher's PO files
10173 - generate-build-manifest: support builds that used no source package
10174 - Switch to a simpler way to maintain our Tor Browser AppArmor profile delta
10175 - Rebase AppArmor profile for Tor Browser on top of torbrowser-launcher 0.3.3-5
10177 * Recover TCA fix + test suite work from now defunct !431 (tails/tails!447)
10180 - Test suite: fix racy test.
10181 - Test suite: avoid using regex matching since we can.
10182 - Test suite: drop escaping we already deal with.
10183 - Test suite: implement proper dropping of markup.
10184 - Test suite: escape single-quotes in generated Python strings.
10185 - Test suite: drop markup from translated strings.
10186 - Test suite: make Dogtail automatically translate strings.
10187 - TCA: fix tor crashing when falling back to default bridges.
10189 * TCA asks for confirmation if you close it during progress (tails/tails!446)
10192 - Apply 1 suggestion(s) to 1 file(s)
10193 - asks confirmation on quit during progress
10195 * TCA: explain the autoconfig better and implement designed behavior for
10196 displaying help (tails/tails!445)
10199 - TCA: hide bridge help by default
10200 - TCA: use the designed toggle instead of a link near "Configure a Tor bridge" in
10202 - TCA: Explain more about the implications of the autoconfig of Tor
10204 * Resolve "TCA connects with default bridges when it shouldn't" (tails/tails!444)
10207 - TCA always saves configuration
10209 * Resolve "TCA status does not reflect the current status of the connection to
10210 Tor" (tails/tails!443)
10213 - tca reacts to /run/tor-has-bootstrapped/done
10214 - tca monitors /run/tor-has-bootstrapped/done
10216 * Improve Tor Connection GUI (tails/tails!438)
10219 - Test suite: adapt to UI changes in TCA.
10220 - Fix shellcheck regressions
10221 - TCA: add title to proxy configuration window
10222 - TCA: add link to doc in consent question
10223 - TCA: make status messages consistently include "to Tor"
10224 - TCA: define margin in 1 single place
10225 - TCA: make the bridges config screen breathe
10226 - TCA: implement designed link to the bridges doc
10227 - TCA: remove icons on proxy port & pasword entries
10228 - TCA: make the "Connecting" progress screen breathe
10229 - TCA: make proxy configuration visual layout linear
10230 - TCA: basic visual layout for the "Error connecting to Tor" screen
10231 - TCA: reorganize container/child structure to fix vertical text alignment
10232 - TCA: Fix vertical text alignment
10233 - TCA: Fix vertical text alignment
10234 - TCA: make "Connected to Tor successfully" a progress-box-heading
10235 - TCA: add standard spacing between label and progress bar
10236 - TCA: make "Connecting to Tor…" a progress-box-heading
10237 - TCA: move progress-box-heading styling to CSS
10238 - TCA: make it breathe
10239 - TCA: drop duplicate margin
10240 - TCA: improve vertical alignment of success icon
10241 - TCA: hide percentage
10242 - fixup! TCA: use Unicode ellipsis char
10243 - TCA: use correct Unicode char
10244 - TCA: hide non-functional "Reset Tor Connection" button
10245 - TCA: explicitly declare translation domain in Glade UI file
10246 - TCA: style step titles via CSS, make them larger
10247 - TCA: make layout more GNOME HIG compliant
10248 - TCA: use non-deprecated margin properties, make them multiples of 6px
10249 - TCA: make the "Start Tor Browser button" fill the dialog width as designed
10250 - TCA: drop custom font size
10251 - TCA: use standard GNOME HIG spacing
10252 - TCA: improve visual layout
10253 - TCA: fix alignment
10254 - TCA: improve visual layout
10255 - TCA: simplify CSS
10256 - TCA: port CSS to pixels and start making it a bit more GNOME HIG compliant
10257 - TCA: give widget a name so it can be styled with CSS
10258 - WIP: save with glade/sid
10259 - Git, please ignore Glade backup files for TCA
10260 - TCA Glade UI: require the GTK version we're shipping in Tails 4.x
10262 * Resolve "Confusing behavior of Tor Connection in offline mode"
10266 - better function naming
10267 - offline mode error strings changed
10268 - FIX ci dependencies for tca
10269 - update gettext strings
10270 - tca offline mode errors are translatable
10271 - TCA give clear error message in Offline Mode
10272 - tailslib has doctests
10273 - tailslib: can check greeter variables
10275 * Resolve "Ensure WhisperBack still tells us how successful connections to Tor
10276 were made" (tails/tails!434)
10279 - whisperback includes tca details
10281 * TCA UI improvements (tails/tails!428)
10284 - Test suite: don't throw TCAConnectionFailure on try_for() timeout.
10285 - Test suite: adapt for recent UI changes in TCA.
10286 - explain bridge requirements in hide mode
10287 - smaller image in TCA
10288 - Improvements to TCA GUI
10289 - doc: how to tweak tca GUI
10290 - corner case about bridge validation
10291 - FIX resize problems through GtkStack
10292 - tca UI improvements
10293 - changing to default bridges is honored
10294 - tca ui more consistent
10296 * TCA reports an error in case of slow connection (tails/tails!426)
10299 - progress bar was very slow; + more testing
10300 - tca timeout understands "sign-of-life" UX concept
10301 - quick & dirty: increase timeout
10303 * Display an error message when upgrader fails to check for available upgrades
10307 - Display an error message when the Upgrader fails to check for available
10308 upgrades (tails/tails#18238)
10311 - Display a dialog if an error happens when getting the UDF
10312 - Make debugging_info parameter optional
10313 - Display an error dialog when the Upgrader fails to check for available upgrades
10315 * Rename "MAC address spoofing" as "MAC address anonymization" (tails/tails!411)
10319 - Avoid in-page link
10321 - Rename "MAC address spoofing" as "MAC address anonymization" (#18286)
10323 * Upgrade Linux to 5.10.24 (tails/tails!409)
10326 - Upgrade Linux to 5.10.24
10327 - Revert "Install linux-compiler-* linux-kbuild-* from our custom APT repository"
10329 * Fix shellcheck error (tails/tails!394)
10332 - Fix shellcheck error
10334 * Establish a coding standards baseline on our shell code base (tails/tails!190)
10337 - GitLab CI: install "file" for the shellcheck test
10340 - GitLab CI: use Unit test reports for shellcheck
10341 - shellcheck-tree: drop unused import
10342 - shellcheck-tree: drop obsolete comment
10343 - GitLab CI: check shell scripts
10344 - ShellCheck: fix remaining offenses
10345 - ShellCheck: fix remaining SC2086 offenses
10346 - shellcheck-tree: skip built website
10347 - Drop unused variables
10348 - ShellCheck: make exceptions where warranted
10349 - Misc. linting suggested by ShellCheck
10350 - shellcheck-tree: new script, that runs shellcheck on all shell scripts
10351 - Misc. linting suggested by ShellCheck
10352 - ShellCheck: make exceptions where warranted
10353 - Drop $ in arithmetic variables
10354 - Drop useless calls to cat
10355 - ShellCheck: fix offenses
10356 - ShellCheck: fix SC2155 offenses
10357 - ShellCheck: backticks → $()
10358 - auto/config: fix stderr redirection
10360 - ShellCheck: make exceptions where warranted
10361 - ShellCheck: add missing quoting
10362 - branch_name_to_suite: fix bug in tr call
10363 - ShellCheck: disable false positive
10364 - unsafe-browser: use $* when our intent is to concatenate
10365 - keepassxc wrapper: fix behavior in case 2+ arguments are passed
10366 - live-persist: fix usage message
10367 - ShellCheck: fix SC2162 offense
10368 - ShellCheck: make exceptions where warranted
10369 - ShellCheck: add missing quoting
10370 - ShellCheck: fix SC2006 offenses
10371 - ShellCheck: fix SC2155 offenses
10372 - Drop useless "echo"
10373 - ShellCheck: make exceptions where warranted
10374 - ShellCheck: fix SC2006 offenses
10375 - ShellCheck: replace deprecated tempfile with mktemp (SC2186)
10376 - ShellCheck: add missing quoting
10377 - Replace antiquated use of expr
10378 - Drop unused variables
10379 - ShellCheck: fix SC2155 offenses
10380 - ShellCheck: disable check that generates mostly false positives
10382 - Drop unused variables
10383 - ShellCheck: add missing quoting
10384 - Drop unused variable
10385 - ShellCheck: fix SC2059 offense
10386 - Ensure here-doc text is not subject to parameter expansion, command
10387 substitution, and arithmetic expansion, unless we do need it
10388 - ShellCheck: fix SC2162 offenses
10389 - chroot_local-hooks: consistently set the executable bit
10391 - Make for loop more robust
10392 - Ensure filenames that start with '-' are not interpreted as switches
10393 - Ensure glob is not expanded by the shell interpreter
10394 - 10-tbb: fix typo in variable name
10396 - ShellCheck: make exceptions where warranted
10397 - ShellCheck: disable false positive
10398 - ShellCheck: disable following included source files
10400 -- Tails developers <tails@boum.org> Mon, 12 Jul 2021 13:50:41 +0200
10402 tails (4.19) unstable; urgency=medium
10404 * Upgrade Tor Browser to 10.0.17-build1 (tails/tails!468)
10407 - Upgrade to Tor Browser based on Firefox 78.11 (tails/tails#18284)
10410 - Fetch Tor Browser from our own archive.
10411 - Upgrade Tor Browser to 10.0.17-build1.
10413 * Upgrade Thunderbird to 1:78.10.0-1~deb10u1
10415 * run_test_suite: fix tor version check with recent tor (tails/tails!450)
10418 - Chutney: fix tor version check with recent tor
10419 - run_test_suite: fix tor version check with recent tor
10421 * Upgrader, tails-security-check: drop CA pinning (tails/tails!448)
10424 - TLS certificate issue prevents tails-upgrade-frontend to check for updates :
10425 Error while downloading the signing key (tails/tails#18324)
10428 - Design doc: update tense
10429 - Remove unused Let's Encrypt certificates
10430 - Upgrader, tails-security-check: drop CA pinning
10431 - Design doc: drop overly optimistic future improvement idea
10432 - Design doc: mirrors used by the Upgrader are all HTTPS nowadays
10434 * gitlab-triage: migrate from Docker to podman (tails/tails!440)
10437 - gitlab-triage: migrate from Docker to podman
10439 * Add password feedback for sudo (refs: #18355) (tails/tails!439)
10442 - Add password feedback for sudo (refs: #18355)
10444 * Remove ikiwiki-cgi.setup (tails/tails!405)
10447 - Document how to test changes to the banner locally
10448 - Deduplicate content
10449 - Don't disable plugins that are not enabled by default
10450 - Remove ikiwiki-cgi.setup and references to it
10452 -- Tails developers <tails@boum.org> Mon, 31 May 2021 09:19:03 +0000
10454 tails (4.18) unstable; urgency=medium
10456 * Upgrade Thunderbird to 78.9.0-1~deb10u1
10458 * Upgrade Tor Browser to 10.0.16 (tails/tails!400)
10461 - Upgrade to Tor Browser based on Firefox 78.10 (tails/tails#18252)
10464 - Fetch Tor Browser from our own archive.
10465 - Upgrade Tor Browser to 10.0.15.
10467 * Upgrade Intel microcodes to 3.20210216.1~deb10u1
10469 * Upgrade firmware-linux-nonfree to 20210315-2
10471 * Remove Poedit (#18236) (tails/tails!395)
10474 - Remove Poedit (#18236)
10476 * Display an error message when the Upgrader fails to download the signing key
10480 - Display an error message when the Upgrader fails to check for available
10481 upgrades (tails/tails#18238)
10484 - Display an error message when the Upgrader fails to download the signing key
10486 * Remove clock sync notification (tails/tails!389)
10489 - Remove the "clock synchronization" notification (tails/tails#7439)
10492 - tails-htp-notify-user only notifies if $problems
10494 * Bump snapshots of the Debian APT archive to 2021033101 (tails/tails!388)
10497 - Bump snapshots of the Debian APT archive to 2021033101
10499 * APT: use non-onion HTTPS sources for Debian repositories (tails/tails!383)
10502 - Fix failures with Debian's APT repository onion service (tails/tails#17993)
10505 - APT: use non-onion HTTPS sources for Debian repositories
10507 * Merge base branch earlier (tails/tails!381)
10510 - The mergebasebranch option merges the base branch too late (tails/tails#12557)
10513 - Document that faketime is needed on the host to build Tails.
10514 - Vagrant: don't install faketime any more.
10515 - Drop useless version part from development build filenames.
10516 - Build system: only add base branch info to image names when relevant.
10517 - Build system: make development images' names more consistent.
10518 - Build system: move around logic to reduce ENV state.
10519 - Build system: re-run rake after merging base branch (#12557)
10520 - Rakefile: handle jenkins passing the now obsolete mergebasebranch.
10521 - Build system: by default, merge the base branch early when building (#12557)
10523 -- Tails developers <tails@boum.org> Mon, 19 Apr 2021 14:19:38 +0000
10525 tails (4.17) unstable; urgency=medium
10527 * Upgrade Thunderbird to 78.8.0-1~deb10u1
10529 * Upgrade Tor Browser to 10.0.14-build1 (tails/tails!382)
10532 - Upgrade Tor Browser to 10.0.14-build1.
10534 * Upgrade tor to 0.4.5.7 (tails/tails!380)
10537 - Upgrade tor to 0.4.5.7 (tails/tails#18244)
10540 - Upgrade tor to 0.4.5.7
10542 * Retry failed upgrade downloads, reusing the previously downloaded data, and
10543 fallback to the DNS mirror pool (tails/tails!379)
10546 - Make it possible to resume an automatic upgrade download (tails/tails#15875)
10547 - Make Tails Upgrader resilient to broken mirrors (tails/tails#17615)
10550 - Tails::IUK::TargetFile::Download: always disable exponential backoff when
10552 - Tails::IUK::LWP::UserAgent::WithProgress: display correct progress status when
10553 resuming a previously failed download
10554 - Give Tails::IUK::LWP::UserAgent::WithProgress information that it'll need
10555 - Refactoring: make temp_file an attribute
10556 - Refactoring: use more meaningful variable name and document what value it holds
10557 - GitLab CI: disable test that now requires systemd
10558 - Retry failed upgrade downloads, reusing the previously downloaded data, and
10559 fallback to the DNS mirror pool
10560 - Upgrader hardening: comment out sudo env_keep settings that are not needed in
10562 - Tails::Download::HTTPS hardening: drop support for SSL_NO_VERIFY
10563 - Upgrader test suite: remove useless Win32 support code
10565 * Repair the filesystem on the system partition and avoid breaking it in the
10566 first place (tails/tails!374)
10569 - Deleted obsolete automatic upgrades still occupy disk space ⇒ no automatic
10570 upgrade possible after a while (tails/tails#17902)
10573 - On boot, repair the filesystem on the system partition
10574 - Refactoring: move repartitioning code to a function
10575 - Unmount the system partition on shutdown
10577 * Upgrade GRUB2 to 2.04-16+ (tails/tails!372)
10580 - Upgrade GRUB2 to 2.04-16+ (tails/tails#18227)
10581 - devel branch FTBFS with uBlock 1.33.0+dfsg-1 (tails/tails#18191)
10584 - Bump snapshots of the Debian APT archive to 2021030401
10586 * Upgrade non-free Linux firmware to 20210208-3 (tails/tails!371)
10589 - Upgrade non-free Linux firmware to 20210208-3+ (tails/tails#18226)
10590 - devel branch FTBFS with uBlock 1.33.0+dfsg-1 (tails/tails#18191)
10593 - Revert "Temporarily install the kernel from Bullseye"
10594 - Refresh uBlock patch
10595 - Bump snapshots of the Debian APT archive to 2021030101
10597 * Test suite: relax delay for OpenPGP future expiration date (tails/tails!370)
10600 - Test suite: relax delay for OpenPGP future expiration date
10602 * Improve security advisory since they don't list vulnerabilities anymore
10606 - Help people find the information on their own (#18221)
10607 - Remove not-so-helpful TOC
10608 - Simplify and reuse the same wording
10609 - Don't make people click for nothing (#18221)
10611 * Clarify error message when starting the Unsafe Browser while offline
10615 - Clarify error message when the Unsafe Browser was launched without network
10616 connection (tails/tails#12251)
10619 - Test suite: update to match UI change
10620 - Clarify error message when starting offline (#12251)
10622 * Release process: add po4a version sanity checks (tails/tails!364)
10625 - Release process: ensure the RM has the correct version of po4a
10627 * Upgrade our production and test-only tor configuration (tails/tails!363)
10630 - Upgrade our production and test-only tor configuration (tails/tails#18216)
10633 - Test suite: bump PathsNeededToBuildCircuits to 0.67, like Chutney
10634 - Test suite: drop "TestingBridgeDownloadInitialDelay" customization
10635 - Test suite: drop "DownloadInitialDelay" testing options that we set to their
10637 - Test suite: drop unused second argument for the "DownloadInitialDelay" tor
10639 - Test suite: use the new "DownloadInitialDelay" names for the "DownloadSchedule"
10640 tor testing options
10641 - torrc: drop obsolete WarnUnsafeSocks setting
10642 - torrc: migrate from deprecated {Control,Trans}ListenAddress to
10643 {Control,Trans}Port address syntax
10645 * Upgrade tor to 0.4.5.6 (tails/tails!361)
10648 - run_test_suite: abort if the host system's tor is too old
10649 - Test suite setup doc: ensure we have a recent enough tor
10650 - Test suite setup doc: update APT pinning to support current QEMU backport
10651 - Upgrade tor to 0.4.5.6 final
10653 * Update uBlock Origin patch (tails/tails!354)
10656 - Refresh uBlock patch
10658 * Resolve "onion-grater race condition" (tails/tails!345)
10661 - onion-grater race condition (tails/tails#18123)
10665 - onioncircuits: longer options are more readable
10666 - tails-create-netns: more consistent style
10667 - tails-create-netns: avoid bashisms
10668 - a11y-proxy-netns: explain behavior with comments
10669 - review tips: is_veth_nic is more readable
10670 - review tips: clearer behaviour
10671 - Remove another remain from the reverted TBB experiment.
10672 - veth exclusion: log to debug
10673 - don't spoof veth interfaces
10674 - a11y proxy now can be passed to the right netns
10675 - onioncircuits is accessible!
10676 - small cleanup to tailslib.gnome
10677 - really: let's forget about TBB and its netns
10678 - Let's forget about TBB in its netns
10679 - get_all_ethernet_nics behave even if no real eth
10680 - update design doc for netns improvements
10681 - test: tor can bind a non-127.0.0.1 port
10682 - FIX helper lib to recognize veth appropriately
10684 - tails-documentation: fixed when Tor is not ready
10685 - sudo tor-browser allowed
10686 - FIX service: run before network.target
10687 - we need veth: don't blacklist it, it's harmless
10688 - /stop tails-create-netns service can stop
10689 - FIX tails-create-netns.service
10690 - TBB: changed onion-grater
10691 - TBB works + port 9150 drop
10692 - netns: firewall configuration moved to ferm
10693 - configure tor and ferm for TBB netns address
10694 - tails-create-netns is a systemd.service
10695 - onion-grater whitelisted in sane_defaults
10696 - onioncircuits profile adapted to netns
10697 - onioncircuits wrapper to use netns
10698 - still a draft, but at least tidier
10699 - DRAFT of network namespace support
10701 * Test suite: disable sound forwarding to host (tails/tails!333)
10704 - Test suite: consider disabling SPICE audio (tails/tails#18122)
10707 - Test suite: disable sound forwarding to host (Closes: #18122)
10709 -- Tails developers <tails@boum.org> Mon, 22 Mar 2021 08:11:53 +0000
10711 tails (4.15.1) unstable; urgency=medium
10713 * Upgrade sudo to 1.8.27-1+deb10u3 due to CVE-2021-3156 ("Baron
10716 -- Tails developers <tails@boum.org> Wed, 27 Jan 2021 19:33:08 +0100
10718 tails (4.15) unstable; urgency=medium
10720 * Upgrade Thunderbird to 1:78.6.0-1~deb10u1
10722 * Upgrade Tor Browser to 10.0.9, based on Firefox 78.7 (tails/tails!331)
10725 - Upgrade Tor Browser to 10.0.9, based on Firefox 78.7 (tails/tails#18100)
10728 - Fetch Tor Browser from our own archive.
10729 - Upgrade Tor Browser to 10.0.9-build2.
10731 * Test suite: support path of tcpdump in current sid (tails/tails!328)
10734 - Test suite broken on current sid: "No such file or directory -
10735 /usr/sbin/tcpdump" (tails/tails#18126)
10738 - Test suite: support path of tcpdump in current sid
10740 * Update CAs trusted to connect to our website (tails/tails!327)
10743 - Upgrader fails to check upgrades: CA changed for our website
10744 (tails/tails#18127)
10745 - Remove AddTrust_External_Root.pem from our website CA bundle
10746 (tails/tails#11811)
10750 - Reference issue and add another related XXX
10751 - Don't ship individual Let's Encrypt intermediate certificates files in the
10753 - Move Let's Encrypt intermediate certificates outside of the system-wide CA
10755 - Upgrader: trust current and upcoming Let's Encrypt intermediate certificates
10756 - Add current and upcoming Let's Encrypt intermediate certificates
10757 - Remove AddTrust_External_Root.pem from our website CA bundle (refs: #11811).
10759 * Upgrade Linux to 5.9.15-1~bpo10+1 (stable branch) (tails/tails!325)
10762 - Upgrade to Linux 5.9.15 (tails/tails#18104)
10763 - Install Intel SOF Firmware and Topology binaries from Debian
10764 (tails/tails#18096)
10765 - USB tethering is broken with iOS 14 => Need kernel upgrade (tails/tails#18097)
10768 - Refresh uBlock patch
10769 - Install Intel SOF Firmware and Topology binaries from Debian
10770 - Upgrade Linux to 5.9.15-1~bpo10+1
10771 - Update APT snapshot for the "debian" archive to 2021011501
10773 * Upgrade firmware-linux to 20201218-1
10775 * Migrate blueprints to GitLab wiki (tails/tails!323)
10777 * Fix stream isolation test suite after !306 (tails/tails!319)
10780 - Test suite: update wrt. recent htpdate changes (tails/tails#18095)
10783 - fix stream isolation test suite after !306
10785 * Refresh uBlock patch to fix devel branch FTBFS (tails/tails!318)
10788 - Refresh uBlock patch
10790 * Test suite: improve error reporting for GuestFS problems and user mistakes
10794 - Test suite: error out early if images to be tested are directories
10795 - Test suite: log all guestfs events, not only "trace" level messages
10797 * Make 'Upgrading the system' dialog appear faster (tails/tails!316)
10800 - Make "Upgrading the system" dialog appear faster (tails/tails#18051)
10803 - Upgrader test suite: adjust to match UI changes
10804 - Warn in advance about the network connection being disabled (#18051)
10805 - Avoid ambiguous future tense
10807 - Upgrader: don't declare variable in conditional statement
10808 - Upgrader: adjust test suite to user interaction changes
10810 - Make 'Upgrading the system' dialog appear faster
10812 * Make writing Tails.module more robust (tails/tails!315)
10815 - Make writing Tails.module more robust (tails/tails#17906)
10818 - Make writing Tails.module more robust
10820 * Fix support for Ledger hardware wallet, by upgrading python3-btchip
10824 - "No hardware device detected" with Ledger Nano S wallet in Electrum
10825 (tails/tails#18080)
10828 - Fix support for Ledger hardware wallet, by upgrading python3-btchip
10830 * Test expiration date for all keys trusted by APT (tails/tails!310)
10833 - Test expiration date for all keys trusted by APT (tails/tails#18094)
10836 - Test suite: improve Gherkin phrasing
10837 - Test suite: check expiration date for all trusted APT keys
10839 * Log more info upon curl failure in htpdate (tails/tails!306)
10842 - htpdate: make output more useful on name resolution errors
10843 - htpdate: include stdout and stderr of curl(1) upon failure
10844 - htpdate: remove misleading comment
10846 * Clarify that this message is about the size of the USB stick (#18073)
10850 - Improve error message when the USB stick is too small (tails/tails#18073)
10853 - Add comment to explain the unit being used
10854 - Display too small boot device size in GB, not GiB
10855 - Display too small boot device size with 1 digit of precision after the decimal
10857 - Make displayed number and unit match
10858 - Only use variable after we've assigned it a value
10859 - Clarify that this message is about the size of the USB stick (#18073)
10861 * Thunderbird: drop obsolete patch. (tails/tails!304)
10864 - Thunderbird: drop obsolete patch.
10866 * Make build reproducibility verification easier (tails/tails!303)
10869 - Don't trust any random key that has a UID which contains "deb.tails.boum.org"
10870 - Make formatting consistent with other command lines
10873 - Use numbered list: order matters
10874 - Reorder instructions to avoid a step essentially depend on the next one
10875 - contribute/build.mdwn: add instruction for importing deb.tails.boum.org key
10876 - release_process/test/reproducibility.mdwn: add -p to mkdir
10877 - Rakefile: add option to scp to disable agent
10879 * Test suite: differentiate between tordate and htpdate errors (tails/tails!295)
10882 - Test suite: split exception.
10883 - Test suite: use more specific exception.
10884 - We can have TimeSyncingError due to tordate, so no htpdate log exists.
10885 - Rename variable and rearrange code to fix scoping issues.
10886 - Test suite: differentiate between tordate and htpdate errors.
10888 * Add "Don't Show Again" button to the notification when starting Tails in a VM
10892 - Add "Don't Show Again" button to notifications where appropriate
10893 (tails/tails#10553)
10896 - swap buttons in tails-virt-notify-user
10897 - Refresh translations.
10898 - tails-documentation: drop yelp dependency.
10899 - Revert "Patch libdesktop-notify-perl to accept an array ref for actions."
10900 - tails-documentation: let Gnome start Tor Browser so it can quit.
10901 - tails-virt-notify-user: port form Perl to Python.
10903 - Improve button labels
10904 - Apply 1 suggestion(s) to 1 file(s)
10905 - Apply 1 suggestion(s) to 1 file(s)
10906 - tails-virt-notify-user: make action IDs globally unique again.
10908 - tails-virt-notify-user: make action buttons ordering deterministic.
10909 - Patch libdesktop-notify-perl to accept an array ref for actions.
10910 - live-persist: always enable support for "Don't ask again" (refs: #10553).
10911 - tails-virt-notify-user: only show "Don't ask again" if feature is available
10913 - tails-virt-notify-user: add "Don't ask again" button PoC (refs: #10553).
10914 - Add tooling for "Don't ask me again" feature for notifications etc.
10916 -- Tails developers <tails@boum.org> Mon, 25 Jan 2021 08:23:10 +0000
10918 tails (4.14) unstable; urgency=medium
10920 * Grant the user read access to external Persistent Storage (tails/tails!300)
10923 - Nautilus cannot open a plugged Tails Persistent Storage anymore
10924 (tails/tails#18050)
10927 - Make *external* TailsData's root user-readable when mounted (closes: #18050)
10929 * Upgrade Tor Browser to 10.0.7 (tails/tails!297)
10932 - Upgrade Tor Browser to 10.0.7 (tails/tails#18058)
10935 - Fetch Tor Browser from our own archive.
10936 - Upgrade Tor Browser to 10.0.7-build1.
10938 * Add a script to help updating our UX debt spreadsheet (tails/tails!292)
10941 - ux-debt-changes: list issues that had the UX:debt label removed
10942 - ux-debt-changes: list issues that had the UX:debt label added
10943 - ux-debt-changes: allow running only some of the supported reports
10944 - ux-debt-changes: cache GitLab API responses
10945 - ux-debt-changes initial version: lists solved or rejected UX:debt issues since
10948 * Upgrade to Linux 5.9 and to Buster 10.7 (tails/tails!288)
10951 - Upgrade Linux to 5.9 (tails/tails#17973)
10952 - Upgrade to Buster 10.7 (tails/tails#17995)
10955 - Upgrade Linux to 5.9.0-0.bpo.2, currently at version 5.9.6-1~bpo10+1
10956 - Install the kernel from buster-backports
10957 - Upgrade Tails and the Vagrant build box to Debian Buster 10.7
10959 * Test suite: make evince "Print to File" test more robust (tails/tails!287)
10962 - Test suite: update and fix comment
10963 - Test suite: make evince "Print to File" test more robust
10965 * Upgrade Linux to 5.9 (devel branch) (tails/tails!285)
10968 - Upgrade Linux to 5.9.0-0.bpo.2, currently at version 5.9.6-1~bpo10+1
10970 * Don't include URLs pointing to our live website in translatable strings
10974 - Upgrader: don't use non-existent debug method
10975 - GitLab CI: ensure we don't re-add translatable URLs to our live website
10976 - Update POT and PO files
10977 - Don't include URLs pointing to our live website in translatable strings
10980 * Test suite: bump timeout for the Greeter's GUI to update after language change.
10984 - Revert "Test suite: switch from sleep() to more robust approach."
10985 - Test suite: switch from sleep() to more robust approach.
10986 - Test suite: bump timeout for the Greeter's GUI to update after language change.
10988 * Port otr-bot to Python 3 and migrate to slixmpp (tails/tails!278)
10991 - Test suite's otr-bot.py has obsolete dependencies (tails/tails#17031)
10994 - Test suite doc: update dependencies
10995 - Make otr-bot quiet.
10996 - otr-bot: linting.
10997 - Improve variable names.
10998 - otr-bot: port to python3 and migrate from jabberbot to slixmpp.
11000 * Detect corrupt GnuPG public keyring and restore its backup (tails/tails!275)
11003 - Automate fix for "GnuPG keys missing" problem (tails/tails#17807)
11006 - Try to detect corrupt GnuPG pubring.kbx and restore any backup (refs: #17807)
11008 * Drop superfluous block.events_dfl_poll_msecs=1000 kernel parameter
11012 - Drop superfluous block.events_dfl_poll_msecs=1000 kernel parameter
11014 * Install the kernel from buster-backports (tails/tails!273)
11017 - Install the kernel from buster-backports
11019 * Enable Electrum's Ledger hardware wallet support (tails/tails!272)
11022 - Ledger Nano S hardware wallet is not recognized due to wrong udev rules
11023 (tails/tails#15353)
11026 - Enable Electrum's Ledger hardware wallet support
11028 * Test suite: update expected title of the GitLab page we use (tails/tails!271)
11031 - Test suite: update expected title of the GitLab page we use
11033 * Port Tails Installer to Python 3 (tails/tails!270)
11036 - Port Tails Installer to Python 3 (tails/tails#10085)
11037 - Installer: get rid of workaround for udisks bug#418 in SetFlags()
11038 (tails/tails#15010)
11041 - Update POT and PO files
11042 - Also undo mistaken changes to Tails 3.0 release note PO files.
11043 - Installer: get rid of workaround for udisks#418 in SetFlags()
11044 - Installer: update URL (Redmine → GitLab)
11045 - Installer: drop obsolete comment
11046 - Installer: don't make user-facing URLs translatable
11047 - Undo mistaken change to Tails 3.0 release notes.
11048 - Tails Installer: fix incorrect function/variable names.
11049 - Update installer's deps after porting to Python 3 (refs: #10085)
11050 - Apply 1 suggestion(s) to 1 file(s)
11051 - Tails Installer: don't show install/cancel buttons on warning prompts.
11052 - Tails Installer: delay deletion of parents until all drives have been examined.
11053 - Tails Installer: update PO/POT files after migration to Python 3.
11054 - Tails Installer: move into Python 3's dist-packages.
11055 - Tails Installer: revive _set_liberal_perms_recursive().
11056 - Tails Installer: pass argument list to subprocess.Popen().
11057 - Tails Installer: port to Python 3 based on saschamarkus's patches (refs:
11060 * Update deb.torproject.org's APT key (tails/tails!269)
11063 - Outdated APT key for deb.torproject.org (tails/tails#18042)
11066 - Stop installing deb.torproject.org-keyring
11067 - Update deb.torproject.org's APT key
11069 * Release process: drop dependency on parallel_collect_IUKs (tails/tails!267)
11073 - Release process: don't pass --debug to copy-iuks-to-rsync-server-and-verify
11074 - Release process: drop dependency on parallel_collect_IUKs
11077 * Allow users to change persisted admin password option (tails/tails!266)
11080 - Allow users to change persisted admin password option (tails/tails#18018)
11083 - Fix not being able to delete a once persisted admin password
11085 * Upgrade Thunderbird to 1:78.5.1-1~deb10u1, and accordingly update
11086 its patch series (tails/tails!264)
11089 - All branches FTBFS since Thunderbird 78.5.0 upload (tails/tails#18034)
11092 - Drop Thunderbird patch: applied in 78.5.0 upstream
11093 - Drop Thunderbird patch: applied in 78.5.0 upstream
11094 - patch-thunderbird: log which patch we're currently trying to apply
11097 * Stop installing the Unifont fonts (tails/tails!263)
11100 - Stop installing the Unifont fonts
11102 * Upgrade tor to 0.4.4.6 (tails/tails!259)
11105 - Upgrade tor to 0.4.4.6
11107 * Document python-gitlab setup needed for generate-changelog and generate-report
11111 - Don't track testing forever
11112 - Make instructions work on sid
11113 - python3-gitlab from Buster doesn't work
11114 - Document torsocks for GitLab scripts
11115 - Improve readibility
11116 - generate-changelog, generate-report: point to documentation
11117 - Document how to configure python-gitlab
11119 * Test suite: use the qemu-xhci USB controller (tails/tails!255)
11122 - Use qemu-xhci for TailsToaster (tails/tails#15831)
11125 - Test suite: use the qemu-xhci USB controller
11127 * Require Buster or newer for running our test suite (tails/tails!254)
11130 - Require Buster or newer for running our test suite (tails/tails#17842)
11133 - Test suite: run a Q35 5.0 machine
11134 - Test suite: drop workarounds for running on Stretch
11135 - run_test_suite: drop support for Stretch
11136 - Test suite doc: drop support for Stretch
11138 -- Tails developers <tails@boum.org> Mon, 14 Dec 2020 08:56:31 +0000
11140 tails (4.13) unstable; urgency=medium
11142 * Tor Browser 10.0.5 (tails/tails!253)
11145 - Upgrade to Tor Browser 10.0.5 (tails/tails#18017)
11146 - Most Tor Browser scenarios fail (tails/tails#18016)
11147 - Only ship locale definitions that the user can select in the Welcome Screen
11148 (tails/tails#17139)
11151 - Mark security issue as fixed
11152 - Test suite: avoid wait_any() in error-prone situation.
11153 - Test suite: adapt image so it works for RTL locales too.
11154 - Upgrade Tor Browser to 10.0.5-build1.
11157 * Browsers: drop el-GR from browser localization (tails/tails!252)
11160 - "The Unsafe Browser can be used in all languages supported in Tails" scenario
11161 fails in Greek (tails/tails#18015)
11164 - Browsers: drop el-GR from browser localization.
11166 * Test suite: wait for GNOME Overview launchers to be ready before interacting
11167 with them (tails/tails!251)
11170 - Most Tor Browser scenarios fail (tails/tails#18016)
11173 - Test suite: wait for GNOME Overview launchers to be ready before interacting
11174 with them (fixes: #18016).
11176 * Garbage collect website cache more aggressively (tails/tails!248)
11179 - Some builds fail on Jenkins due to lack of disk space to store cached built
11180 website (tails/tails#18010)
11183 - website-cache: don't delete lost+found directory
11185 - website-cache: garbage collect cache directories older than 20 days
11187 * generate-report: Buster compatibility, help the user install dependencies
11191 - generate-report: add helpful message on missing Python modules
11192 - generate-changelog, generate-report: support Python 3.7
11194 * custom-apt-cruft-check: fix output when there's nothing to remove
11198 - custom-apt-cruft-check: fix output when there's nothing to remove
11200 * Release process: streamline configuration and environment management
11204 - Release process: rename variable to avoid confusion
11205 - Apply 1 suggestion(s) to 1 file(s)
11206 - Fix typo in suggestion
11207 - Apply 3 suggestion(s) to 3 file(s)
11208 - rm-config: workaround pylint false positives
11209 - remove-unused-udfs: lint
11210 - remove-unused-udfs: actually use passed before_version
11211 - rm-config: add mypy exceptions
11212 - rm-config: add docstrings
11214 - rm-config: drop unused import
11215 - rm-config: import generation of IUK_SOURCE_VERSIONS
11217 - rm-config: import more configuration generation
11218 - rm-config: validate configuration
11219 - RM config template: quote "FIXME" as it should be in the manually-filled
11221 - rm-config: fix generate-environment for non-string values
11222 - rm-config: log config before validating
11223 - rm-config: pass stage to Config()
11224 - rm-config: add validate-configuration action
11225 - Release process: consistently provide editor command-line
11226 - rm-config: ensure generated shell snippet has a trailing newline
11227 - Release process: move generation of derived values to rm-config
11229 - Release process: fully phrase the rm-config usage bits
11230 - Release process: bring all notes together
11231 - Release process: document how to get your own local.yml
11232 - Release process: convert example local.yml to YAML, move generated variable out
11236 - rm-config: generate boilerplate config, read config & export it as shell
11238 - Release process: ensure the configuration does not taint the next release
11240 - Document config format
11241 - Ensure RM config snippets produce 1 single YAML document when concatenated
11242 - Release process: specify interface for new RM config management.
11244 * WhisperBack: include the output of lsusb in reports (tails/tails!244)
11247 - WhisperBack: include the output of lsusb in reports
11249 * Automate Tor Browser WebRTC tests (tails/tails!243)
11252 - Automate Tor Browser WebRTC tests (tails/tails#10264)
11255 - Test suite: automatically test that WebRTC is disabled in Tor Browser
11256 - Test suite: refactoring (extract code to function)
11258 * GitLab CI: only run the apt-snapshots-expiry job when relevant
11262 - GitLab CI: only run the apt-snapshots-expiry job when relevant
11263 - GitLab CI: switch to "Pipelines for Merge Requests" mode
11265 * GitLab CI: check PO files that we did not import from Transifex yet, only run
11266 PO checks when relevant (tails/tails!241)
11271 - GitLab CI: only run check-po-msgfmt and lint-po when relevant
11272 - GitLab CI: check PO files that we did not import from Transifex yet
11274 * Add script that checks which packages in our custom APT repo are unused
11278 - Remove cruft from our custom APT repository (2020Q4 edition)
11279 (tails/tails#17997)
11282 - custom-apt-cruft-check: look for custom package on the suite we're working on
11283 - custom-apt-cruft-check: update script description to match current usage
11284 - custom-apt-cruft-check: fix generated reprepro command
11285 - custom-apt-cruft-check: make output command line easier to copy'n'paste
11286 - custom-apt-cruft-check: use a command line argument to specify which suite to
11288 - Revert overzealous linting
11289 - custom-apt-cruft-check: fix branch check
11291 - custom-apt-cruft-check: add helpful comment to error message
11292 - custom-apt-cruft-check: output require reprepro clean up command
11293 - custom-apt-cruft-check: fetch .build-manifest from Jenkins
11294 - custom-apt-cruft-check: change quoting so \n becomes an actual newline
11295 - custom-apt-cruft-check: also support the devel branch/APT suite
11297 - custom-apt-cruft-check: add support for Onion service
11298 - Add script that checks which packages in our custom APT repo that are unused.
11300 * Release process: automate removing unused UDFs (tails/tails!239)
11303 - Remove UDFs for versions we'll never release
11304 - remove-unused-udfs: avoid computing the list of tags multiple times
11305 - remove-unused-udfs: avoid using global variable.
11306 - Release process: automate removing unused UDFs
11307 - Release process: remove now-irrelevant case
11308 - Release process: move cleaning up Changelog to a smarter place
11309 - Release process: remove duplicate operation
11310 - Release process: bundle together actions on the devel branch
11312 * GitLab CI: check that no APT snapshot will expire within 1 month
11316 - GitLab CI: give job a name that better reflects its, well, job
11318 - GitLab CI: check that no APT snapshot will expire within 1 month.
11319 - apt-snapshot-expiry: exit with error if any snapshot will expire within 1
11321 - Get rid of subshell.
11323 * Release process: automate generation of email to manual testers
11327 - Release process: make the shell complain if setting PAD was forgotten.
11328 - Release process: de-duplicate
11329 - Release process: automate generating the call for manual testing
11331 * Release process: streamline APT repository operations (tails/tails!236)
11334 - Release process: only context switch to freeze exception management if needed
11335 - Release process: streamline thawing time-based APT snapshots
11336 - Release process: streamline bumping time-based APT snapshots expiration date
11337 - Fix Vagrant build box APT snapshots updating info
11338 - Release process: streamline freezing time-based APT snapshots
11339 - Release process: automate
11340 - Release process: streamline post-release operations
11341 - Release process: streamline initializing the versioned custom APT suite
11342 - Replace link to obsolete reprepro homepage with link to Tracker
11343 - Release process: automate
11344 - Release process: streamline merging base branches
11345 - Custom APT repo doc: move to a script merging a main branch
11346 - Release process: streamline resetting custom APT suites
11348 - Custom APT repo doc: move to a script resetting a suite
11349 - Release process: streamline merging APT overlays
11350 - Release process: be extra explicit about what "freeze time" means
11351 - Revert "Release process: be explicit about the required setting when merging"
11353 * Ensure that we install the required custom packages from our custom APT repo
11357 - Release process: drop VeraCrypt reminder.
11358 - Build system: ensure we install the required custom packages from our custom
11361 * Release process: move big code snippets to scripts (tails/tails!234)
11365 - Release process: move to a script preparing the included website
11366 - Release process: move to a script cleaning SquashFS sort file
11368 - Release process: move to a script generating images signatures and Torrents
11370 - Release process: move to a script publishing test UDFs
11372 - Release process: move to a script signing UDFs
11373 - Release process: move to a script updating the trace file
11375 - Release process: move to a script publishing IUKs
11377 - Release process: move to a script announcing and seeding the Torrents
11379 - Release process: move to a script copying release files to the website
11380 - Release process: move Tor blog post generation to a script
11382 * check-po-msgstr: Add option to sanitize .po files (tails#17661)
11386 - check-po-msgstr: Add option to sanitize .po files (tails#17661)
11388 * GitLab CI: run the perl5lib, persistence-setup, and a subset of the upgrader
11389 test suites (tails/tails!228)
11392 - Upgrader test suite: drop noisy output
11393 - Add missing strictures
11394 - GitLab CI: run the subset of the iuk test suite that works in a Docker
11396 - GitLab CI: run the persistence-setup test suite
11397 - GitLab CI: run the perl5lib test suite
11398 - Skip chattr when running in a test environment
11399 - Perl program test suite doc: run tests in a UTF-8 locale
11400 - Perl program test suite doc: use command-line --all flag instead of environment
11402 - Perl program test suite doc: add missing dependency
11404 * GitLab CI: run unit tests for tails-gdm-error-message (tails/tails!224)
11407 - GitLab CI: run unit tests for tails-gdm-error-message
11409 * GitLab CI: run WhisperBack unit tests (tails/tails!222)
11412 - GitLab CI: run WhisperBack unit tests
11414 * GitLab CI: check PO files with lint_po, that calls i18nspector
11418 - GitLab CI: use Debian testing for lint-po stage
11419 - GitLab CI: check PO files with lint_po, that calls i18nspector
11421 * Fix test suite robustness regression introduced by the upgrade of lizard
11422 isotesters to Buster (tails/tails!218)
11425 - Test suite robustness regressed since the lizard isotesters were upgraded to
11426 Buster (tails/tails#17985)
11429 - Test suite: don't let Screen#find mess with Screen#wait_vanish's timeout
11431 - Test suite: make @screen.find() @screen.wait() for 5 seconds
11433 * Fix Tails Installer in Turkish and in languages that have a translation for the
11434 "Clone the current Tails" string (tails/tails!217)
11437 - Tails Installer does not allow upgrade in languages that have a translation for
11438 the "Clone the current Tails" string (tails/tails#17982)
11439 - tails-installer fails to operate in Turkish (tails/tails#17576)
11442 - Fix Tails Installer in Turkish
11443 - Update POT and PO files
11444 - Installer: s/Live.?OS/Tails/
11445 - Installer: use translations for strings defined in Glade
11447 * Move wrap_test_suite cucumber args logic into run_test_suite (tails/tails!216)
11450 - run_test_suite: use variable consistently.
11451 - run_test_suite: don't use current Git state, but the one described by Jenkin's
11452 environment variables.
11454 - Test suite: print which Cucumber tags are used on start.
11455 - Remove unused Rake 'test' task.
11456 - run_test_suite: make @doc tag handling independent of ~@fragile.
11458 - run_test_suite: move cucumber logic from wrap_test_suite in here (refs:
11459 tails/sysadmin#17772).
11461 * Test suite: automate a few manual tests (tails/tails!213)
11464 - Automatically test that we cannot login as root (tails/tails#10274)
11465 - Automate APT manual tests (tails/tails#17017)
11466 - Test that the correct keyboard layout is set (tails/tails#10261)
11467 - Test that DuckDuckGo is the default search engine in Tor Browser
11468 (tails/tails#10265)
11469 - Test that the on-screen keyboard works and its layout is correctly set
11470 (tails/tails#10263)
11473 - Test suite: fix regexp
11474 - Test suite: login using the button, not accelerators.
11475 - Test suite: implement find_any() with real_find().
11477 - Test suite: enable localization tests in Spanish and Turkish
11478 - Test suite: have #(exists|find|wait)_any return a hash instead of an array
11479 - run_test_suite: pass --expand to Cucumber
11480 - Test suite: handle the fact that the browser address bar is initialized lazily
11482 - Test suite: make new tests not run by default
11483 - Test suite: automate the screen keyboard manual tests
11484 - Test suite: enable keyboard layout and browser search engine tests for Arabic
11485 - Test suite: automate testing that DuckDuckGo is the default search engine in
11486 all tier-1 languages
11487 - Test suite: automate testing that the correct keyboard layout is set
11488 - Test suite: automate manual /bin/su tests
11489 - Test suite: automate manual APT tests
11490 - Test suite: fix steps semantics
11491 - Test suite: don't bother logging in when not needed
11493 * Drop dead code for read-only persistence (tails/tails!211)
11496 - Drop dead code for read-only persistence (tails/tails#17972)
11499 - Drop dead code for read-only persistence
11501 * Make the root directory of the persistence non-world-readable (tails/tails!210)
11504 - Make the root directory of the persistence non-world-readable
11508 - Put first what matters most to the user
11509 - Document shortcut
11510 - Add period at the end of (imperative) sentences
11511 - Fix Markdown formatting
11512 - Add, and take benefit from, a GTK bookmark for the persistent Dotfiles source
11514 - Make the root directory of the persistence non-world-readable
11516 * Make udisks less verbose about "errors" to determine whether unused loop
11517 devices are encrypted (tails/tails!209)
11520 - Revert "Raise the maximum number of loop devices to 32 (refs: #12065)."
11522 * Allow raising sound volume above 100% (tails/tails!207)
11525 - Allow raising sound volume above 100% (tails/tails#17322)
11526 - Re-enable TCP timestamps (tails/tails#17491)
11529 - Allow raising sound volume above 100%
11531 * Re-enable TCP timestamps (tails/tails!206)
11534 - Re-enable TCP timestamps (tails/tails#17491)
11537 - Re-enable TCP timestamps
11539 * Add a button to restart Tails at the end of creating the Persistent Storage
11543 - Drop unneeded sentence
11544 - Add a button to restart Tails at the end of creating the Persistent Storage
11546 * Only install usable locales and Tor Browser langpacks (tails/tails!204)
11549 - Only ship locale definitions that the user can select in the Welcome Screen
11550 (tails/tails#17139)
11551 - Test suite often fails on Jenkins due to lack of "disk" space in
11552 /tmp/TailsToaster/TailsToasterStorage (tails/tails#17984)
11555 - Test suite: calculate supported locales outside of loop.
11556 - Test suite: add expected image for the Unsafe Browser in Spanish
11557 - Test suite: don't use English as a way of testing localization of the Unsafe
11559 - Test suite: adjust for the removal of locales-all
11560 - Avoid localepurge deleting ll_RR.utf8 locale variants
11561 - Build system: drop browser localization descriptions for languages not
11562 available in the Welcome Screen
11563 - Bring back localepurge, to delete unneeded localizations
11564 - Only ship Tor Browser langpacks for locales that the user can select in the
11566 - Only ship locale definitions that the user can select in the Welcome Screen
11568 * Thunderbird 78 and Enigmail obsoletion (tails/tails!203)
11571 - Upgrade to Thunderbird 78 ESR (tails/tails#17148)
11572 - Migrate from Enigmail to Thunderbird 78's built-in OpenPGP support
11573 (tails/tails#17147)
11576 - Test suite: adjust tests for Thunderbird 78.
11577 - Test suite: make local.yml load before *.d dirs, as intended.
11578 - Apply 1 suggestion(s) to 1 file(s)
11579 - Apply 1 suggestion(s) to 1 file(s)
11580 - Add missing 'set -u' to build-time hook.
11581 - Apply 1 suggestion(s) to 1 file(s)
11583 - Be more assertive
11584 - I'm not sure whether it's still the case
11585 - Update more references
11586 - Instruct to disable the GnuPG feature of the Persistent Storage
11587 - Document 'Require Encryption' by default
11588 - Rewrite anonym's draft
11592 - Remove outdated screenshot
11593 - Explain better the protection of the Master Password
11594 - Thunderbird: drop part of patch.
11595 - Thunderbird: don't automatically attach public key to signed messages.
11596 - Thunderbird: backport patch introducing pref for whether to automatically
11597 attach the public key.
11598 - Thunderbird: backport fix for OpenPGP dialog when sending to a recipient
11600 - Create libresolv.so → libresolv-${version}.so symlink.
11601 - Thunderbird: use the "Require encryption by default" policy.
11602 - Thunderbird: apply patch fixing issue with default encryption policy.
11603 - Revert "Thunderbird: patch to disable protectHeaders AKA MemoryHole."
11604 - Revert "Thunderbird: set allow_external_gnupg = true."
11605 - Improve migration prompt
11606 - Help user know how old Tails 4.13 is
11607 - Update Persistent Storage UI and doc
11608 - Remove fuzzy duplicates in PO files.
11609 - Remove section that's too generic
11610 - Remove deprecated migration instructions
11611 - Add section to import private keys
11612 - Move shorter and more generic sections first
11613 - Use automatic TOC anchors
11614 - Merge inline with its only page
11615 - Add headings and make the instructions linear
11616 - Thunderbird: patch to disable protectHeaders AKA MemoryHole.
11617 - Apply 1 suggestion(s) to 1 file(s)
11618 - Apply 1 suggestion(s) to 1 file(s)
11619 - Apply 1 suggestion(s) to 1 file(s)
11620 - Apply 1 suggestion(s) to 1 file(s)
11621 - Apply 1 suggestion(s) to 1 file(s)
11622 - Apply 1 suggestion(s) to 1 file(s)
11623 - Apply 1 suggestion(s) to 1 file(s)
11624 - Hook thunderbird wrapper script into our translation infrastructure.
11625 - Thunderbird: notify user about Enigmail migration.
11626 - Update Thunderbird OpenPGP docs for version 78.
11627 - Drop everything related to Enigmail.
11628 - Thunderbird: set allow_external_gnupg = true.
11629 - Thunderbird: update renamed prefs from upstreamed patches.
11630 - Don't install Enigmail (refs: #17147).
11631 - Update Thunderbird patches from icedove.git at commit
11632 90184f927783370a65bfde271a67613d21372c9f
11634 - Revert "Install Thunderbird 68 until we're ready for 78"
11636 -- Tails developers <tails@boum.org> Mon, 16 Nov 2020 12:23:11 +0100
11638 tails (4.12) unstable; urgency=medium
11641 - Upgrade libx11 to 2:1.6.7-1+deb10u1
11644 - Upgrade firmware-linux-nonfree to 20200918-1
11646 * Upgrade to Tor Browser 10.0.2 (based on Firefox 78.4) (tails/tails!208)
11649 - Upgrade to Tor Browser 10.0.2 (based on Firefox 78.4) (tails/tails#17971)
11652 - Revert "Tor Browser: patch in prefs changes introduced in 10.0-build3."
11653 - Fetch Tor Browser from our own archive.
11654 - Upgrade Tor Browser to 10.0.2-build2.
11656 * Use v3 Onion service to connect to our custom APT repository (tails/tails!201)
11659 - Migrate deb.tails.boum.org APT source to v3 onion (tails/tails#17937)
11662 - Use v3 Onion service to connect to our custom APT repository
11664 * onion-grater: fix rate limiting of how often we try to connect to tor
11668 - onion-grater: fix rate limiting of how often we try to connect to tor
11670 * Electrum & Upgrader wrappers: fix i18n support and use canonical URL for manual
11671 upgrade doc (tails/tails!198)
11674 - tails-upgrade-frontend-wrapper points users to a 404 URL for manual upgrades in
11675 French (tails/tails#17958)
11676 - Some Python scripts fail to set the gettext text domain correctly
11677 (tails/tails#17758)
11681 - Electrum & Upgrader wrappers: fix internationalization support, by setting the
11682 text domain correctly
11683 - Unfuzzy 2 translation strings
11684 - Update POT and PO files
11685 - tails-upgrade-frontend-wrapper: remove spurious double quotes surrounding error
11687 - Update POT and PO files
11688 - tails-upgrade-frontend-wrapper: use canonical URLs for manual upgrade doc
11690 * Keep installing Thunderbird 68 until we're ready for 78 (tails/tails!197)
11693 - All branches FTBFS since Thunderbird 78 reached the Buster security repo
11694 (tails/tails#17962)
11697 - Install Thunderbird 68 until we're ready for 78
11699 * WhisperBack: sanitize HTTP(s) URLs (tails/tails!196)
11702 - Unscrubbed URL in WhisperBack reports (tails/tails#10695)
11705 - WhisperBack: sanitize HTTP(s) URLs
11707 * Avoid mirrors and rsync.lizard running out of disk space during the release
11708 process when upgrades to a beta/RC are present (tails/tails!195)
11711 - Avoid mirrors and rsync.lizard running out of disk space during the release
11712 process when upgrades to a beta/RC are present (tails/tails#17944)
11715 - Release process: delete beta/RC IUKs before uploading the IUKs for the final
11717 - Call for testing: set a deadline for providing feedback (2 days before the
11719 - Release process: automate generation of call for testing
11721 * Installer: fix various internationalization bugs (tails/tails!194)
11724 - Various internationalization bugs in the Installer (tails/tails#17961)
11727 - Update POT and PO files, to match translatable strings changes
11728 - Installer: allow translators to reorder string arguments in translations
11729 - Installer: fix translations being unused due to translatable string being
11730 computed at runtime
11732 * Upgrade Linux to 5.8 and Debian to 10.6 (tails/tails!188)
11735 - Upgrade Linux to 5.8 (tails/tails#17896)
11736 - Upgrade to Buster 10.6 (tails/tails#17930)
11737 - Regression with Intel Corporation [8086:22b0] and [8086:22b1] GPU since 4.9
11738 (tails/tails#17953)
11741 - Tor Browser AppArmor profile: allow access to DRI nodes
11742 - Tor Browser AppArmor profile: update patch to apply on top of 0.3.2-14
11743 - Update GNOME Shell to 3.30.2-11~deb10u2.0tails1
11744 - Update systemd to 241-7~deb10u4.0tails1
11745 - Refresh uBlock patch to apply cleanly on top of webext-ublock-origin-firefox
11747 - Adjust for webext-ublock-origin package split
11748 - Adjust fake linux-compiler-gcc-N-x86 hack to Linux 5.8's needs
11749 - Kernel command line: drop init_on_alloc=1, now set by default in Debian
11750 - Upgrade Linux to 5.8.0-2 (currently at version 5.8.10-1)
11751 - Bump snapshot of the Debian archive to 2020101002
11753 * Upgrade to tor 0.4.4.5 (tails/tails!187)
11756 - Upgrade to tor 0.4.4 (tails/tails#17932)
11759 - Bump APT snapshot of the "torproject" archive to 2020091901, that has tor
11762 * Port Perl code to translatable strings format supported by GNU gettext
11766 - Port Perl code to translatable strings format supported by GNU gettext
11767 (tails/tails#17928)
11770 - refresh-translations: check PO files while converting them to MO
11771 - Upgrader, Persistence wizard: set the UTF-8 flag on all strings returned by
11773 - Re-add loading POSIX: we use it for more than setlocale
11774 - Upgrader, Persistence wizard: assume UTF-8 locale
11775 - Drop unneeded call to setlocale
11776 - Drop meaningless attempt at localization
11777 - Persistence setup: encode output when displaying errors on stdout
11778 - IUK creation: make saveas method benchmarking info honor its $outfile_name
11780 - Port Perl code to translatable strings format supported by GNU gettext
11782 * Import WhisperBack into our main Git repository (tails/tails!179)
11785 - Move WhisperBack source to our main Git repository (tails/tails#16936)
11788 - generate-changelog: don't consider obsolete tails/whisperback project
11789 - Integrate WhisperBack into our l10n setup
11790 - Import WhisperBack
11792 * Import Tails Installer into our main Git repository and delete its dead code
11796 - Move Tails Installer to our main Git repository (tails/tails#17917)
11799 - generate-changelog: don't consider obsolete tails/installer project
11800 - Adjust tails-installer.desktop to l10n setup
11801 - Installer: adjust gettext files lookup
11802 - Installer: adjust data directory lookup
11803 - Update Transifex script & doc: most of our Transifex projects are obsolete
11804 - Adjust code and doc to the fact Tails Installer now lives in tails.git
11805 - Import Tails Installer
11807 * Add a button to cancel the upgrade while downloading (tails/tails!12)
11810 - Add a button to cancel the upgrade while it's downloading (tails/tails#17310)
11813 - Fix regression introduced by 26b9b1b83f3857232474dd2291889867e80a3b45
11814 - Upgrader: port code added in !12 to the l10n setup we switched to in !181
11816 - Convert tails-iuk-get-target-file | zenity pipeline to start / pump / finish
11818 - Update design doc wrt. new tails-iuk-get-target-file permissions
11819 - Remove unnecessary exit code handling
11821 - Allow tails-upgrade-frontend to kill the download process
11822 - Set a signal handler to cancel the download when the zenity dialog is closed
11823 - Add a button to cancel the upgrade while it is downloading
11825 -- Tails developers <tails@boum.org> Mon, 19 Oct 2020 08:35:44 +0000
11827 tails (4.11) unstable; urgency=medium
11830 - Upgrade Linux kernel to 5.7.0-3 at 5.7.17-1 (#17895).
11831 - Upgrade Tor Browser to 10.0 (#17933).
11832 - Upgrade Thunderbird to 68.12.0-1~deb10u1.
11833 - Upgrade xorg-server to 1.20.4-1+deb10u1.
11834 - Upgrade openexr to 2.2.1-4.1+deb10u1.
11835 - Upgrade bind9 to 9.11.5.P4+dfsg-5.1+deb10u2.
11836 - Upgrade ghostscript to 9.27~dfsg-2+deb10u4.
11837 - Upgrade libzmq5 to 4.3.1-4+deb10u2.
11839 * Minor improvements and updates
11840 - Upgrade Electrum to 4.0.2-2.
11842 * Tor Browser 10.0 (tails/tails!189)
11845 - Tor Browser: patch in prefs changes introduced in 10.0-build3.
11846 - Test suite: make scenario titles consistently not end with period
11847 - Unsafe Browser: adjust disabling add-ons to Tor Browser 10
11848 - Unsafe Browser: add missing escaping
11849 - Upgrade Tor Browser to 10.0-build2 (refs: #17933).
11850 - Rename, refactor, reorganize.
11851 - Tor Browser: use new trick to avoid mandatory extension signing.
11852 - Upgrade Tor Browser to 10.0a7.
11854 * Test suite: use versioned python2 interpreter for otr-bot.py (tails/tails!186)
11857 - Test suite: use versioned python2 interpreter for otr-bot.py
11859 * Test suite: switch to virtio transport for the remote shell (tails/tails!185)
11862 - Improve the remote shell's performance by switching to a virtio channel
11863 (tails/tails#11888)
11866 - Test suite: make SocketReadTimeout inherit from RuntimeError
11868 - Test suite: use factorized way to get and update the domain's XML definition
11869 - Fix Layout/EmptyLineAfterGuardClause Rubocop regression
11870 - Fix Style/StringLiterals Rubocop regression
11871 - Fix Naming/HeredocDelimiterNaming Rubocop regression
11872 - Rubocop: fix a Security/JSONLoad regression
11873 - tails-autotest-remote-shell: lint
11874 - tails-autotest-remote-shell: remove unused import
11875 - Remote shell: improve warning.
11876 - Test suite: log whenever remote_shell_is_up?() returns false.
11877 - Remote shell: use timed read() for virtio channel.
11878 - Remote shell: switch from serial to virtio transport (refs: #11888).
11880 * Release process: generate UDFs to non-final releases from any supported
11881 previous version (tails/tails!178)
11884 - UDF generation is broken for release candidates (tails/tails#17921)
11887 - Don't generate UDFs on the stable channel to point to a release candidate
11888 - Release process: generate UDFs to non-final releases from any supported
11891 * Don't override Debian's system-wide Thunderbird configuration (tails/tails!177)
11894 - Adding comment explaining extensions.update.enabled Thunderbird pref (Refs:
11896 - Removing network.protocol-handler.app.http[s] Thunderbird preferences (Refs:
11898 - Removing intl.locale.requested Thunderbird preference (Refs: #16021)
11899 - Changing header in Thunderbird's prefs file indicating they are Tails' prefs
11901 - aa_tails.js: Removing repeated thunderbird preferences
11902 - Moving local included thunderbird config to not overwrite debian default (Will-
11905 * Clarify phrasing of KeePassXC database renaming dialog (tails/tails!175)
11908 - Explicit (#17286)
11909 - Explain that the change came from KeePassXC (#17286)
11911 * Test Thunderbird with local email server on Jenkins (tails/tails!172)
11914 - Checking credentials in Thunderbird autoconfig wizard sometimes fails in the
11915 test suite (tails/tails#11890)
11916 - Run our own email (IMAP/POP3/SMTP) server for automated tests run on lizard
11917 (tails/tails#12277)
11920 - Test suite: fix Rubocop offenses
11922 - Test suite: add debug logging so we can tell whether we're installing the
11923 hosts' email server's snakeoil certificate
11924 - Test suite: add missing newline.
11925 - Test suite: set promiscuous trust for the certificate we import.
11926 - Test suite: import isotesters' snakoil SSL cert into Thunderbird.
11927 - Test suite: complete the switch from Icedove to Thunderbird namespace in
11928 configuration (refs: #12277)
11930 * Chutney docs and logging (tails/tails!167)
11933 - Test suite: improve logging message for initial Chutney cleanup.
11934 - Test suite: also log when Chutney is up and running.
11935 - Test suite: make Chutney logging visible without debug formatter.
11936 - Test suite: document our usage of Chutney (refs: #17801).
11938 * Install python3-trezor from buster-backports (tails/tails!165)
11941 - Install trezor packages from buster-backports
11943 * Fix “return to Greeter when clicking the Start Tails button” on Intel+AMD dual-
11944 GPU systems (tails/tails!163)
11947 - tails-unblock-network: skip most graphics-related devices when triggering udev
11949 * Round the download size in "Upgrade available" dialog (tails/tails!162)
11952 - Rounds the size of numbers displayed in stderr if is not possible to do an
11953 incremental upgrade because there is no free memory or disk space available
11954 - Round the download size in Upgrade available IUK dialog
11956 * Save KeePassXC database in persistent directory (tails/tails!161)
11959 - Adjust end-user documentation for new default KeePassXC database filename
11960 - Open Passwords.kdbx by default (#17286)
11961 - Install KeePassXC 2.5.4 from buster-backports (#17286)
11963 * Support audio on recent Intel platforms: Comet Lake, Whiskey Lake, etc.
11967 - auto/build: enable the pipefail option
11968 - Add Intel SOF Firmware and Topology binaries as a submodule and install them
11969 - build-tails: give our build scripts access to submodules' refs
11970 - Make code fail hard if it becomes obsolete
11972 * "Synchronizing the system's clock" notification: hidden → onion services
11976 - update hidden to onion services
11977 (https://gitlab.tails.boum.org/tails/tails/-/issues/15354)
11979 * Drop obsolete workaround for python3-qdarkstyle, fixing devel FTBFS
11983 - Drop now unneeded APT pinning on helpdev and python3-qdarkstyle
11984 - Revert "Avoid installing python3-qdarkstyle by default"
11986 * Build the changelog from GitLab MRs rather than from Git commits
11990 - generate-changelog: only list merged MRs
11991 - Changelog generation: support preparing a non-final (alpha, beta, RC) release
11993 - Release process: update obsolete reference to Stretch
11994 - Release process: use HTTPS URIs
11995 - Remove obsolete "release" script
11996 - RM doc: drop obsolete process hack around painful changelog generation
11997 - Release process and release notes checklist: switch to automated changelog
11999 - changelog.jinja2: add newlines for nicer formatting if rendered as Markdown
12000 - generate-changelog: skip merge commits
12001 - Add PoC script that generates a changelog from GitLab MRs
12003 * Include "initially installed Tails version" info in WhisperBack reports
12007 - Include "initially installed Tails version" in WhisperBack reports
12008 - Reorder debugging info: keep persistence-related info together
12010 * try_for() timeout is not honored (tails/tails!151)
12013 - Test suite: try_for timeout is not honored (tails/tails#17822)
12016 - Revert "Revert "Test suite: revert exception handling change in try_for""
12018 * Enable persistence for all Greeter settings (tails/tails!149)
12021 - Test suite: make sure Greeter settings are default when they should.
12022 - Test suite: add scenario testing persistent Greeter options (refs: #17136).
12023 - Test suite: support entering sudo/persistent password in German.
12024 - Test suite: simplify.
12025 - Test suite: refactor.
12026 - Test suite: restore $language after reboot during the same scenario.
12027 - Test suite: consistently wait for notifications after logging in.
12028 - Greeter: Explain in a comment why we need this ugly workaround
12029 - Greeter: expand persistence support to all settings.
12031 * Tor browser 10.0.x based on ESR78 (tails/tails!148)
12034 - Automate Tor Browser import branch name generation.
12035 - Tor Browser: disable update checks via Enterprise Policy mechanism.
12036 - Revert "Tor Browser: disable the update check with a hack."
12037 - Upgrade Tor Browser to 10.0a6.
12038 - Tor Browser: disable the update check with a hack.
12039 - Test Suite: bump image.
12040 - Test Suite: bump UnsafeBrowserStartPage.fa.png.
12041 - Unsafe Browser: enable userChrome.css.
12042 - Unsafe Browser: Fix pref → user_pref error.
12043 - Tor Browser: drop userChrome.css.
12044 - Unsafe Browsesr: make DNS resolution work.
12045 - Revert "Tor Browser: remove leftover .orig."
12046 - Revert "Tor Browser: delete all Namecoin stuff."
12047 - Revert "Tor Browser: temporarily disable all non-en_US locales."
12048 - Tor Browser: refresh extension hacks patches.
12049 - Upgrade Tor Browser to 10.0a5-build2.
12051 - Don't ignore grep failure.
12052 - Tor Browser: delete all Namecoin stuff.
12053 - Tor Browser: use the bundled libstdc++.so.6.
12054 - Tor Browser: remove leftover .orig.
12055 - Tor Browser: temporarily disable all non-en_US locales.
12056 - Upgrade Tor Browser to 10.x nightly build as of 2020-08-13.
12057 - Tor Browser: naming scheme for nightly builds has changed.
12059 * Hide broken "Turn on Wi-Fi Hotspot" feature in GNOME Wi-Fi settings
12063 - Hide broken "Turn on Wi-Fi Hotspot" feature in GNOME Wi-Fi settings (#17887)
12065 * Upgrade Linux to 5.7.17-1, adjust for updated Electrum dependencies, support
12066 older TREZOR firmware (tails/tails!142)
12069 - Avoid installing python3-qdarkstyle by default
12070 - Install python3-hid, to support the HID version of TREZOR
12071 - Install python3-qdarkstyle from Bullseye: Electrum now depends on it (#17904)
12072 - Upgrade Linux to 5.7.0-3, currently at version 5.7.17-1 (#17895)
12073 - Revert "Install python3-cryptography, otherwise Electrum 4.0.2-0.1 won't start"
12074 - Install python3-construct from buster-backports: python3-trezor needs it
12077 * Fix sorting Intel GPUs last in the "Error starting GDM" message
12081 - Multiple GPUs are not sorted in the intended order in the "Error starting GDM"
12082 message (tails/tails#17903)
12085 - Fix sorting Intel GPUs last in the "Error starting GDM" message (#17903)
12087 * Include information about the contents of the system partition in WhisperBack
12088 reports (tails/tails!140)
12091 - tails-debugging-info: include information about the contents of the system
12093 - tails-debugging-info: add support for commands that need to go through a shell
12095 -- Tails developers <tails@boum.org> Mon, 21 Sep 2020 12:03:51 +0200
12097 tails (4.10) unstable; urgency=medium
12100 - Upgrade Tor Browser to 9.5.4-build1 (Closes: #17885).
12101 - Upgrade Linux kernel to 5.7.0-2 at 5.7.10-1 (Closes: #17841,
12105 - Make iPhone Tethering work by adding udev rule to disable MAC
12106 spoofing for it (Closes: #17820).
12107 - Remove broken Thunderbird protocol selection. This code has been
12108 a no-op in practice since at least Tails 4.0. We've decided to
12109 reject #17276 and investigate what the biggest problems are for
12110 email in Tails with slow/shitty Internet connections:
12111 default'ing to IMAP may, or may not, be part of these
12112 problems (Closes #17276).
12114 * Minor improvements and updates
12115 - Upgrade to Tor 0.4.3.6 (Closes: #17835).
12116 - Upgrade to Electrum 4.0.2 (Closes: #17828).
12117 - Hide Thunderbird welcome message: it is not relevant in the
12118 context of Tails. For example, it feels weird that we would
12119 encourage users to donate to Thunderbird about as loudly as we
12120 encourage them to donate to Tails. Besides, the default message
12121 is retrieved from the web when Thunderbird starts. We don't
12122 need this extra network activity.
12123 - import-translations: use *_release branches instead of
12124 *_completed branches. The new *_release branches contain exactly
12125 what we want, i.e. all reviewed translations from
12126 Transifex. While the *_completed branches only contain PO files
12127 for languages that are fully translated (Closes: #16774).
12130 - Upgrade snapshot of the Debian archive to 2020081601, including
12131 the 10.5 point release of Debian Buster (Closes: #17790).
12132 - On Bullseye and newer: use custom, fake, unversioned python
12133 packages. The unversioned python packages are not shipped in
12134 Bullseye/sid anymore, and even old versions are not installable
12135 anymore (Closes: #17858).
12136 - Import vagrant-libvirt's create_box.sh script. It's not included
12137 in vagrant-libvirt 0.1.2-1 anymore (Closes: #17872).
12140 - Improve robustness for scenario "The Additional Software dpkg
12141 hook notices when persistence is locked down while installing a
12143 - Improve robustness for scenario "Use GNOME Disks to unlock a USB
12144 drive that has a basic VeraCrypt volume with a keyfile".
12145 - Improve robustness of cloning a Git repository.
12146 - Don't hammer resources of the system under test while
12147 installing/removing packages. I see every such dpkg|grep call
12148 takes about 0.3 seconds on lizard, i.e. 30% of the 1 second
12149 default delay between checks, which I suspect is enough to slow
12150 down the package installation/removal we're exercising.
12151 - Update expected title of the GitLab page we use
12152 - Rubocop: target Ruby 2.5 (Buster).
12154 -- Tails developers <tails@boum.org> Mon, 24 Aug 2020 13:28:43 +0200
12156 tails (4.9) unstable; urgency=medium
12159 - Upgrade Tor Browser to 9.5.3-build1 (Closes: #17827).
12160 - Upgrade Thunderbird to 1:68.10.0-1~deb10u1 (DSA-4718).
12161 - Upgrade Linux to 5.7.0-1 at 5.7.6-1 (Closes: #17786).
12162 - Upgrade Evolution Data Server to 3.30.5-1+deb10u1 (DSA-4725).
12163 - Upgrade FFmpeg to 7:4.1.6-1~deb10u1 (DSA-4722).
12164 - Upgrade ImageMagick to 8:6.9.10.23+dfsg-2.1+deb10u1 (DSA-4712).
12165 - Upgrade NSS to 2:3.42.1-1+deb10u3 (DSA-4726).
12166 - Upgrade OpenMPT to 2:3.42.1-1+deb10u3 (DSA-4729).
12167 - Upgrade WebKitGTK to 2.28.3-2~deb10u1 (DSA-4724).
12170 - Fix quoting issue triggering problems with some administration
12171 passwords (Closes: #17792).
12172 - Fix toram boot option by not starting the tails-shutdown-on-media-removal
12173 service unit in that case (Closes: #17800).
12174 - Fix keyboard setting handling in the greeter (Closes: #17794).
12175 - Make sure log messages can be displayed by Plymouth, which has strict
12176 limits, and improve parsing in tails-gdm-error-message (Closes: #17533).
12177 - Upgrade firmware-linux and firmware-nonfree to 20200421-1.
12179 * Minor improvements and updates
12180 - Ensure MAC spoofing messages are translated (Closes: #17783).
12181 - Improve failure handling for MAC spoofing (Closes: #17784).
12182 - Trigger MAC spoofing "panic" mode when the debug=test_mac_spoof_panic boot
12184 - Upgrade VirtualBox guest modules to 6.1.12-dfsg-5.
12187 - Automate post-release GitLab updates, using gitlab-triage (Closes: #17589).
12188 - Fix a lot of possible problems spotted by ShellCheck, thanks to Paul Wise.
12189 - Stop installing custom firmware: firmware-realtek 20200421-1 includes it
12190 (See: #17786, #17323).
12191 - Update Thunderbird patches (Closes: #6156, #17808).
12192 - Bump snapshot of the Debian archive to 2020071801 (Closes: #17786).
12195 - Add shell-special chars to passwords (See: #17792).
12196 - Always test the Unsafe Browser in Farsi.
12197 - Fix support for symlinks (Closes: #17547).
12198 - Update persistence-setup test suite for a new preset in Welcome Screen
12200 - Drop Thunderbird POP3 test.
12201 - Make the "the Tor Browser has started" step stricter.
12202 - Improve error output when the Unsafe Browser fails to start in some locale.
12204 -- Tails developers <tails@boum.org> Mon, 27 Jul 2020 09:03:10 +0200
12206 tails (4.8) unstable; urgency=medium
12209 - Welcome Screen: after a large refactoring we now can persist
12210 settings (See: #17136)! Currently it is limited to the newly
12211 added option that controls whether the Unsafe Browser is allowed
12212 to start (#17085). In the next major release we'll support all
12216 - Allow to disable the Unsafe Browser in the Welcome Screen
12217 (Closes: #17085). The Unsafe Browser can be used by exploits to
12218 deanonymize the Tails user (for details, see: #15635).
12219 - Upgrade Tor Browser to 9.5.1-build2 (Closes: 17782).
12221 * Upgrade to Thunderbird 68.9.0 (DSA-4702).
12222 * Disable unsafe MX automatic configuration method (Closes:
12224 * Disable unsafe MS Exchange automatic configuration method
12226 - Upgrade Linux kernel to linux-image-5.6.0-2 at 5.6.14-2 (Closes:
12228 - Upgrade gnutls28-based packages to 3.6.7-4+deb10u4 (DSA-4697).
12229 - Upgrade intel-microcode to 3.20200609.2~deb10u1 (DSA-4701).
12232 - Trigger emergency shutdown on resume when the boot device was
12233 removed while suspended (Closes: #16787).
12234 - Thunderbird: make searching in messages (Find bar and Find in
12235 This Message) work again (Closes: #17328).
12236 - Ensure Mac Spoofing Panic messages will be correctly displayed
12237 (Closes: #17779). udev may close child processes when a process
12238 associated with a rule (/etc/udev/rules) terminates so we wait
12239 for those processes before exiting.
12240 - Wrap `seahorse-tool --import` so it is handled by `gpg --import`
12241 (Closes: #17183). This makes importing binary keys via GNOME
12242 Files integration possible again.
12244 * Minor improvements and updates
12245 - Upgrade to tor 0.4.3.5-1 (Closes: #17741).
12246 - Upgrade LibreOffice to 1:6.1.5-3+deb10u6.
12247 - Upgrade VirtualBox guest modules to 6.1.10-dfsg-1.
12248 - Append Unsafe Browser setting to WhisperBack debug info.
12251 - Upgrade snapshot of the Debian archive to 2020061003, including
12252 the 10.4 point release of Debian Buster (Closes: #17620).
12253 - Tor Browser AppArmor profile: update patch to apply on top of
12254 0.3.2-11 (Closes: #17612)
12255 - Thunderbird AppArmor profile: update patch to apply on top of
12256 68.9.0 (Closes: #17769).
12259 - Establish a coding standards baseline on our Ruby code base
12260 using Rubocop (Closes: #17646). This *MASSIVE* change includes
12261 mainly stylistic fixes and linting but also a few bug fixes,
12262 some dead code removal and code simplifications/refactorings,
12263 spelling fixes, improved gherkin and even removal the of
12264 a few duplicated tests and merging of very similar tests.
12265 - Improve robustness of navigating the GRUB menu in UEFI mode, and
12266 consequently drop the @fragile tag on the UEFI boot scenario
12268 - Allow configuring the number of vCPUs given to TailsToaster.
12269 Based on work done by kytv (♥) on #6729. On powerful hardware
12270 with many CPUs, Tails boots much faster with >2 vCPUs given to
12272 - Disable desktop size and clipboard interference between the host
12273 system and the system under test when using --view.
12274 - Ensure we run post_snapshot_restore_hook every time it's needed.
12275 - Fix running with XDG_SESSION_TYPE unset (Closes: #17596).
12276 - Always test the localized start up page of the Unsafe Browser.
12277 - Add --keep-chutney option to keep Chutney data, but no
12278 snapshots, between runs.
12279 - Revert "Test suite: disable tests about notifications in case of
12280 MAC spoofing failure (refs: #10774)"
12281 - Verify that the Unsafe Browser is disabled by default.
12282 - Test suite: fix --image-bumping-mode.
12284 -- Tails developers <tails@boum.org> Mon, 29 Jun 2020 16:02:18 +0200
12286 tails (4.7) unstable; urgency=medium
12289 - Upgrade Tor Browser to 9.5-build2 (Closes: #17710).
12290 - Upgrade APT to 1.8.2.1 (DSA-4685).
12291 - Upgrade BIND to 1:9.11.5.P4+dfsg-5.1+deb10u1 (DSA-4689).
12292 - Upgrade WebKitGTK to 2.28.2-2~deb10u1 (DSA-4681).
12293 - Upgrade Thunderbird to 1:68.8.0-1~deb10u1 (DSA-4683).
12296 - Improve Additional Software reliability (Closes: #17278): disable
12297 periodic APT operations entirely, adjust timeouts, force data
12298 synchronization, preserve file ownership.
12299 - Make memory erasure feature compatible with overlayfs (Closes: #15146).
12300 - Adjust various documentation for the new GitLab-based hosting.
12302 * Minor improvements and updates
12303 - Fix title of unlock-veracrypt-volume error dialog in case of incorrect
12304 password (Closes: #17668).
12305 - Clean up confusing torrc (Closes: #17706).
12308 - IUK creation: don't use extreme compression options for the outer
12309 SquashFS container refs.
12310 - IUK creation: add support for building several IUKs in parallel locally
12312 - IUK verification: add support for fetching IUKs built in parallel on
12313 Jenkins (Closes: #17658).
12314 - Release process: generate UDFs on the alpha channel for previous
12315 non-final releases (Closes: #17614).
12316 - Remove aufs-based IUK generation code and doc (Closes: #17489).
12319 - Adjust for augmented timeouts in Additional Software.
12320 - Adjust locale lookup to check several directories.
12321 - Speed up 'I fill a ... MiB file' step by 1000%.
12322 - Keep latest test suite screenshot (Closes: #17621).
12323 - Fix test suite breaking when the user connects to the VM via virt-viewer
12325 - Adjust reference images and titles following the migration to GitLab
12326 (Closes: #17718, 17719).
12328 -- Tails developers <tails@boum.org> Mon, 01 Jun 2020 18:31:41 +0200
12330 tails (4.6) unstable; urgency=medium
12333 - Upgrade Tor Browser to 9.0.10-build2 (Closes: #17660).
12334 - Upgrade Thunderbird to 1:68.7.0-1~deb10u1 (MFSA-2020-14, DSA-4656).
12335 - Upgrade Git to 1:2.11.0-3+deb9u3 (DSA-4657, DSA-4659).
12336 - Upgrade Node.js to 10.19.0~dfsg1-1 (DSA-4669).
12337 - Upgrade OpenLDAP to 2.4.47+dfsg-3+deb10u2 (DSA-4666).
12338 - Upgrade OpenSSL to 1.1.1d-0+deb10u3 (DSA-4661).
12339 - Upgrade ReportLab to 3.5.13-1+deb10u1 (DSA-4663).
12340 - Upgrade WebKitGTK to 2.26.4-1~deb10u3 (DSA-4658).
12343 - Switch Japanese input method from Anthy to Mozc (Closes: #16719).
12344 - Install the libu2f-udev package, for U2F device support.
12345 - Update our list of 'Favorites' applications (Closes: #16990).
12348 - lint_po: support locales with "@" in their name, such as ru@petr1708
12350 - perl5lib: declare missing test dependencies (Closes: #17591).
12351 - iuk: declare missing test dependencies (Closes: #17592).
12352 - Upgrade to po4a 0.55 for Tails images and Vagrant box (Closes: #17005).
12355 - Print disk usage information when the test suite fails with “No
12356 space left” errors.
12357 - Ensure no zombie processes are left around, by cleaning subprocesses
12358 correctly (Closes: #17551).
12359 - Prevent webrick from becoming a zombie process.
12360 - Avoid test suite getting stuck due to a zero timeout.
12361 - Fix obsoletion warnings (Closes: #17552).
12362 - Add root check and --allow-non-root option (Closes: #17613). Let's
12363 make it clear running the test suite requires root privileges in
12366 -- Tails developers <tails@boum.org> Mon, 04 May 2020 18:43:38 +0200
12368 tails (4.5) unstable; urgency=medium
12371 - Upgrade Tor Browser to 9.0.9-build1 (Closes: #17594).
12372 - Upgrade BlueZ to 5.50-1.2~deb10u1 (DSA-4647).
12373 - Upgrade GnuTLS to 3.6.7-4+deb10u3 (DSA-4652).
12375 -- Tails developers <tails@boum.org> Mon, 06 Apr 2020 21:51:05 +0200
12377 tails (4.5~rc1) unstable; urgency=medium
12380 - Migrate from aufs to overlayfs (Closes: #8415). This change touches
12381 many components which won't all be listed individually, but some
12382 highlights are listed below:
12383 ⋅ Adjust the build system to stop building the aufs kernel module.
12384 ⋅ Switch the kernel command line from union=aufs to union=overlayfs.
12385 ⋅ Adjust AppArmor profiles (Closes: #9045, #12112).
12386 . Adapt chroot-browsers (Closes: #12105).
12387 ⋅ Drop the aufs Git submodule.
12388 ⋅ Make memory erasure feature compatible with overlayfs
12390 ⋅ Make Upgrader support and also generate overlayfs-based IUKs by
12391 default (Closes: #9373).
12392 - Use GRUB with Secure Boot support for x86_64 (Closes: #6560, #15806).
12393 This is also a large change, touching many components:
12394 ⋅ Install grub from bullseye.
12395 ⋅ Introduce a custom grub configuration file.
12396 ⋅ Use a custom background image.
12397 ⋅ Mimick Debian Installer's efi-image build script to handle all
12398 details in binary local hooks.
12399 ⋅ Add SYSLINUX in the syslinux bootloader menu, to make it easier to
12400 troubleshoot GRUB vs. syslinux issues (Closes: #17538).
12401 ⋅ Upgrader: Adjust to also handle files in EFI/debian when dealing
12402 with file removals.
12403 ⋅ Adjust test suite.
12404 - Migrate test suite from Sikuli to a combination of OpenCV (image
12405 matching), xdotool (mouse interaction), plus libvirt's send-key
12406 (keyboard interaction) (Closes: #15460). This is another major
12407 changes, allowing the test suite to run on Buster-based systems,
12408 touching various areas of the test suite, among which:
12409 ⋅ Add workaround for the Greeter when restoring snapshot.
12410 ⋅ Fix dependencies for Buster.
12411 ⋅ Replace some Sikuli-based options with some OpenCV-based ones
12412 (e.g. --retry-find → --image-bumping-mode).
12413 ⋅ Handle non-English keyboards.
12414 ⋅ Fix --capture on Buster and above.
12415 ⋅ Deal with Buster having migrated from avconv to ffmpeg.
12418 - Upgrade ICU to 63.1-6+deb10u1 (DSA-4646).
12420 * Minor improvements and updates
12421 - Refactor tails-documentation (Closes: #16903).
12424 - Freeze APT snapshots for 4.5~rc1.
12425 - Rakefile: always disable website caching when building from a tag
12427 - Rakefile: fix recommended permissions (libvirt needs +r to share the
12428 source tree with the Vagrant box).
12429 - Import persistence-setup.git from its own repository into tails.git
12430 (Closes: #17526, #6487).
12431 - IUK: ensure rsync runtime dependency is installed.
12434 - Adjust for the aufs → overlayfs migration (Closes: #12106, #17440,
12436 - run_test_suite: don't print usage on error.
12437 - run_test_suite: --view/--vnc-server-only are only supported on x11.
12438 - Optimize checking if file is empty.
12439 - Speed up some test failures to avoid resource starvation.
12440 - Check for tcplay dependency.
12441 - Increase chances chutney starts after unclean shutdown.
12442 - Make chutney log what it is doing.
12443 - Make opening Thunderbird's Extensions tab more robust.
12445 -- Tails developers <tails@boum.org> Thu, 26 Mar 2020 22:51:35 +0100
12447 tails (4.4.1) unstable; urgency=medium
12450 - Upgrade Tor Browser to 9.0.7-build1 (Closes: #17539).
12451 - Upgrade tor to 0.4.2.7 (Closes: #17531).
12452 - Upgrade Thunderbird to 1:68.6.0-1~deb10u1 (MFSA-2020-10, DSA-4642).
12453 - Upgrade WebKitGTK to 2.26.4-1~deb10u2 (DSA-4641).
12456 - lint_po: avoid race conditions when checking PO files (Closes: #17359).
12458 -- Tails developers <tails@boum.org> Sun, 22 Mar 2020 20:27:47 +0100
12460 tails (4.4) unstable; urgency=medium
12463 - Upgrade Tor Browser to 9.0.6-build2 (MFSA-2020-09).
12464 - Upgrade Linux kernel to linux-image-5.4.0-4, currently at 5.4.19-1
12466 - Upgrade Thunderbird to 68.5.0-1~deb10u1 (MFSA-2020-07, Closes: #17481).
12467 - Upgrade cURL to 7.64.0-4+deb10u1 (DSA-4633).
12468 - Upgrade evince to 3.30.2-3+deb10u1 (DSA-4624).
12469 - Upgrade Pillow to 5.4.1-2+deb10u1 (DSA-4631).
12470 - Upgrade ppp to 2.4.7-2+4.1+deb10u1 (DSA-4632).
12471 - Upgrade WebKitGTK to 2.26.4-1~deb10u1 (DSA-4627).
12474 - Fix missing firmware for RTL8822BE/RTL8822CE (See: #17323). Use the
12475 tails-workarounds provided firmwares until the firmware-realtek
12476 package is updated with the patch by Sjoerd Simons (Debian#935969).
12477 Note: This might not be sufficient to support those cards.
12479 * Minor improvements and updates
12480 - Upgrade dogtail to 0.9.11-6.
12481 - Upgrade virtualbox to 6.1.4-dfsg-1.
12484 - Vagrant build box: disable mitigation features for CPU
12485 vulnerabilities (Closes: #17386). Given the kind of things we do in
12486 our Vagrant build box, it seems very unlikely that vulnerabilities
12487 such as Spectre and Meltdown can be exploited in there. Let's
12488 reclaim some of the performance cost of the corresponding mitigation
12490 - Enable website caching by default, with a way option to disable it
12492 - Key the website cache on debian/changelog too (Closes: #17511).
12493 - Update APT snapshot of the Debian archive to 2020030101.
12494 - Add support for the tails-workarounds submodule.
12496 -- Tails developers <tails@boum.org> Wed, 11 Mar 2020 10:59:10 +0100
12498 tails (4.3) unstable; urgency=medium
12501 - Upgrade Tor Browser to 9.0.5-build2 (Closes: #17469).
12502 - Update Linux kernel to linux-image-5.4.0-3-amd64, currently at
12503 5.4.13-1 (Closes: #17443).
12504 - Upgrade Thunderbird to 1:68.4.1-1~deb10u1
12505 - Upgrade WebKitGTK to 2.26.3-1~deb10u1 (DSA-4610).
12508 - live-persist: don't backup empty configuration files (Closes:
12509 #17112). In some cases, the previous code would overwrite a
12510 non-empty backup file with an empty one, making it harder to
12511 recover from the already painful #10976.
12512 - create-usb-image-from-iso: Run syslinux within proper chroot
12513 (Closes: #17179). Previously we ran syslinux from the host,
12514 which can lead to bugs if its versions differs from the one
12515 inside the chroot (which is what Tails will use later). Thanks
12516 to Johan Blåbäck for the patch!
12517 - Tails Upgrader: Fix progress bar not pulsating and hide useless
12518 OK button (Closes: #16603).
12520 * Minor improvements and updates
12521 - Upgrade tor to 0.4.2.6 (Closes: #17059).
12522 - Install the trezor package, which adds a command-line (only)
12523 tool for managing Trezor devices (Closes: #17463). Thanks to
12524 Pavol Rusnak for the patch!
12525 - As a consequence of the Linux kernel upgrade we also:
12526 * Upgrade aufs to 5.4.3 20200127.
12527 * Install VirtualBox guest tools and kernel modules from sid.
12530 - Upgrade snapshot of the Debian archive to 2020020302, including
12531 the 10.3 point release of Debian Buster (Closes: #17458).
12532 - Add opt-in caching of the wiki (Closes: #15342).
12533 - Use mksquashfs' -no-exports option even when the fastcomp build
12534 option is set. "fastcomp" is supposed to only tweak SquashFS
12535 compression settings, but so far it was also disabling the
12536 -no-exports option that we set for our release builds.
12537 - Drop a bunch of packages installed for ikiwiki for various
12538 (obsoloete) resons:
12539 * libfile-chdir-perl, libyaml-perl and libxml-simple-perl which
12540 was needed back when we built our own ikiwiki from Git… a
12542 * libtext-multimarkdown-perl used multimarkdown ikiwiki which
12543 its doubtful we ever will use.
12544 * libhtml-scrubber-perl, libhtml-template-perl,
12545 libhtml-parser-perl, libyaml-libyaml-perl and liburi-perl
12546 which are already installed as ikiwiki dependencies.
12547 - Install libimage-magick-perl instead of the perlmagick
12548 transitional package.
12549 - Don't install obsolete dependencies whois and eatmydata.
12550 - Consistently validate individual build options as we parse them.
12551 This is consistent with how we handled "fastcomp" already. Only
12552 compatibility checks between multiple build options really need
12553 to happen later, once we've parsed all build options.
12554 - Remove 5 years old transition code
12555 - Fully provision the Vagrant box every time it starts, and
12556 partially re-provision it for every build.
12557 - Behave correctly when disabling a previously set "offline" or
12558 "vmproxy+extproxy" build option. Previously, setting one of
12559 these build options *once* would taint the Vagrant box forever
12560 with the resulting apt-cacher-ng configuration.
12561 - Shrink the apt-cacher-ng cache after a successful build too
12563 - Set up infrastructure to retrieve log file from the VM even on
12564 build failure (Closes: #7749).
12565 - Always build from a fresh Git clone.
12566 - Set the permissions that Vagrant needs inside the source tree
12567 (Closes: #11411, #16607, #17289).
12570 - Remove Seahorse key synchronization scenarios. These 2 scenarios
12571 never pass due to #17169, so currently:
12572 * They don't teach us anything new → no benefit.
12573 * Every time a developer looks at test suite results,
12574 they need to filter out this known problem, which takes time
12575 and trains us to ignore problems.
12577 -- Tails developers <tails@boum.org> Mon, 10 Feb 2020 14:08:59 +0100
12579 tails (4.2.2) unstable; urgency=medium
12582 - Upgrade Tor Browser to 9.0.4-build1 (MFSA-2020-03)
12585 - Avoid the Upgrader proposing to upgrade to the version
12586 that's already running (Closes: #17425)
12587 - Avoid 2 minutes delay while rebooting after applying an automatic
12588 upgrade (Closes: #17026)
12589 - Make Thunderbird support TLS 1.3 (Closes: #17333)
12592 - IUK generation: don't make all files in the SquashFS diff
12593 owned by root, otherwise an upgraded system cannot start
12596 -- Tails developers <tails@boum.org> Mon, 13 Jan 2020 09:21:51 +0000
12598 tails (4.2) unstable; urgency=medium
12601 - Switch to a redesigned upgrade system (Closes: #15281), which:
12602 - removes the need for manual upgrades caused by lack of disk space
12603 on the Tails device
12605 - Bump snapshot of the Debian archive to 2019122802
12608 - Upgrade Tor Browser to 9.0.3 (Closes: #17402)
12609 - Upgrade Linux to 5.3.15-1 (Closes: #17332)
12610 and upgrade the aufs module to 5.3-20191223
12611 - Upgrade Thunderbird to 1:68.3.0-2~deb10u1
12612 - Upgrade libsasl2 to 2.1.27+dfsg-1+deb10u1
12613 - Upgrade python3-ecdsa to 0.13-3+deb10u1
12617 - Open ~/Persistent/keepassx.kdbx by default again (Closes: #17212)
12618 - Open the database specified by the user on the command-line, if any
12619 - Fix database renaming prompt
12621 - Ensure debugging info lands in the Journal before we refer to it
12622 - Catch more download errors
12623 - Upgrade amd64-microcode to 3.20191218.1, which removes firmware
12624 updates that cause issues
12626 * Minor improvements and updates
12627 - Add metadata analysis tools used by SecureDrop (Closes: #17178)
12628 - Refresh the signing key before checking for available upgrades
12630 - Port the Upgrader and perl5lib to a set of dependencies that are
12631 faster and have a lower memory footprint (Closes: #17152)
12632 - Ensure IUKs don't include files of our website if their content
12633 has not changed (refs: #15290)
12634 - Zero heap memory at allocation time and at free time (Closes: #17236)
12637 - Import the Upgrader and perl5lib codebases into tails.git
12639 - lint_po: ignore pre-existing rply cache file that can cause
12640 trouble if it's corrupted (Closes: #17359)
12641 - Move generate-languages-list to auto/scripts
12642 - import-translations: work around the lack of usable branches
12643 in Tor's translation.git (Closes: #17279)
12644 - Build released IUKs on Jenkins and verify that they match
12645 those built locally by the Release Manager (Closes: #15287)
12646 - Don't download every localized Tor Browser tarball: instead,
12647 use the new tarball that includes every langpacks (Closes: #17400)
12650 - Adapt for the "one single SquashFS diff" upgrade scheme
12651 - Chutney: update to upstream 33cbff7fc73aa51a785197c5f4afa5a91d81de9c
12653 - Fix tagging of Chutney exit relays and bridge authorities
12654 - Tag Chutney clients as such
12655 - Wait for all Chutney nodes to have bootstrapped before assuming
12656 the simulated Tor network is ready
12657 - Don't try to save tor control sockets as artifacts
12658 - Add a crude script to generate IUKs for our test suite
12660 -- Tails developers <tails@boum.org> Mon, 06 Jan 2020 16:25:22 +0000
12662 tails (4.1.1) unstable; urgency=medium
12665 - Drop all network drivers from the initramfs to shrink its size
12666 drastically. Going over the 32 MiB mark might be the reason why so
12667 many Apple machines can't boot 4.1 while they could boot 4.0
12669 - Only allow up to (but excluding) 32 MiB for initramfs accordingly.
12671 * Minor improvements and updates
12672 - Fix escape sequence in tails-gdm-failed-to-start.service, to avoid a
12673 warning message (Closes: #17166).
12675 -- Tails developers <tails@boum.org> Sun, 15 Dec 2019 23:51:25 +0100
12677 tails (4.1) unstable; urgency=medium
12680 - Upgrade Tor Browser to 9.0.2-build2, based on Firefox ESR 68.3
12682 - Upgrade Thunderbird to 68.2.2 (Closes: #16771, #17220, #17222, #17267).
12683 - Upgrade Enigmail to 2:2.1.3+ds1-4~deb10u2 accordingly.
12686 - Upgrade Linux to 5.3.9-2 from sid (Closes: #17124).
12687 - Disable unprivileged userfaultfd syscall (Closes: #17196).
12688 - Upgrade file to 1:5.35-4+deb10u1 (DSA-4550-1).
12689 - Upgrade FriBidi to 1.0.5-3.1+deb10u1 (DSA-4561-1).
12690 - Upgrade Ghostscript to 9.27~dfsg-2+deb10u3 (DSA-4569-1)
12691 - Upgrade Intel microcode to 3.20191112.1~deb10u1 (DSA-4565-1,
12693 - Upgrade libarchive to 3.3.3-4+deb10u1 (DSA-4557-1).
12694 - Upgrade libvpx to 1.7.0-3+deb10u1 (DSA-4578-1).
12695 - Upgrade libxslt to 1.1.32-2.2~deb10u1 (CVE-2019-18197).
12696 - Upgrade ncurses to 6.1+20181013-2+deb10u2 (CVE-2019-17594,
12698 - Upgrade Python 2.7 to 2.7.16-2+deb10u1 (CVE-2018-20852,
12699 CVE-2019-10160, CVE-2019-16056, CVE-2019-16935, CVE-2019-9740,
12701 - Upgrade Qt to 5.11.3+dfsg1-1+deb10u1 (DSA-4556-1).
12702 - Upgrade tcpdump to 4.9.3-1~deb10u1 (DSA-4547-1).
12703 - Upgrade WebKitGTK to 2.26.2-1~deb10+1 (DSA-4558-1, DSA-4563-1).
12706 - Remove TorBirdy (Closes: #17219, #17269).
12707 - Use keys.openpgp.org's Onion service as the default keyserver
12708 (Closes: #12689, #14770).
12709 - Fix ordering of GTK bookmarks setup vs. Tor Browser directories
12710 creation (Closes: #17206).
12711 - Bring back the "Show Passphrase" button in the Greeter
12713 - Bring back "Open in Terminal" entry in the GNOME Files context menu
12715 - Revert "Browsers: disable the Quantum Bar." (Closes: #17143).
12716 - Revert "Hide all Tor connection-related settings in
12717 about:preferences in all browsers" (Closes: #17214).
12718 - Wait until Tor has bootstrapped before we try to upgrade Additional
12719 Software (Closes: #17203).
12720 - Fix the "GDM failed to start" splash screen functionality
12723 * Minor improvements and updates
12724 - htpdate: stop sending User-Agent that fakes Tor Browser
12726 - HTP: replace encrypted.google.com with www.google.com.
12727 - Remove signal handler from Greeter UI file (Closes: #17240).
12728 - Upgrade AMD microcode to 3.20191021.1.
12729 - Upgrade fonts-noto-cjk to 1:20170601+repack1-3+deb10u1
12733 - Update Vagrant box to Buster (Closes: #16868).
12734 - Adjust to timedatectl's output on Buster.
12735 - Adjust to Buster's debootstrap.
12736 - Vagrant: ensure the chroot has a /proc filesystem while running
12738 - Vagrant: install po4a from Stretch in the basebox.
12739 - build-tails: wait for NTP to be disabled before setting the desired
12741 - Bump APT snapshot of the Debian archive to 2019111801, including the
12742 10.2 point release of Buster (Closes: #17124, #17021).
12743 - Install virtualbox 6.0.12-dfsg-1 from our custom APT repository
12747 - Ensure we don't break tests by opening the Applications menu in
12748 post_vm_start_hook (Closes: #17164).
12749 - Improve GnuPG testing (Closes: #12689):
12750 · Switch to using sajolida's key.
12751 · Start adjusting for keys.openpgp.org.
12752 · Make the "GnuPG's dirmngr uses the configured keyserver" step
12753 actually test what it is meant to.
12754 · Make error strings better reflect what failure they are about.
12755 · Ensure dirmngr uses IPv4 since our CI runs on an IPv4-only
12757 - Ensure dirmngr picks up the changes we make to its configuration.
12758 - Switch backend keyservers (Closes: #14770).
12759 - Don't leave redir(1) processes behind (Closes: #14948).
12760 - Update image for Buster (Closes: #14770).
12761 - Update fragility status of Seahorse scenarios.
12762 - Avoid multiple instances of tcpdump writing to the same file,
12763 resulting in an unparsable network capture (Closes: #17102).
12764 - Update for Thunderbird 68 (Closes: #17269).
12767 - Remove or adapt mentions to Tails Installer as only installation
12768 method (Closes: #17204).
12769 - Add a warning about which Tails to run rsync from (Closes: #17197).
12771 -- Tails developers <tails@boum.org> Mon, 02 Dec 2019 22:23:35 +0100
12773 tails (4.0) unstable; urgency=medium
12776 - Upgrade Tor Browser to 9.0-build2, based on Firefox ESR 68.2.
12779 - Upgrade IBus to 1.5.19-4+deb10u1.0tails1 (Closes: #17144)
12780 - Upgrade sudo to 1.8.27-1+deb10u1
12783 - Fix regressions brought by the integration of Tor Browser 9.0:
12784 · Fix non-English spellchecking (Closes: #17150)
12785 · Unsafe Browser: don't enable private browsing mode, don't display
12786 Tor Browser icons, hide the new "New identity" toolbar button
12788 · Hide all Tor connection-related settings in about:preferences
12790 - Fix Stealth Onion services in OnionShare (Closes: #17162)
12791 - Upgrade OpenSSL to 1.1.1d-0+deb10u2
12793 * Minor improvements and updates
12794 - Don't include the locales package (Closes: #17132)
12795 - Update htpdate's User-Agent to match Tor Browser 9.0's
12798 - Only partially fill memory for userspace processes (Closes: #17104)
12799 - Drop the "Unsafe Browser has no proxy configured" step, that's hard
12800 to update and adds little value
12801 - Various updates for Tor Browser 9.0 final
12802 - Make the "SSH is using the default SocksPort" scenario more robust
12805 -- Tails developers <tails@boum.org> Mon, 21 Oct 2019 10:24:56 +0000
12807 tails (4.0~rc1) unstable; urgency=medium
12810 - Update Tor Browser to 9.0a7, based on Firefox ESR 68 (#16356).
12811 - Include a working version of Electrum: 3.3.8-0.1 (Closes: #16421).
12813 · Remove the obsolete "coin_chooser: Privacy" option (Closes: #15483).
12814 · Disable the update check (Closes: #15483).
12815 - Curate the list of languages in Tails Greeter (Closes: #16095).
12816 Only include languages which meet one of these conditions:
12817 · Have a PO file in tails.git (i.e. have at least one translated
12818 and reviewed string)
12819 · Are on our list of tier-1 supported languages.
12820 - Update Linux to 5.3.2-1~exp1 from Debian experimental (Closes: #17117).
12821 - Bump APT snapshots of the 'debian' and 'torproject' archives
12822 to 2019100904. This includes the update to the Buster 10.1
12826 - Drop NoScript customization that makes our web fingerprint diverge
12827 from Tor Browser's (related to #5362).
12828 - Enable Buster security APT sources (Closes: #17119).
12829 - Upgrade CUPS to 2.2.10-6+deb10u1 (CVE-2019-8696, CVE-2019-8675,
12830 and more security fixes).
12831 - Update GnuPG to 2.2.12-1+deb10u1, which mitigates the certificates
12833 - Update e2fsprogs to 1.44.5-1+deb10u2 (DSA-4535-1).
12834 - Update ghostscript to 9.27~dfsg-2+deb10u2 (DSA-4518-1, DSA-4499-1).
12835 - Update WebKitGTK to 2.24.4-1~deb10u1 (DSA-4515-1).
12836 - Update Pango to 1.42.4-7~deb10u1 (DSA-4496-1).
12837 - Update ffmpeg to 7:4.1.4-1~deb10u1 (DSA-4502-1).
12838 - Update expat to 2.2.6-2+deb10u1 (DSA-4530-1).
12839 - Update GLib to 2.58.3-2+deb10u1 (CVE-2019-13012).
12840 - Update libmariadb3 to 1:10.3.17-0+deb10u1 (various vulnerabilities).
12841 - Update NSS to 2:3.42.1-1+deb10u1 (CVE-2019-11719, CVE-2019-11727,
12843 - Update LibreOffice to 1:6.1.5-3+deb10u4 (DSA-4519-1, DSA-4501-1,
12844 DSA-4483-1, and CVE-2019-9848).
12845 - Update Samba to 2:4.9.5+dfsg-5+deb10u1 (DSA-4513-1).
12846 - Update OpenSSL to 1.1.1d-0+deb10u1 (DSA-4539-1).
12847 - Update libxslt to 1.1.32-2.1~deb10u1 (CVE-2019-11068, CVE-2019-13117,
12849 - Update zeromq3 to 4.3.1-4+deb10u1 (DSA-4477-1).
12850 - Update patch to 2.7.6-3+deb10u1 (DSA-4489-1).
12851 - Update Thunderbird to 1:60.9.0-1~deb10u1 (DSA-4523-1, DSA-4482-1).
12852 - Update wpasupplicant to 2:2.7+git20190128+0c1e29f-6+deb10u1 (DSA-4538-1).
12855 - Ensure that tor-has-bootstrapped systemd units are stopped
12856 if tor@default.service stops; replace the tor-has-bootstrapped
12857 script with a tor_has_bootstrapped() function that checks the status
12858 of tails-tor-has-bootstrapped.target (Closes: #16664).
12859 - Fix MIME info data build reproducibility (Closes: #17023).
12860 - Fix missing GNOME bookmarks, by adding them earlier in the session
12861 login process (Closes: #17030).
12862 - Increase left dock width in GIMP's sessionrc (Closes: #16807).
12863 - Use hardware defaults for the touchpad click method (Closes: #17045).
12864 - Fix image thumbnails in GNOME Files (Closes: #17062).
12865 - Use the "intel" X.Org driver for Intel Iris Plus Graphics 640
12867 - Fix sdhci-pci support.
12868 - Honor the "Formats" settings chosen in the Greeter (Closes: #16806).
12869 - Fix administration password not being applied in some cases
12871 - Fix Greeter settings being applied when clicking "Cancel"
12873 - Fix bridge information not always shown when the user selects
12874 bridge mode in the Greeter.
12875 - Fix path in whisperback's debugging info (Closes: #17109).
12876 - Fix Tor Browser functionality that was broken when it was started
12877 by clicking a link in Thunderbird (Closes: #17105).
12878 - Fix WhisperBack that was broken due to an expired X.509 certificate:
12879 stop using TLS (we already have end-to-end encryption via OpenPGP,
12880 plus end-to-end encryption and remote peer authentication via
12881 Tor hidden services). Also, switch to a v3 Onion service (Closes #17110).
12882 - Install Stretch's po4a (0.47-2) from our custom APT repository:
12883 the upgrade to Buster's version will need more work and coordination
12885 - Fix hiding of the Add-ons manager in the Unsafe Browser hamburger menu.
12886 Regression introduced when we upgraded to Tor Browser based on Firefox
12888 - Mention USB images as a valid installation technique when trying
12889 to create a persistent volume on a device that can't have one
12892 * Minor improvements and updates
12893 - Add iPhone USB tethering support (Closes: #16180).
12894 - Install Enigmail from Buster (Closes: #16978).
12895 - Disable GDM debug logs (Closes: #17011).
12896 - Hide less common keyboard layouts in the Greeter (Closes: #17084).
12897 - Major refactoring and cleanup of Tails Greeter (Closes: #17098).
12898 - Use a localized page for the Greeter help window, if available
12900 - Separate Chinese into simplified and traditional scripts
12901 in the Greeter (Closes: #16094).
12902 - Allow the user to show the passphrase they're typing when creating
12903 a new persistent volume (Closes: #15102).
12904 - When saving persistence.conf or its backup, also run sync(1)
12905 on its parent directory (might help fix #10976).
12906 - Improve Tails Installer wording (Closes: #15564).
12907 - Update tor to 0.4.1.6-1~d10.buster+1.
12908 - Update VirtualBox guest drivers and tools to 6.0.12-dfsg-1.
12911 - SquashFS sort file: remove more noise.
12912 - Improve lint_po's UX (refs: #16864).
12913 - Import our pythonlib, previously included as a submodule (Closes: #16935).
12914 - Use a consistent, standard Python packages directory (Closes: #17082).
12917 - Make various steps more robust:
12918 · "all notifications are disappeared" (Closes: #17012)
12919 · "Additional Software is correctly configured for package"
12920 · "I unlock and mount this VeraCrypt file container
12921 with Unlock VeraCrypt Volumes"
12922 · "I open the Unsafe Browser proxy settings dialog"
12923 · starting apps via the GNOME Activities Overview (Closes: #13469)
12924 · "I start the Tor Browser in offline mode"
12925 - Handle Guestfs::Error exceptions.
12926 - Provide guidance to fix problematic situation.
12927 - Update various reference images for Buster.
12928 - Don't attempt to find fuzzy matches with Sikuli unless fuzzy image
12929 matching is enabled (Closes: #17029).
12930 - Dogtail'ify all interactions with gedit (Closes: #17028).
12931 - New test: ensure that no experimental APT suite is enabled
12932 for deb.torproject.org (Closes: #16931).
12933 - Remove dead IRC-related code and dependencies.
12934 - Take into account that Evince and Tor Browser's print-to-file dialogs
12935 are rendered in a subtly different manner.
12936 - Drop fragile tag for actual Tails bugs (#17007).
12937 - Drop compatibility code for Cucumber < 2.4.0 (Closes: #17083).
12938 - Fix regression in the Persistent browser bookmarks scenario
12941 -- Tails developers <tails@boum.org> Thu, 10 Oct 2019 11:23:53 +0000
12943 tails (4.0~beta2) unstable; urgency=medium
12945 * All changes included in Tails 3.16, see the corresponding changelog entry.
12948 - Upgrade tor to 0.4.1.5 (Closes: #16986).
12951 - Upgrade the Linux kernel to 5.2.0-2 (Closes: #16942).
12952 This mitigates the Spectre v1 swapgs vulnerability (CVE-2019-1125).
12953 Accordingly, aufs to aufs5.2 20190805.
12954 - Install enigmail from Bullseye (Closes: #16738).
12955 This fixes CVE-2019-12269.
12958 - tails-unblock-network: only sleep until all-net-blacklist.conf is gone,
12959 instead of unconditionally delaying the login process for 5 seconds
12961 - Terminate GDM's GNOME session after the amnesia user logs in,
12962 to free 200-300 MiB of memory (Closes: #12092).
12963 Temporarily enable GDM debug logs so we get enough information to fix
12964 any issue this might cause.
12965 - Make our KeePassXC wrapper translatable (Closes: #16952).
12966 - Adjust boot-time backports APT pinning for Buster.
12967 - Ensure we don't install unwanted packages even if they become
12968 "Priority: standard" again (Closes: #16949).
12969 - Move some GNOME apps to different menu categories (Closes: #16981).
12970 - Update HTP pools: replace boum.org (invalid certificate) with puscii.nl,
12971 replace www.myspace.com with myspace.com (the former redirects to
12973 - AppArmor: allow OnionShare to open URLs with Tor Browser (Closes: #16914).
12974 - Make file transfers with Spice reliable.
12976 * Minor improvements and updates
12977 - Greeter: improve formatting of printed exceptions.
12978 - Use the same icon for Tails Documentation in the Applications menu
12979 as on te Desktop (Closes: #16800).
12980 - Drop migration path from GnuPG persistent configuration created
12981 in the Tails 2.x era.
12982 - Remove various hacks that we don't need on Buster anymore.
12983 - Stop installing libcaribou-gtk3-module (Closes: #16757).
12984 - Stop installing python-cairo: mat2 does not use it anymore.
12985 - tails-unblock-network: have udev reload the databases it uses.
12986 This should avoid our fix for #16805 introducing regressions.
12989 - Bump APT snapshot of the 'debian' and 'torproject' archives
12991 - Import the Greeter codebase into tails.git (Closes: #16912).
12992 - Explicitly install gnome-shell to make the set of installed packages
12993 more deterministic (related to #16947).
12994 - Don't try to follow symlinks when normalizing timestamps on source files.
12995 - Add missing "set -u" to build-time hook.
12996 - Use consistent method to extract translatable strings from Glade files.
12997 - Create gdm-tails related files from the original GNOME files
12999 - Stop installing libimage-exiftool-perl explicitly: mat2 depends on it
13001 - Rakefile: disable compression when retrieving artifacts via scp.
13002 This makes this build step faster on systems that have SSH compression
13003 enabled by default.
13004 - import-translations: use tails-misc_release for tails.git's PO files
13005 (i.e. the Tails part of #16774).
13006 - Use squashfs-tools from sid (Closes: #16637).
13007 - Lower VM_MEMORY_BASE to 1536M.
13008 - Remove unneeded package cleanup (Closes: #16950).
13011 - New scenario: installing with GNOME Disks from a USB image
13013 - New scenarios: VeraCrypt PIM support (Closes: #15946).
13014 - Revert timeout bump that's not needed anymore.
13015 - Add a showing method on Dogtail objects.
13016 - VeraCrypt: ensure the temporary keyfile file is not garbage collected
13017 while we still need it.
13018 - Remote shell: print traceback to stderr so we can see it.
13019 - Install Dogtail from Bullseye and run it with Python 3 (Closes: #16976).
13020 This gives us UTF-8 support. Accordingly, drop anonym's "showingOnly"
13021 patch that was merged upstream, and port some test suite code to Dogtail,
13022 which we could not do before it got UTF-8 support.
13023 - Dogtail'ify some steps.
13024 - Make "^the Tor Browser shows the "([^"]+)" error$" step more robust
13026 - Make the "the support documentation page opens in Tor Browser" step more
13027 robust (Closes: #15321)
13028 - Remove a bunch of obsolete @fragile tags, update the reasons why
13029 the remaining ones are fragile, and add some missing @fragile tags.
13030 - Drop useless code based on wrong assumptions (refs: #13470).
13031 - Make the "I set an administration password" step more robust.
13033 -- Tails developers <tails@boum.org> Mon, 02 Sep 2019 19:55:24 +0000
13035 tails (4.0~beta1) unstable; urgency=medium
13038 - Upgrade to a snapshot of Debian 10 (Buster) from 2018-08-06.
13041 - Remove scribus completely (refs: 16290).
13042 - Remove LibreOffice Math (#16911).
13045 - Fix Electrum wrapper's persistence check (Closes: #16821).
13046 - Remove pre-generated Pidgin accounts (Closes: #16744).
13047 - Hide the security level button in the unsafe browser (Closes:
13049 - Only hide unlocked TailsData partitions from the boot device
13052 * Minor improvements and updates
13053 - Remove KeePassX and replace it with KeePassXC (Closes:
13054 #15297). As KeePassX was used around for a longer time, we don't
13055 need automatic upgrading cappability from old KeePass file
13056 format (Tails 2 times). The user can still import those old
13057 files, if they want to access it.
13058 - Ship a pre-compiled AppArmor policy to make boot faster (Closes:
13060 - Change the splash screen for Tails 4.0 (#16837). Add SVG source
13062 - Remove our predefined bookmarks and ship default upstream Tor
13063 Browser bookmarks instead (Closes: #15895).
13064 - Install bolt for improved Thunderbolt support (Closes: #5463).
13065 - Don't display the Home launcher on the desktop (Closes: #16799).
13066 Since the switch to the desktop-icons GNOME Shell extension, the
13067 nicer XDG-blah name ("Home" in English, translated in many
13068 languages) is not used to label this launcher anymore: instead,
13069 the name of the directory is displayed, in this case: "amnesia",
13070 which makes no sense to our users. Our other options to fix that
13071 are more costly and we've decided a while ago, when I proposed
13072 to remove the desktop icons, to keep them until they were too
13073 expensive to support. So this one goes: we have the Places menu
13075 - Add Files to favorite apps (Closes: #16799). This gives another
13076 entry point to the home folder, which partially mitigates any UX
13077 regression that might be caused by the previous changelog entry.
13078 - Explicitly install imagemagick. We ship it on purpose (see
13079 [[contribute/meetings/201707]]).
13081 * Drop obsolete optional MAT dependencies it isn't using any
13083 * Stop explicitly installing MAT dependencies. The package
13084 depends on those so we don't need to pull them ourselves.
13085 - Move translations from root-terminal.desktop.in into own PO
13086 files (Closes: #15335).
13087 - Drop obsolete live-boot patch: the bug it workarounds only
13088 happens with CONFIG_AUFS_DEBUG enabled. We disable
13089 CONFIG_AUFS_DEBUG in config/chroot_local-hooks/13-aufs and the
13090 Debian package did it as well (Refs: Debian#886329).
13091 - Rename /usr/share/amnesia to /usr/share/tails.
13092 - Drop APT pinning for non-existing live.debian.net, that we
13093 haven't used since 2010.
13094 - Don't install the cryptsetup initramfs integration and startup
13095 scripts (Closes: #16264). We probably only need the binaries.
13096 Not installing the initramfs integration will get rid of some
13098 - Don't install full-blown cryptsetup, take 2 (refs: #15690). We've
13099 stopped installing it (#16264) but this branch independently
13101 - Disable live-tools.service (Closes: #16324). This service is only
13102 useful to display the "Please remove the live-medium, close the
13103 tray (if any) and press ENTER to continue:" prompt on shutdown,
13104 that we don't want to display in Tails: shutdown and memory
13105 erasure should not require a confirmation once the user has
13106 triggered it. In Stretch this code was broken and we were
13107 relying on this. But the Buster upgrade of this code has
13108 repaired it, so I sometimes see that prompt. This might also
13109 explain some issues such as #16312.
13110 - AppArmor: allow cups-brf, driverless, and gutenprint53+usb
13111 printer backends (Closes: #15030). Technically, cups-brf and
13112 driverless are not third-party and should be confined more
13113 strictly with "ixr", under the cupsd profile. But I don't know
13114 how to to test these backends and confining them more strictly
13115 may break them. Anyway, that's an upstream matter: the purpose
13116 of our Tails-specific patch is to replace the third party
13117 backends /usr/lib/cups/backend/* catch all rule, that doesn't
13118 work for us, and not to keep the list of backends which come
13119 with CUPS up-to-date.
13120 - Make export_gnome_env() exit early if gnome-shell isn't running.
13121 Without this e.g. the automated test suite, which will call
13122 export_gnome_env() before gnome-shell is running, will have its
13123 journal polluted with errors about this. This is not the first
13124 time I see this and get worried and waste minutes investigating,
13125 so let's just fix it.
13128 - Bump VM_MEMORY_BASE to 2048M. With the previous 1024M setting,
13129 the squashfs preparation gets OOM-killed.
13130 - Limit the memory used by mksquashfs to 512M (Closes: #16177). By
13131 default mksquashfs will use 25% of the physical memory. So when
13132 we use the "ram" build option, build in a VM with 13GB of RAM,
13133 of which up to 12G is supposed to be used by the build tmpfs,
13134 mksquashfs will try using 13/4 = 3.25G of memory. And then it
13135 will get reaped by the OOM killer more or less occasionally
13136 depending on how much space is really used in the build tmpfs
13137 and how much memory the rest of the system is using. So let's
13138 limit the memory used by mksquashfs to 50% of the memory we
13139 allocate to the build VM, excluding the part of it that we
13140 expect tmpfs data to fill. In passing, the fact mksquashfs does
13141 not get killed every time suggests that our current
13142 BUILD_SPACE_REQUIREMENT value exceeds the real needs of a build:
13143 a value around 10 or 11G should be enough. But that will be for
13145 - Use xz with default settings to compress non-release SquashFS
13146 (refs: #16177). squashfs-tools 1:4.3-11, used to build
13147 feature/buster, does not consistently honor the value passed to
13148 -mem: the xz compressor does but at least the gzip and lzo ones
13149 don't. This makes the build often fail because mksquashfs gets
13150 reaped by the OOM-killer. Our only other option is currently to
13151 bump the build VM memory a lot, which is going to be painful on
13152 developers' systems and might not be an option on Jenkins. So
13153 let's fall back to xz with default settings (not the crazy slow
13154 but efficient we use at release time) when building non-release
13156 - Rename the "gzipcomp" build option to "fastcomp". What matters
13157 in the "user" interface is not the exact algorithm that's used,
13158 it's the fact it's supposed to be faster than the compression
13159 settings we use to build releases. We may have to changes these
13160 fast(er) settings occasionally, possibly to use a non-gzip
13161 algorithm. So let's keep supporting "gzipcomp" for backward
13162 compatibility but stop documenting it. Instead, support and
13163 document "fastcomp".
13164 - Add the vmproxy+extproxy build option. When enabled, use the
13165 vmproxy but configure it to in turn use the exproxy set via the
13166 http_proxy environment variable.
13167 - Support the case when we don't ship a custom AppArmor feature
13168 set. Let's keep this sanity check for the times when we do ship
13169 a custom feature set, but building an ISO without a custom one
13170 should remain supported. (Closes: #15149)
13171 - Don't remove packages whose deinstallation removes most of the
13172 system; don't explicitly remove packages that are taken care of
13173 by "apt-get autoremove" already. On Buster, removing dpkg-dev
13174 or make deinstalls python3, gnome-shell and more.
13175 - Install all "Priority: standard" packages via an explicit
13176 packages list instead of via --tasks (Closes: #15690). This will
13177 make it easier to remove some of these packages from the list of
13178 those that should be installed in the first place, as opposed to
13179 letting them be installed by tasksel only to uninstall them
13180 later. I've seeded tails-000-standard.list with the output of:
13181 tasksel --task-packages standard | sort … run on a clean Buster
13183 * live-build forcibly translates --packages-lists="standard"
13184 into "tasksel install standard", so to make this change
13185 effective we also need to switch to "--packages-lists
13186 minimal" or "--packages-lists none". The former has
13187 problematic side-effects so let's use the latter.
13188 * Add to tails-common.list some of the packages that were
13189 previously installed automatically, e.g. via live-build's
13190 lists/standard → lists/minimal.
13193 - Tons of tiny updates for the Stretch → Buster transition, mainly
13194 updated reference images, but also a few other trivial changes
13195 (e.g. close with Alt+F4 instead of menu, or vice versa) due to
13196 changes in applications.
13197 - Drop test case about migrating from a Jessie-area persistent
13198 volume. If our code happens to support Tails 2.x → 4.x upgrades
13199 without going through 3.x, fine. But let's not spend cycles in
13200 our CI to guarantee this.
13201 - Revert "Test suite: add backward compatibility with redir <
13202 3.0." We don't support running the test suite on Jessie anymore.
13203 - Adjust dhclient listening address for Buster.
13204 - Bump timeout for poweroff from 3 to 10 minutes (Refs: #16312).
13205 - Adjust dogtail patterns for gobby test (Closes: #16335). With the
13206 gobby upgrade from 0.5.0 to 0.6.0 pre-series, the case changed a
13207 little for a menu item and the window it leads to.
13208 - Update key shortcut to close seahorse's Preferences window
13209 (Closes: #16341). The “Close” button is gone from the
13210 Preferences window in the buster version of the seahorse
13211 package, making it impossible to close that window. Switch to
13212 sending ESC instead of Alt-C.
13213 - Update MAT test case for MAT2 (Closes: #16623).
13214 - Add debug logging for when we call Sikuli. When following a
13215 (debug) log live (through `--format debug`) I find this change
13216 useful to know what is going on *right now* since Sikuli only
13217 reports what it has done after it is done.
13218 - Be more careful when finding ASP notifications. For some reason
13219 both the label and button has a "weird" invisible (despite
13220 `showingOnly`) twin located just below the Applications
13221 menu. So let's make some extra effort to actually find the real
13222 notification, and then look for the label and button among its
13224 - Remove obsolete method. Display::take_screenshot() hasn't
13226 - Remove workaround "Desktop icons are sometimes not shown" (Refs:
13228 - Wait longer between search steps in the GNOME Overview. On
13229 jenkins.lizard — which was under high load at that time — I've
13230 seen failures while starting GNOME Terminal from the Overview,
13232 - The debug log claims we did type "c", waited 1 second, then
13233 typed "ommandline", then slept another 1 second, then pressed
13234 Enter. I.e. just as the code says.
13235 - The video shows that GNOME Shell did pick up "c", which
13236 selected the first search result ("Configure Persistent
13237 Volume"), but then there's no trace of typing "ommandline".
13238 So I suspect that "ommandline" was lost because GNOME Shell
13239 was still busy, somehow. Let's sleep a bit longer before
13240 these steps, to give GNOME Shell a better chance to recover
13241 and notice keyboard input.
13242 - Log exceptions thrown in generated (i.e. snapshot) steps (Refs:
13243 #16747). Hopefully this will help us track down these elusive
13245 - Extend waiting time for additional software to be installed.
13246 - Sometimes we need more more time to load a page over tor.
13247 - Remove useless TailsUpgraderApplyingUpgrade.png. The "progress
13248 prompt" it was used for just flashes by and can easily be
13249 missed. There is no reason at all to wait for it since the only
13250 two final outcomes are success or failure, which we already look
13252 - debug_log() when we save/restore snapshots. These actions can
13253 take a long time (especially saving snapshots on a system under
13254 load) and can make it appear like if the test suite has gotten
13255 stuck for those following the debug log.
13256 - Don't rely on mtimes from Debian packages we download, to
13257 indicate which one has the biggest version (Closes: #16819).
13258 These mtimes are copied from the HTTP server where APT downloads
13259 packages from, which contradicts our assumption that the newest
13260 file must be the one with the biggest version. Instead we use ls
13261 to sort by version number, to pick the biggest version.
13262 - Only send TAB every second to get the syslinux kernel
13263 command-line (Closes: #16820). Our syslinux has a timeout of 5s so
13264 sending TAB every second should be enough to guarantee we do
13265 open the kernel command line. As anonym reported, "the spammer
13266 makes the splash show for significantly longer: I've seen >10x,
13267 so the boot splash never managed to appear, which is worrying".
13268 - Drop workaround to make the TAB spammer compatible with the UEFI
13269 firmware (Closes: #16820). As reported by anonym on #16820, and
13270 confirmed by my testing, pressing TAB doesn't seem to open the
13271 UEFI configuration, so the very reason why we had this
13272 workaround is gone.
13274 * Adjustments for Debian 10 (Buster) with no or very little user-visible impact
13275 - Adjust APT sources and pinning for Buster.
13276 - Refresh and unfuzzy patches for Buster.
13277 - Pass --ellipsize to zenity (refs: #16286). This fixes dialog
13278 width and height on Buster.
13279 - Update expected /etc/passwd and /etc/group for Buster.
13280 - Display TopIcons systray on the left of the system menu (Refs:
13282 - Remove apparmor-adjust-freedesktop-abstraction.diff patch,
13283 merged upstream in apparmor. The
13284 9d8b6f4dbd8a04470490ae2bfd52044906abd7f6 commit (first appeared
13285 upstream in apparmor v2.13.1) implements this change in a
13287 - Adjust hook to the fact the Dovecot AppArmor profiles are not
13288 shipped in /etc anymore.
13289 - Import iuk.git's feature/buster branch at commit 919335e
13291 - Enable desktop-icons gnome-shell extension (Closes: #16283).
13292 - Add autostart script to have gnome-shell trust desktop icons
13293 (Closes: #16283). Various conditions must be met for gnome-shell
13294 to make desktop icons launchable, including file
13295 permissions. But the GIO metadata::trusted setting is also
13296 needed, and can apparently only be set from an opened session,
13297 so let's set the right things with an autostart script.
13298 - Drop code that sets the cursor to "WATCH" (hourglass) after
13299 logging in (Closes: #16305) This fixes "GDM's GNOME Shell floods
13300 the Journal with XFIXES/cursor issues on Buster" by importing
13301 the relevant bits of greeter:feature/buster's commit abad17b6.
13302 - Remove 8 development packages that are not part of Tails 3.11 so
13303 we probably don't need to ship them in Tails 4.0 either (Closes:
13305 - Completely get rid of Qt4 (Closes: #15182).
13306 - SSH client: remove obsolete CompressionLevel setting (Closes:
13308 - Removing /usr/share/live/config/xserver-xorg/intel.ids (Closes:
13309 #14991). Let's hope the graphics hardware issues we fixed via
13310 that file is fixed no.
13311 - Adjust Onion Grater and AppArmor configuration for OnionShare
13312 1.3 (Closes: #16306).
13313 - Have OnionShare 1.3 connect to the system Tor via Onion Grater
13314 for the control port (Closes: #16306). By default, OnionShare
13315 1.3 will start its own tor process, which can't possibly work on
13317 - Don't install binutils-* (Closes: #16272). It wasn't in Tails 3.x
13318 and we have no reason to ship it in 4.0.
13319 - Install mat2 instead of the transitional mat package.
13320 - Don't suspend automatically (Closes: #16624)
13321 - tails-additional-software: Adjust arguments to
13322 tails-persistence-setup (Closes: #16622). It seems like the perl
13323 library which previously nicely handled the tps command-line
13324 arguments now doesn't support taking dashes instead of
13325 underscores anymore.
13326 - Start tails-unblock-network in a blocking way (Closes: #16620)
13327 This reverts commit 59e99c51f15ab9e756e287acb03b4d3a91ca1dd2 in
13328 greeter.git. NetworkManager starting at the same time as GNOME
13329 Shell makes things racy: the Wi-Fi password prompt is sometimes
13330 not displayed (unreproduce on Debian Buster Live).
13331 - Patch ibus to fix an issue that prevented the on-screen keyboard
13332 from displaying in Tails Greeter (Closes: #16291).
13333 - oniongrater: give onioncircuits empty STATUS_SERVER events.
13334 Connection to STATUS_SERVER events is required by stem 1.7
13335 connect() function, but we actually don't need them, so let's
13336 suppress them (Closes: #16626).
13337 - Fix GNOME bookmarks file for Buster (Closes: #16629).
13338 - Build VeraCrypt packages with our patches applied for Buster
13340 - Avoid new "render" group stealing a GID we have already
13341 statically allocated to another group (Closes: #16649) With the
13342 systemd 241-1~bpo9+1 → 241-3~bpo9+1 upgrade, udev.postinst now
13343 creates a "render" system group, which shifts GIDs and makes our
13344 devel branch FTBFS.
13345 - update-acng-config: add support for 4.x and 5.x, drop 2.x. We
13346 won't build 2.x releases anymore but we'll start building 4.x
13347 from this branch soon.
13348 - Restore Plymouth theme to "text" (Closes: #16743). The default
13349 theme in Buster ("futureprototype") is Debian-branded and thus
13350 unsuitable for Tails. Let's revert to the one we use in Tails
13352 - Stop installing caribou and libcaribou*: they're not used by
13353 GNOME Shell in Buster anymore (Closes: #16628)
13354 - Allow read access to /etc/machine-id in the AppArmor profile for
13355 Thunderbird (Closes: #16756). It breaks access to the D-Bus
13356 service where the GNOME on-screen keyboard listens on Buster.
13357 - Fix screen locker not working in Buster (Closes: #16763).
13358 - Hide lstopo in the Applications menu (Closes: #16797). It's
13359 pulled as a dependency by aircrack-ng but is probably not useful
13360 to the vast majority of Tails users.
13361 - Hide nm-connection-editor in the Applications menu (Closes:
13362 #16798). We still need the network-manager-gnome package that
13363 installs this .desktop file (for details, see
13364 commit:40290be3651eaa6f08346231aef80eddd8b33c64), but there's no
13365 reason to expose it directly to users.
13366 - TorStatus: call our custom destructor to avoid a use-after-free
13367 crashing GNOME Shell (Closes: #16791). It was ported to an ES6
13368 class in the process.
13369 - Copy dmidecode to initramfs (Closes: #16857). On Buster,
13370 partprobe complains if dmidecode is missing. It's not clear what
13371 the consequences are, at least it doesn't cause partprobe to
13372 exit with an error status code - but it's cheap to just copy
13373 dmidecode to the initramfs.
13374 - Adjust path for webext-ublock-origin 1.19.0+dfsg-2 (Closes:
13376 - Update Tor Browser AppArmor profile to take into account new
13377 uBlock installation path (Closes: #16858).
13378 - Disable the uBlock logger sidebar. This brings back
13379 the hack we had before we removed it in #16206. Without this,
13380 the uBlock logger sidebar is displayed.
13381 - Reintroduce the same APT pinning as we use in 3.x for uBlock.
13382 Granted, the version from Buster should probably be sufficient
13383 right now, but it probably won't be once Tor Browser gets
13384 updated to a future major Firefox ESR. And in the meantime,
13385 this pinning discrepancy between devel and feature/buster makes
13386 it harder to maintain our patch against
13387 /usr/share/webext/ublock-origin/js/background.js.
13388 - Drop obsolete libdesktop-notify-perl patches: they were merged
13390 - Use X.Org in amnesia's GNOME session (Closes: #12213). Since a
13391 few months gdm3 defaults to Wayland in Debian testing/sid, just
13392 like upstream. But we're not ready yet.
13393 - Adjust Greeter's gdm-tails.session for Buster (Closes:
13394 #12551). This should ultimately be applied in greeter.git, but
13395 let's deal with it as a patch for now to avoid having to
13396 maintain two parallel branches of the Greeter.
13397 - Patch udisks2 and libblockdev and fix Tails Installer to repair
13398 USB boot on Buster (Closes: #14809).
13399 - Install gnome-user-docs directly instead of the gnome-user-guide
13400 transitional package.
13401 - Install the "crypto" libblockdev plugin (Closes: #14816). It's
13402 needed by recent udisks to do crypto operations.
13403 - Use ConditionUser=1000 instead of manually testing the output of
13404 `id -u' in some of our systemd services.
13405 - Have debootstrap install gnupg when setting up the chroot.
13406 Otherwise the build fails after debootstrap has done its job and
13407 live-build tries to use apt-key.
13408 - Don't try to install the obsolete gnome-search-tool package.
13409 It's been removed from testing/sid by its maintainers:
13410 https://bugs.debian.org/885975
13411 - Don't try to retrieve syslinux.exe from the syslinux source
13412 package. Since syslinux 3:6.03+dfsg1-1 this file is (rightfully)
13413 not included anymore in the Debian source package. This commit
13414 is meant to fix the feature/buster ISO build. We of course need
13415 to find a proper solution, which is what #15178 is about.
13416 - Drop our pinned AppArmor feature set (Closes: #15149). On current
13417 Buster the AppArmor package pins to the Linux 4.14.13-1 feature
13418 set and I expect it'll keep pinning something that should work
13419 with the policy shipped in Buster.
13420 - Drop Stretch-specific workaround. This essentially workarounds
13421 4f8b50afb10a1ce1faf7645971bc020d2eb5d7dd,
13422 3e2d8a6a025b86f8191d125783ad507c57171bad and
13423 d56633a3089e5b177e07c2888442745557772f42.
13424 - Disable the usr.bin.man AppArmor profile. On Buster it breaks
13425 apparmor.service due to "profile has merged rule with
13426 conflicting x modifiers" that's most likely caused by the "/**
13427 mrixwlk" rule vs. our tweaks for aufs support.
13428 - Import files (from gksu 2.0.2-9+b1) needed for the Root Terminal
13429 into Git instead of fetching the package and extracting them at
13431 - Use orca's current package name instead of pre-Buster
13433 - Stop explicitly installing gstreamer1.0-pulseaudio. This was
13434 needed on Jessie due to Debian#852870 which was fixed in
13436 - Drop adwaita-qt4: it was removed from Debian sid and won't be in
13438 - Disable man-db.timer on Buster (Closes: #16631)
13439 - Fix invalid seq range in update-acng-config so we geberate proper
13440 rules for Tails 4.x and 5.x.
13442 -- Tails developers <tails@boum.org> Wed, 07 Aug 2019 20:30:15 +0200
13444 tails (3.16) unstable; urgency=medium
13447 - Upgrade Tor Browser to 8.5.5 (Closes: #16692).
13450 - Install Linux kernel from the Buster security repository (Closes: #16970).
13451 The new Spectre v1 swapgs variant (CVE-2019-1125), which was fixed
13452 in sid via 5.2.x, which is a too big change for the Tails 3.16 bugfix
13453 release. Let's instead track Buster (+ security) for the time being.
13454 - Upgrade LibreOffice to 1:5.2.7-1+deb9u10 (DSA-4483-1, DSA-4501-1).
13455 - Upgrade Thunderbird to 60.8 (DSA-4482-1).
13456 - Upgrade Ghostscript to 9.26a~dfsg-0+deb9u4 (DSA-4499-1).
13457 - Upgrade Patch to 2.7.5-1+deb9u2 (DSA-4489-1).
13458 - Upgrade nghttp2 library to 1.18.1-1+deb9u1 (DSA-4511-1).
13461 - Additional software: Improve/fix support for translations (Closes: #16601).
13462 - Rework the implementation for hiding TailsData partitions (Closes: #16789).
13463 - Adjust how tordate determines whether the clock is in a valid range,
13464 fixing issues with obfs4 (Closes: #16972).
13466 * Minor improvements and updates
13467 - Ship default upstream Tor Browser bookmarks, and remove our predefined
13468 bookmarks (Closes: #15895).
13469 - Hide the security level button in the unsafe browser (Closes: #16735).
13470 - Remove pre-generated Pidgin accounts (Closes: #16744).
13471 - Remove LibreOffice Math (Closes: #16911).
13472 - Website: Make sandbox page translatable (Closes: #16873).
13473 - Website: Only scrub HTML on blueprints (Closes: #16901).
13474 - Website: Point history & diff URLs to Salsa.
13477 - Bump APT snapshot of the torproject archive to 2019073103, and drop
13478 tor-experimental-0.4.0.x-stretch reference (Closes: #16883).
13479 - Bump APT snapshot of the Debian archive to 2019080801 to get fixed
13480 firmware packages from sid instead of sticking to those from
13481 stretch-backports (Closes: #16728).
13482 - Enable the buster APT repository and install some packages from there:
13483 hunspell-id, hunspell-tr, and fonts-noto-* (See: #16728).
13484 - Refresh patch for webext-ublock-origin 1.19.0+dfsg-2, and adjust Tor
13485 Browser AppArmor profile accordingly (Closes: #16858).
13486 - Refresh Tor Browser AppArmor profile patch for torbrowser-launcher
13487 0.3.2-1 (Closes: #16941).
13490 - Ignore RARP packets, since PacketFu cannot parse them (Closes: #16825).
13491 - Adjust both locale handling and reference pictures for the Unsafe
13492 Browser homepage (Closes: #17004).
13493 - Fix "Watching a WebM video over HTTPS" scenario on Jenkins
13495 - Tag "Watching a WebM video" as fragile.
13496 - Make @check_tor_leaks more verbose (See: #10442).
13497 - Remove broken Electrum scenario since Electrum support is currently
13498 missing (Closes: #16421).
13500 -- Tails developers <tails@boum.org> Tue, 03 Sep 2019 20:30:14 +0200
13502 tails (3.15) unstable; urgency=medium
13505 - Upgrade Tor Browser to 8.5.4 (Closes: #16691).
13506 - Upgrade Thunderbird to 60.7.2 (Closes: #16834).
13509 - Upgrade Expat to 2.2.0-2+deb9u2 (DSA-4472-1).
13510 - Upgrade OpenSSL 1.0 to 1.0.2s-1~deb9u1 (DSA-4475-1).
13511 - Upgrade OpenSSL to 1.1.0k-1~deb9u1 (DSA-4475-1).
13512 - Upgrade Vim to 2:8.0.0197-4+deb9u3 (DSA-4467-1).
13515 - Recompute CHS values for the hybrid MBR after first-boot
13516 repartitioning (Closes: #16389). Some legacy BIOS systems won't boot
13518 - Strip debug symbols from the aufs kernel module smaller (refs: #16818).
13519 The primary target was getting the initramfs down under 32MB, hoping
13520 to repair boot of feature/buster on MacBookPro 8,1. In any cases,
13521 the user experience should be improved due to a faster boot for
13522 every user, and a shortened “black screen” duration (between the
13523 bootloader and the Plymouth splash screen).
13525 * Minor improvements and updates
13526 - Make “Unlock VeraCrypt Volumes” show an error message if locking
13527 fails (Closes: #15794).
13528 - Add support for booting Tails from a read only sdcard (fromiso),
13529 through Heads, allowing for measured boot on some tamper-evident
13530 hardware (https://github.com/osresearch/heads/issues/581).
13533 - Patch Thunderbird packages from Debian when building Tails images
13535 - Improve tooling to maintain and update PO files (Closes: #15403),
13536 rewriting some tools and moving code to the jenkins-tools submodule.
13537 - Implement preliminary steps needed to make the ikiwiki PO plugin
13538 able to update PO files for languages that are disabled on the
13539 website (refs: #15355).
13541 -- Tails developers <tails@boum.org> Tue, 09 Jul 2019 02:50:09 +0200
13543 tails (3.14.2) unstable; urgency=medium
13546 - Upgrade Tor Browser to 8.5.3 (Closes: #16835).
13549 - tails-screen-locker: Don't use dim-label style class
13552 -- Tails developers <tails@boum.org> Sun, 23 Jun 2019 11:52:49 +0200
13554 tails (3.14.1) unstable; urgency=medium
13557 - Upgrade Tor Browser to 8.5.2-build1 (Closes: #16824).
13558 - Upgrade Thunderbird to 60.7.0 (Closes: #16742).
13559 - Upgraded Linux to 4.19.37-4 (Closes: #16823).
13562 - Only probe for partitions on the boot device when setting up
13563 TailsData. Without arguments partprobe will scan all devices,
13564 and if it encounters a device it doesn't support (e.g. fake
13565 raid-0 arrays) it will return non-zero, thus aborting Tails'
13566 partitioning script, resulting in an unbootable install
13569 * Minor improvements and updates
13570 - Upgrade tor to 0.4.0.5-1~d90.stretch+1, the first stable
13571 candidate in the 0.4.0.x series (Closes: #16687).
13572 - Completely disable IPv6 except for the loopback interface. We
13573 attempt to completely block it on the netfilter level but we
13574 have seen ICMPv6 "leaks" any way (related to Router
13575 Solicitation, see: #16148) so let's just disable it. We keep
13576 enabled on the loopback interface since some services depends on
13578 - create-usb-image-from-iso: Use syslinux from chroot. We used the
13579 syslinux from the vagrant box before, which caused issues with
13580 when building Tails/Buster with a Stretch vagrant box and then
13581 cloning the image via Tails Installer with syslinux from Buster
13583 - Set Tor Browser's homepage to https://tails.boum.org/home/testing/
13584 if building anything but a stable release. This page explains the
13585 dangers of using a non-stable release. (Closes: #12003)
13588 - auto/{build,config}:
13589 * consistently use fatal() to error out, and prefix its message
13590 with "E: " to help distinguish them from the noise produced by
13592 * Similarly, also prefix informational message with "I: ".
13593 * drop support for GnuPG 1.x.
13594 * clone more build output to the log file.
13595 * Drop obsolete check for syslinux version. This version
13596 requirement is satisfied by Jessie and it is doubtful Tails
13597 would build in anything older.
13598 * auto/build: drop a few checks for conditions that are already
13599 satisfied in the supported build environments.
13600 - Revert "Build system: try to be smart again by fetching only the
13601 refs we need." This optimization overrides the trick we have on
13602 Jenkins (set_origin_base_branch_head in
13603 jenkins-jobs:macros/builders.yaml),
13604 that ensures that a reproducibly_build_Tails_ISO_* job builds
13605 from the commit used by the first build. (Closes: #16730)
13608 - Fix mistake with execute() vs spawn() when starting the upgrader.
13609 - Don't filter during pcap capture, instead let's just apply the
13610 same filtering when we are inspecting the pcap files. This way
13611 any pcap file saved on failure will include the full capture,
13612 and not just the packets sent by the system under testing, which
13613 sometimes makes it hard to understand what is going on.
13614 - Also include the content of /var/log/tor/log in $scenario.tor
13615 when tor failed to bootstrap (refs: #16793)
13616 - Don't flood the debug logger with tor@default's journal
13618 - Power off system under testing after scenario. Until now we have
13619 relied on either one of the generated "snapshot restore" steps
13620 or the "[Given] a computer" step to implicitly stop the old VM
13621 when we move on to a new scenario. That meant the old VM was
13622 still running during the new scenarios @Before@ hooks. If the
13623 new scenario is tagged @check_tor_leaks that means we start its
13624 sniffer while the old VM is still running, possibly sending
13625 packets that then affect the new scenario. That would explain
13626 some myserious "Unexpected connections were made" failures we
13627 have seen (Closes: #11521).
13628 - Only accept IP(v6)/ARP during DHCP check.
13630 -- Tails developers <tails@boum.org> Wed, 19 Jun 2019 15:29:07 +0200
13632 tails (3.14) unstable; urgency=medium
13635 - Upgrade Linux to 4.19.0-5 from sid (Closes: #16708).
13636 - Enable all available mitigations for the Microarchitectural Data
13637 Sampling (MDS) attacks and disable SMT on vulnerable CPUs
13639 - Upgrade Tor Browser to 8.5 (Closes: #16337, #16706).
13642 - Install Electrum 3.2.3-1 from our custom APT repository (Closes: #16708).
13643 The version in sid now displays a warning and exits, while 3.2.3-1 is
13644 still usable, in the rare cases when it manages to connect to the
13645 network, despite being affected by problematic phishing attacks which
13646 will only be solved once the package in Debian is updated to a newer
13650 - Bump APT snapshot of the 'debian' archive to 2019051601, needed for
13651 the MDS mitigations.
13652 - Don't install the firmware-linux and firmware-linux-nonfree
13653 metapackages, as packages they pulled are already listed explicitly
13654 and one might run into version-related issues (Closes: #16708).
13656 * Minor improvements and updates
13657 - Remove some packages from the Tails image as their use is not
13658 widespread while consuming space for everyone. They can still be
13659 installed and upgraded through Additional Software (Closes: #15291).
13660 This includes: monkeysphere and msva-perl, gobby, hopenpgp-tools,
13661 keyringer, libgfshare-bin, monkeysign, paperkey, pitivi,
13662 pdf-redact-tools, pwgen, traverso, and ssss.
13663 - Fix missing translations in the Greeter (Closes: #13438).
13664 - Fix missing newline in unlock-veracrypt-volumes (Closes: #16696).
13665 - Port fillram to Python 3 (Closes: #15845).
13666 - Enable localization for new locales introduced in Tor Browser 8.5
13668 - Re-introduce TopIcons GNOME Shell extension (Closes: #16709).
13669 - Improve internationalization of the Unlock VeraCrypt Volumes
13670 component (Closes: #16602).
13673 - Make tails-security-check's SOCKS port test work when there's a live
13674 security advisory (Closes: #16701).
13675 - Make terminology more consistent.
13677 -- Tails developers <tails@boum.org> Mon, 20 May 2019 18:52:04 +0200
13679 tails (3.13.2) unstable; urgency=medium
13682 - Replace all locale-specific fonts and standard X.Org fonts with
13683 the Noto fonts collection (Closes: #9956).
13684 - Install localization support packages for all tier-1 supported languages,
13685 and only those (Closes: #15807). Current tier-1 supported languages are:
13686 Arabic, German, English, Spanish, Farsi, French, Italian, Portuguese
13687 (Brazil), Russian, Turkish, Simplified Chinese, Hindi, Indonesian.
13688 - Disable the TopIcons GNOME Shell extension (Closes: #16608).
13689 This extension causes crashes (#11188), does not work on Wayland
13690 (#8309, #12213) so long-term, we need to remove it anyway.
13691 In order to learn how much our users rely on this extension and
13692 on OpenPGP Applet, let's disable this extension for one Tails release.
13693 While TopIcons is disabled (by default):
13694 · Users can still use OpenPGP Applet via the system tray in the bottom
13695 left corner of the desktop.
13696 · Users who do need TopIcons for other reasons can enable it again
13697 with 1 command line.
13700 - Upgrade Tor Browser to 8.0.9 (Closes: #16694).
13701 - Upgrade to Debian Stretch 9.9 (Closes: #16670).
13702 - Upgrade Thunderbird to 60.6.1 (Closes: #16641).
13705 - Fix Thunderbird account setup wizard (Closes: #16573).
13706 - Display poweroff and reboot buttons even when locked (Closes: #15640).
13707 - Disable emergency shutdown during suspend (Closes: #11729).
13708 - Provide feedback while starting Onion Circuits (Closes: #16350).
13709 - Associate .key files with Seahorse (Closes: #15213).
13710 This partially fixes importing OpenPGP keys from GNOME Files.
13711 - Don't show spurious notification about "TailsData" while setting
13712 up a persistent volume (Closes: #16632).
13714 * Minor improvements and updates
13715 - Add a suspend button to status-menu-helper (Closes: #14556).
13716 - status-menu-helper: clean up and refactor.
13717 - Drop CSS hacks for the uBlock log window (Closes: #16206).
13718 - Polish 04-change-gids-and-uids code style (Closes: #16322).
13719 - Create persistence.conf backup in a more robust manner (Closes: #16568).
13720 - Make the WhisperBack .desktop file translatable in Transifex
13724 - Don't fail the build if Tor Browser supports new locales that we don't ship
13725 a spellchecking dictionary for (#15807).
13726 - Fix apt-cacher-ng cache shrinking (Closes: #16020).
13727 - Remove obsolete usr.bin.onioncircuits AppArmor profile (Closes: #12170).
13728 All Tails current branches now install onioncircuits 0.6-0.0tails1,
13729 which ships a more current AppArmor profile than the one we
13730 have in our own Git tree.
13731 - Install Electrum from sid (Closes: #16642).
13732 - Avoid new "render" group stealing a GID we have already statically
13733 allocated to another group (Closes: #16649).
13736 - Disable tests about notifications in case of MAC spoofing failure:
13737 we have a well-known bug here and these tests do nothing but confirm
13738 it again and again, which brings no value and has a cost (#10774).
13739 - Clarify what WebM scenarios are fragile (#10442).
13740 - Avoid zombies by waiting for killed child processes to exit (#14948).
13742 -- Tails developers <tails@boum.org> Sun, 05 May 2019 19:32:22 +0000
13744 tails (3.13.1) unstable; urgency=medium
13747 - Upgrade Tor Browser to 8.0.8 (Closes: #16606, MFSA-2019-10).
13748 - Upgrade NTFS-3G to 1:2016.2.22AR.1+dfsg-1+deb9u1 (DSA-4413-1).
13750 -- Tails developers <tails@boum.org> Fri, 22 Mar 2019 20:54:03 +0000
13752 tails (3.13) unstable; urgency=medium
13755 - Upgrade Linux to 4.19.28-1 (Closes: #16390, #16469, #16552).
13756 - Upgrade Tor Browser to 8.0.7 (Closes: #16559).
13757 - Upgrade Thunderbird to 65.1.0 (Closes: #16422).
13760 - Upgrade LDB to 2:1.1.27-1+deb9u1 (DSA-4397-1).
13761 - Upgrade OpenJPEG to 2.1.2-1.1+deb9u3 (DSA-4405-1).
13762 - Upgrade OpenSSL 1.0 to 1.0.2r-1~deb9u1 (DSA-4400-1).
13763 - Upgrade OpenSSH to 1:7.4p1-10+deb9u6 (DSA-4387-2).
13766 - Upgrade tor to 0.3.5.8-1~d90.stretch+1 (Closes: #16348).
13767 - Ensure Additional Software doesn't try to download packages that are
13768 in persistent cache (Closes: #15957).
13769 - Improve chances of recovering a lost persistence configuration
13771 - Tor Launcher: add langpacks to enable localization again
13773 - Migrate away from buggy Chinese input method: switch from ibus-pinyin
13774 to ibus-libpinyin + ibus-chewing (Closes: #11292).
13775 - Fix crash in Whisperback when additional persistent APT repositories
13776 are configured (Closes: #16563).
13777 - Give visual feedback while starting Whisperback (Closes: #16333).
13779 * Minor improvements and updates
13780 - Add feedback when opening VeraCrypt Mounter (Closes: #16334).
13781 - Improve consistency in Additional Software's accessibility
13783 - Fix missing accessibility support when opening a browser from a
13784 notification (Closes: #16475).
13785 - Refresh ublock-origin patch to apply cleanly on top of 1.18.4+dfsg-1
13787 - Upgrade intel-microcode to 3.20180807a.2~deb9u1.
13788 Fixes CVE-2018-3615, CVE-2018-3620, CVE-2018-3646, CVE-2018-3639,
13789 CVE-2018-3640, CVE-2017-5753, CVE-2017-5754.
13792 - Lower memory requirements when building Tails by limiting the memory
13793 used by mksquashfs to 512M (Closes: #16177).
13794 - Remove obsolete check on Thunderbird addons (Closes: #16045).
13795 - Update Tails' APT GnuPG key expiration (Closes: #16420).
13796 - Optimize Git operations (share resources, fetch only the needed
13798 - Clone submodules from the host's local repositories (Closes: #16476).
13799 - Drop useless manual initramfs update (Closes: #16452).
13800 - Add a sanity check on the size of the initramfs (Closes: #16452).
13803 - Add automated tests for Additional Software GUI (Closes: #14576,
13805 - Add automated tests on the backup persistence configuration
13807 - Adjust test for Thunderbird 60.5.1 (Closes: #16555).
13809 -- Tails developers <tails@boum.org> Mon, 18 Mar 2019 23:40:50 +0100
13811 tails (3.12.1) unstable; urgency=medium
13814 - Upgrade Tor Browser to 8.0.6 (MFSA-2019-05; Closes: #16437).
13815 - Upgrade LibreOffice to 1:5.2.7-1+deb9u5 (DSA-4381).
13816 - Upgrade cURL to 7.52.1-5+deb9u9 (DSA-4386).
13817 - Upgrade Qt 5 to 5.7.1+dfsg-3+deb9u1 (DSA-4374).
13818 - Upgrade OpenSSH to 1:7.4p1-10+deb9u5 (DSA-4387).
13820 -- Tails developers <tails@boum.org> Tue, 12 Feb 2019 21:25:14 +0100
13822 tails (3.12) unstable; urgency=medium
13825 - Make the USB image the main supported way to install Tails (refs: #15292).
13826 On first boot, grow the system partition to a size that's a factor
13827 of the size of the boot medium and randomize GUIDs (Closes: #15319).
13828 - Upgrade Linux to 4.19, version 4.19.13-1 (Closes: #16073, #16224).
13829 Fixes CVE-2018-19985, CVE-2018-19406, CVE-2018-16862, CVE-2018-18397,
13830 CVE-2018-18397, CVE-2018-18397, CVE-2018-18397, CVE-2018-19824,
13832 - Remove Liferea (Closes: #11082, #15776).
13833 - Upgrade to the Debian Stretch 9.6 point-release.
13836 - Upgrade Tor Browser to 8.0.5 (MFSA-2019-02; Closes: #16388).
13837 - Upgrade Thunderbird to 60.4.0 (DSA-4362-1; Closes: #16261).
13838 - Upgrade OpenSSL to 1.0.2q-1~deb9u1 (DSA-4355-1).
13839 - Upgrade libarchive to 3.2.2-2+deb9u1 (DSA-4360-1).
13840 - Upgrade GnuTLS to 3.5.8-5+deb9u4 (CVE-2018-10844, CVE-2018-10845).
13841 - Upgrade libgd3 to 2.2.4-2+deb9u3 (CVE-2018-1000222, CVE-2018-5711).
13842 - Upgrade libmspack to 0.5-1+deb9u3 (CVE-2018-18584, CVE-2018-18585).
13843 - Upgrade libopenmpt to 0.2.7386~beta20.3-3+deb9u3 (CVE-2018-10017).
13844 - Upgrade libx11 to 2:1.6.4-3+deb9u1 (CVE-2018-14598, CVE-2018-14599,
13846 - Upgrade libxcursor to 1:1.1.14-1+deb9u2 (CVE-2015-9262).
13847 - Upgrade NetworkManager to 1.6.2-3+deb9u2+0.tails1 (CVE-2018-15688).
13848 - Upgrade wpa to 2:2.4-1+deb9u2 (CVE-2018-14526).
13849 - Upgrade zeromq3 to 4.2.1-4+deb9u1 (CVE-2019-6250).
13850 - Upgrade APT to 1.4.9 (DSA-4371-1).
13851 - Upgrade GhostScript to 9.26a~dfsg-0+deb9u1 (DSA-4372-1).
13854 - Fix Totem's access to the Internet when it's started from the Applications
13856 - Rename HTP pools to avoid confusion (Closes: #15428).
13857 - Fix memory erasure on shutdown with systemd v239+, by mounting
13858 a dedicated tmpfs on /run/initramfs instead of trying to remount /run
13859 with the "exec" option (Closes: #16097).
13860 - Make the KeePassX wrapper dialog translatable.
13861 - Fix detection of first Thunderbird run.
13863 * Minor improvements and updates
13864 - Upgrade tor to 0.3.4.9-1~d90.stretch+1.
13865 - Upgrade Mesa to 18.2.6-1~bpo9+1, libdrm to 2.4.95-1~bpo9+1,
13866 and libglvnd to 1.1.0-1~bpo9+1.
13867 - Upgrade firmware-linux and firmware-nonfree to 20190114-1.
13868 - Upgrade amd64-microcode to 3.20181128.1.
13869 - Upgrade intel-microcode to 3.20180807a.2~bpo9+1.
13870 - Remove the boot readahead feature (Closes: #15915).
13871 In most supported use cases, it did not improve boot time anymore,
13872 or even increases it.
13873 - Require TLS 1.2 in our Upgrader and tails-security-check (Closes: 11815).
13874 - Enable O_CREAT restriction in /tmp directories for FIFOs and regular
13875 files (Closes: #16072).
13876 - Upgrade systemd to 240-4~bpo9+0tails1 (Closes: #16352).
13877 Fixes CVE-2018-16864, CVE-2018-16865, and CVE-2018-16866.
13878 - Upgrade Enigmail to 2.0.8-5~deb9u1 (Closes: #15657).
13879 - Upgrade Torbirdy to 0.2.6-1~bpo9+1 (Closes: #15661).
13880 - Modify Torbirdy configuration in a way that's easier to maintain.
13881 - Tell the user they need to use sudo when they attempt to use su
13885 - Make the build of the USB image reproducible (Closes: #15985).
13886 - Allow specifying which set of APT snapshots shall be used during
13887 the build, with the APT_SNAPSHOTS_SERIALS build option (Closes: #15107).
13888 - Fix more GIDs and display more information when changing UIDs or GIDs
13889 fails (Closes: #16036).
13890 - Remove obsolete patches, refresh remaining ones to apply on top
13891 of currently installed packages version.
13892 - Disable irrelevant recurring jobs in Vagrant build box (refs: #16177)
13893 that increase the chance of FTBFS due to mksquashfs being reaped
13895 - Adjust for recent GnuPG error'ing out when it has no controlling terminal.
13898 - Adjust test suite for USB image:
13899 - Add tests that exercise behavior on first boot from a device
13900 installed using the USB image (Closes: #16003).
13901 - Drop tests for use cases we don't support anymore with the introduction
13902 of the USB image (refs: #16004).
13903 - Adjust remaining tests to focus on main supported use cases,
13904 i.e. Tails installed from a USB image (refs: #16004.
13905 - In scenarios where we simulate MAC spoofing failure, test safety-critical
13906 properties even if the desktop notification is buggy (refs: #10774).
13907 - Update expected title for our Redmine (Closes: #16237).
13908 - Update expected image for OpenPGP key search.
13910 -- Tails developers <tails@boum.org> Mon, 28 Jan 2019 13:26:26 +0100
13912 tails (3.11) unstable; urgency=medium
13915 - Upgrade Tor Browser to 8.0.4-build2 (Closes: #16193).
13916 - Upgrade Thunderbird to 60.3.0-1~deb9u1.0tails1 (Closes: #16118).
13917 - Thunderbird: unconditionally disable Autocrypt, as it is not safe in
13918 its current state (See: #15923, Closes: #16186).
13919 - Upgrade Linux to 4.18.20 and aufs to 4.18.11+-20181119
13921 - Upgrade cURL to 7.52.1-5+deb9u8 (DSA-4331).
13922 - Upgrade Ghostscript to 9.26~dfsg-0+deb9u1 (DSA-4336, DSA-4346).
13923 - Upgrade Perl to 5.24.1-3+deb9u5 (DSA-4347).
13924 - Upgrade Policykit to 0.105-18+deb9u1 (DSA-4350).
13925 - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u4 (DSA-4345).
13926 - Upgrade OpenSSL to 1.1.0j-1~deb9u1 (DSA-4348).
13927 - Upgrade libtiff to 4.0.8-2+deb9u4 (DSA-4349).
13931 · Improve support for incremental upgrades to avoid issues with
13932 partially applied upgrades (Closes: #14754).
13933 · Add a prompt after the IUK has been downloaded so the user can
13934 control when the network will be disabled; previously this was
13935 done without users having a say, possibly leading to confusion and
13936 lost work (Closes: #15282).
13937 - Thunderbird: always set locale according to environment (Closes: #16113).
13939 * Minor improvements and updates
13940 - Remove packages which were needed for getTorBrowserUserAgent
13942 - Fix persistence configuration window opening on full screen
13944 - Time sync: don't temporarily increase tor's log level when using
13945 bridges/PTs (Closes: #15743).
13946 - Warn about non-free software depending on the host operating system
13947 and/or virtualization stack (Closes: #16195).
13950 - Create USB image after building the ISO, and include it in build
13951 artifacts (Closes: #15984, #15985, #15990).
13952 - Release process: adapt to IDF v2 (Closes: #16171).
13955 - Add new Using "VeraCrypt encrypted volumes" feature, with scenarios
13956 split into two parts: "Unlock VeraCrypt Volumes" and "GNOME Disks"
13957 (Closes: #14469, #14471, #15238, #15239).
13958 - Reintroduce "Clock is one day in the future in bridge mode" test
13960 - Make starting apps via GNOME Activities Overview more robust
13962 - Check for "Upgrading the system" and adjust to "Upgrade successfully
13963 downloaded" new UI (See: #14754, #15282).
13965 -- Tails developers <tails@boum.org> Mon, 10 Dec 2018 20:37:06 +0100
13967 tails (3.10.1) unstable; urgency=medium
13969 * Declare that Enigmail is compatible with Thunderbird 60.*.
13971 -- Tails developers <tails@boum.org> Tue, 23 Oct 2018 01:30:00 +0200
13973 tails (3.10) unstable; urgency=medium
13976 - Harden sudo config to avoid potential future privilege escalation
13978 - Upgrade Linux to 4.18 and aufs to 4.18-20181008 (Closes: #15936).
13979 - Upgrade the snapshot of the Debian archive to 2018100901 accordingly.
13980 - Upgrade Tor Browser to 8.0.3-build1 (Closes: #16067).
13981 - Upgrade Thunderbird to 60.2.1 (Closes: #16037).
13984 - Fix installation of mesa/stretch-backports by installing libwayland*
13985 from stretch-backports (Closes: #15846).
13986 - Tor Browser AppArmor profile patch: update to apply cleanly on top
13987 of torbrowser-launcher 0.2.9-5.
13988 - Additional Software: fix issues spotted during the code review
13990 - Additional Software: make sure to offer persistence only for newly
13991 installed packages, avoiding inconsistency (Closes: #15983).
13992 - Improve button labels in confirmation dialogs of the Tails installer
13994 - Hardcode User Agent in htpdate.user-agent (Closes: #15912), as the
13995 Tor Browser doesn't expose it anymore.
13996 - Fix encoding-related crashes in Tails Installer (Closes: #15166).
13997 - Set the Firefox preferences to spoof English, to avoid leaking
13998 information about locale settings (Closes: #16029).
13999 - VeraCrypt: Hide PIM entries in GNOME Shell and Disks, since a newer
14000 cryptsetup would be needed (Closes: #16031).
14001 - VeraCrypt: Fix support for multiple encryption, by iterating over
14002 all children in the device-mapper tree (Closes: #15967).
14003 - Update translations.
14005 * Minor improvements and updates
14006 - Add dmsetup and losetup output in WhisperBack reports to help debug
14007 VeraCrypt-related issues (Closes: #15966).
14008 - Let AppArmor allow access to /usr/local/share/mime, reducing noise
14009 in logs due to many DENIED entries (Closes: #15965).
14010 - Use proper stem.connection module in onion-grater instead of trying
14011 to read the auth cookie manually: that's fragile and breaks some use
14012 cases (e.g. custom auth cookie).
14013 - Unlock VeraCrypt Volumes: Improve internationalization support.
14016 - Ensure the test suite doesn't break when changing the headline of
14017 /home (Closes: #12156).
14018 - Update test suite for updated button labels in confirmation dialogs
14019 of the Tails installer (Closes: #11501).
14021 -- Tails developers <tails@boum.org> Tue, 23 Oct 2018 01:30:00 +0200
14023 tails (3.9.1) unstable; urgency=medium
14026 - Upgrade Tor Browser to 8.0.2, based on Firefox 60.2.1 (Closes: #16017).
14027 - Upgrade Thunderbird to 60.0-3~deb9u1.0tails2 (Closes: #15959). Also
14028 imported the same security fixes that caused Tor Browser 8.0.2.
14029 - Upgrade curl to 7.52.1-5+deb9u7 (DSA-4286).
14030 - Upgrade Ghostscript to 9.20~dfsg-3.2+deb9u5 (DSA-4294).
14031 - Upgrade libarchive-zip-perl to 1.59-1+deb9u1 (DSA-4300).
14032 - Upgrade libkpathsea6 to 2016.20160513.41080.dfsg-2+deb9u1 (DSA-4299).
14033 - Upgrade LittleCMS 2, aka. liblcms2-2, to 2.8-4+deb9u1 (DSA-4284).
14034 - Upgrade Python 2.7 to 2.7.13-2+deb9u3 (DSA-4306).
14035 - Upgrade Python 3.5 to 3.5.3-1+deb9u1 (DSA-4307).
14038 - Make Thunderbird translated in non-English locales via
14039 intl.locale.requested, which works correctly since 60.0-3
14041 - Totem: backport AppArmor profile fix to allow opening the help
14043 - Remove mutt, that was accidentally installed in 3.9 (Closes: #15904).
14044 - Fix VeraCrypt volumes not being opened in GNOME Files (Closes: #15954).
14045 - Fix displaying the "General" section in the Tor Browser preferences
14047 - Fix APT pinning at Tails runtime for our custom APT repository
14048 and for Debian backports (Closes: #15837, #15973).
14050 * Minor improvements and updates
14051 - Upgrade tor to 0.3.4.8-1~d90.stretch+1 (Closes: #15889).
14053 -- Tails developers <tails@boum.org> Wed, 03 Oct 2018 12:12:33 +0200
14055 tails (3.9) unstable; urgency=medium
14058 - Upgrade Tor Browser to 8.0 (Closes: #15803, #15907).
14059 Notable user-visible changes and relevant details:
14060 · Adjust to the fact Tor Browser 8.0a10 replaces firefox with a wrapper.
14061 · Don't use the bundled copy of libstdc++.so.6, ours is recent enough.
14062 · Drop obsolete Torbutton prefs (Closes: #15706).
14063 · Switch back to 128px icons (Closes: #15081).
14064 · AppArmor profile: take into account new Firefox binary path.
14065 - Upgrade Thunderbird to 60.0 (Closes: #15792).
14066 Notable user-visible changes and relevant details:
14067 · AppArmor profile: patch to avoid conflicting x modifiers for ps(1).
14068 - Upgrade tor to 0.3.4.7-rc (Closes: #15772).
14071 - Upgrade Linux to 4.17.17-1 and intel-microcode to 3.20180807a.1
14072 This fixes CVE-2018-3620 aka. Foreshadow aka. L1 Terminal Fault
14074 - Upgrade OpenSSH to 1:7.4p1-10+deb9u4 (DSA-4280).
14077 - Fix Totem on Intel graphics cards by inlining the backported mesa
14078 and dri-enumerate abstractions into its AppArmor profile: they are needed
14079 with recent Mesa and libdrm (Closes: #15821). Regression introduced
14081 - Fix unlocking "hidden" TrueCrypt/VeraCrypt volumes via GNOME Shell
14083 - Fix confusing error message when unlocking TrueCrypt/VeraCrypt volumes
14085 - Revert to Stretch's X.Org nouveau video driver (Closes: #15833).
14086 It seems that the regression brought by the upgraded one
14087 is worse than the improvements reported after our call for testing.
14088 Regression introduced in 3.9~rc1.
14089 - Use the intel X.Org driver for Intel Corporation UHD Graphics 620.
14090 - Fix regressions introduced in 3.9~rc1 in/by Additional Software Packages:
14091 · Don't break new empty persistence configuration files creation when
14092 permissions are incorrect (Closes: #15802).
14093 · Fix UX when the user has specified a distribution or version
14094 for a given package in their live-additional-software.conf
14096 · Don't show installation notifications on upgrade (Closes: #15879).
14097 - Make more Additional Software Packages strings translatable in the
14098 configuration dialog and PolicyKit messages.
14100 * Minor improvements and updates
14101 - Upgrade firmware-nonfree to 20180825-1.
14102 - Update the deb.torproject.org APT repository signing key.
14103 - Unlock VeraCrypt Volumes: add disclaimer (Closes: #15849).
14106 - Update Thunderbird test suite for 60.0 (Closes: #15791).
14107 - Fix various robustness issues.
14108 - Make the Chutney nodes use a higher V3AuthVotingInterval to make client
14109 bootstrap more robust (Closes: #15799).
14110 - Update the Tor Launcher binary path.
14111 - Adjust to the fact "New Circuit for this Site" is now in the site
14112 information and not under the Torbutton anymore.
14113 - Delete unused images.
14115 -- Tails developers <tails@boum.org> Tue, 04 Sep 2018 12:15:43 +0000
14117 tails (3.9~rc1) unstable; urgency=medium
14120 - Integrate the Additional Software Packages feature into the desktop
14121 and revamp the interface of "Configure Persistent Volume".
14122 - Support TrueCrypt/VeraCrypt encrypted volumes on the desktop.
14123 - Upgrade Tor Browser to 8.0a9, based on Firefox 60 ESR (Closes: #15023).
14124 Notable user-visible changes and relevant details:
14125 · Drop search engine customization and stick to Tor Browser's defaults.
14126 · Upgrade uBlock Origin to its WebExtension version and now rely
14127 on the filter lists shipped in the Debian package.
14128 · Tweak the number of web content processes to work better with 2 GiB
14129 of RAM (Closes: #15716).
14130 · Revamp how we're handling our custom prefs, drop obsolete ones,
14131 reduce our delta with pristine Tor Browser.
14132 - Upgrade Thunderbird to 60.0b10 (Closes: #15091). Notable details:
14133 · Install Torbirdy 0.2.5 from stretch-backports and drop our patches
14134 that were merged upstream.
14135 · Enable the optional part of the fixes for EFAIL (Closes: #15602).
14136 - Upgrade Linux to 4.17 (Closes: #15763).
14137 - Upgrade tor to 0.3.4.6-rc (Closes: #15770).
14138 - Upgrade to Debian Stretch 9.5.
14141 - Upgrade CUPS to 2.2.1-8+deb9u2 (DSA-4243).
14142 - Upgrade Exiv2 to 0.25-3.1+deb9u1 (DSA-4238).
14143 - Upgrade FUSE to 2.9.7-1+deb9u1 (DSA-4257).
14144 - Upgrade GDM to 3.22.3-3+deb9u2 (DSA-4270).
14145 - Upgrade libsoup to 2.56.0-2+deb9u2 (DSA-4241).
14146 - Upgrade Imagemagick to 8:6.9.7.4+dfsg-11+deb9u5 (DSA-4245).
14147 - Upgrade ffmpeg to 7:3.2.12-1~deb9u1 (DSA-4258, DSA-4249).
14148 - Upgrade libmspack to 0.5-1+deb9u2 (DSA-4260).
14149 - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u3 (DSA-4271).
14150 - Upgrade the Apache XML Security for C++ library to 1.7.3-4+deb9u1
14154 - Don't display the Enigmail configuration wizard in every Tails session
14155 (Closes: #15693, #15746). Fix against Tails 3.8.
14156 - Make the torstatus GNOME Shell extension actually translatable
14157 (Closes: #15715). Fix against the first Tails release that included
14159 - Drop Icedove → Thunderbird migration code which started causing trouble.
14161 · Link to upgrade documentation when upgrading (Closes: #7904).
14162 · Show the reinstall option only when the device is big enough to make
14163 a full reinstallation (Closes: #14810).
14164 · Make the main window fit in a 600px-high screen (Closes: #14849).
14165 · Show the correct device size in the reinstall confirmation dialog
14167 - Tails Greeter: don't display file:/// URLs to users (Closes: #15582).
14169 * Minor improvements and updates
14170 - Install Mesa and libdrm* from stretch-backports and upgrade the Nouveau
14171 X.Org video driver to 1.0.15. This improves support for some graphics
14172 cards such as NVIDIA Pascal series (Closes: #14910)
14173 - htpdate: improve diagnostics output when the date header can't be fetched.
14174 - Onion Grater: support named AppArmor profiles.
14175 - Update Onion Grater's config for new Tor Browser AppArmor profile name.
14176 - Enable e10s in the Unsafe Browser.
14177 - Delete all search plugins for the Unsafe Browser (Closes: #15708).
14178 - Display a deprecation warning when starting Liferea (#11082).
14179 - Upgrade VirtualBox guest modules to 5.2.16-dfsg-3~bpo9+2.
14180 - Use Tor Browser for browsing the documentation even when offline
14182 - Provide feedback while Tor Browser, "Tails documentation"
14183 or "Report an error" are starting (Closes: #15101).
14184 - WhisperBack: remove the right pane (Closes: #7180).
14185 - tails-debugging-info: return machine-readable, structured data.
14186 Adjust WhisperBack accordingly (Closes: #8514). This paves the way
14187 towards more usable bug reports (#8722).
14188 - Port lots of our Perl code to more lightweight libraries.
14189 This decreases the amount of memory used by the persistence
14190 configuration interface.
14191 - Do not hide applications that require an admin password (Closes: #11013).
14192 - Try unlocking every persistent volume when multiple ones are
14193 available (Closes: #15653).
14194 - Upgrade Electrum to 3.1.3-1~bpo9+1.
14195 - Upgrade most firmware to 20180518-1.
14196 - Upgrade Intel microcode to 3.20180703.2~bpo9+1.
14197 - Upgrade AMD microcode to 3.20180524.1.
14200 - Drop AppArmor feature set pinning: this is now done in Debian Stretch
14202 - Remove the now unused deb.torproject.org sid APT source (Closes: #15638).
14203 - Install OnionShare from our custom APT repo instead of from sid.
14204 We've mistakenly tracked sid for a while and it has become a problem,
14205 so stick to the version that works for us until Tails 4.0.
14206 - Fix building the ISO on zfs by dropping the cache=none setting for
14207 vmproxy's storage (Closes: #14404).
14208 - Update the Vagrant basebox for any change under vagrant/.
14209 Previously, some relevant changes were not effective until something under
14210 vagrant/definitions/tails-builder/ was changed.
14211 - Make intltool ignore .py files: `intltool-update --maintain` seems to be
14212 buggy with .py files.
14213 - Refresh our CUPS AppArmor profile patch to apply on 2.2.1-8+deb9u2.
14214 - Make it more obvious that the .orig file check is fatal (Closes: #15727).
14215 - Delete baseboxes once they're 6 months old instead of 4.
14216 This is more in line with the delay between our major releases these days.
14217 - Rename /usr/share/amnesia to /usr/share/tails. It was about time.
14218 - Abort the build if /etc/{passwd,group} has changed (Closes: #15419).
14219 Such changes can break Tails after an automatic upgrade was applied
14220 so let's detect it ASAP. Consequently, ensure a few GIDs — that wanted
14221 to play musical chairs — are the same as in Tails 3.8 (Closes: #15695).
14222 - Don't fail the build if the APT lists don't include any package
14223 whose name matches ^geoclue.
14226 - Adjust to the new tails-persistence-setup API.
14227 - Update the Tor Browser's AppArmor profile name.
14228 - Re-enable the "I can print the current page […]" test.
14229 - Update tests wrt. the fact tails-upgrade-frontend-wrapper was ported
14230 to Python (Closes: #15379).
14231 - Make a test more robust by waiting for the page to have loaded.
14232 - Adjust to the fact the WhisperBack debugging info is now configured
14233 in a machine-readable file.
14234 - Remove test for tails-debugging-info, that has been a no-op for a while.
14235 - Adjust for Tor Browser 8.
14236 - Make the "I open the address" step more robust and accordingly
14237 stop marking the tests that use it in the Unsafe Browser
14238 as fragile (refs: #14771).
14239 - De-duplicate a number of images of standard GTK+ 3 widgets.
14240 - Make the audio and WebM tests more robust.
14241 - Make the "I start the Tor Browser in offline mode" step more robust.
14242 - Make the "AppArmor has (not )? denied" step more robust.
14243 - Don't try and use XVFB_PID if it's not set (Closes: #15730).
14244 - Adjust Pidgin test to use a certificate that's still in Debian
14246 - Use a hopefully more reliable public GnuPG key and make tests
14247 more robust against new subkeys being added (Closes: #15771).
14248 - Stop hard-coding the list of RTL Tor Browser locales.
14249 - Fix the "Unsafe Browser can be used in all languages supported in Tails"
14250 test for locales that have a translated homepage (Closes: #11711).
14251 - Take into account that apt(8) won't return when run in the remote shell
14252 with the ASP hooks enabled.
14254 -- Tails developers <tails@boum.org> Thu, 16 Aug 2018 18:37:47 +0000
14256 tails (3.8) unstable; urgency=medium
14259 - Upgrade Tor Browser to 7.5.6 (MFSA 2018-17; Closes: #15683).
14260 - Upgrade Enigmail to 2.0.7 (partly fixes #15602 aka. EFAIL).
14261 - Upgrade libgcrypt to 1.7.6-2+deb9u3 (DSA-4231-1).
14262 - Upgrade perl to 5.24.1-3+deb9u4 (DSA-4226-1).
14265 - Thunderbird: fix importing public OpenPGP keys from email attachments
14267 - Make the Unsafe Browser home page translatable again (Closes: #15461).
14269 * Minor improvements
14270 - Don't display the "Know your rights" message on Thunderbird first run.
14271 - Move Thunderbird's default userChrome.css to /etc/thunderbird, just like
14272 we do for Tor Browser, for easier upgrade handling.
14274 -- Tails developers <tails@boum.org> Mon, 25 Jun 2018 09:59:22 +0000
14276 tails (3.7.1) unstable; urgency=medium
14279 - Upgrade Tor Browser to 7.5.5 (MFSA 2018-14; closes: #15643).
14280 - Upgrade Thunderbird to 52.8.0 (DSA-4209-1; Closes: #15607).
14281 - Partially fixes EFAIL.
14282 - Fixes importing OpenPGP keys from keyservers with Enigmail.
14283 - Accordingly refresh our Thunderbird AppArmor profile patch.
14284 - Upgrade cURL to 7.52.1-5+deb9u6 (DSA-4202-1).
14285 - Upgrade GnuPG (modern) 2.1.18-8~deb9u2 (DSA-4222-1).
14286 - Upgrade GnuPG (legacy) to 1.4.21-4+deb9u1 (DSA-4223-1).
14287 - Upgrade Git to 1:2.11.0-3+deb9u3 (DSA-4212-1).
14288 - Upgrade PackageKit to 1.1.5-2+deb9u1 (DSA-4207-1).
14289 - Upgrade procps to 2:3.3.12-3+deb9u1 (DSA-4208-1).
14290 - Upgrade wavpack to 5.0.0-2+deb9u2 (DSA-4197-1).
14291 - Upgrade wget to 1.18-5+deb9u2 (DSA-4195-1).
14292 - Upgrade xdg-utils to 1.1.1-1+deb9u1 (DSA-4211-1).
14295 - Fix setting a screen locker password with non-ASCII characters
14298 - Rename the WhisperBack launcher to "WhisperBack Error Reporting"
14299 so that users have a better chance to understand what it does
14301 - Ensure debugging info in Whisperback reports don't contain email
14302 signature markers so that email clients forward it in full
14304 - Wrap text written by the user to 70 chars (Closes: #11689).
14306 * Minor improvements
14307 - The "Tails documentation" desktop launcher now opens /doc instead of
14308 the aging /getting_started that confused people during user testing
14312 - Update to match "Tails documentation" behaviour change.
14314 -- Tails developers <tails@boum.org> Sat, 09 Jun 2018 19:53:51 +0000
14316 tails (3.7) unstable; urgency=medium
14319 - Upgrade Tor Browser to 7.5.4 (MFSA 2018-12, Closes: #15588).
14320 - Upgrade OpenSSL to 1.1.0f-3+deb9u2 (DSA-4157).
14321 - Upgrade Perl to 5.24.1-3+deb9u3 (DSA-4172).
14322 - Upgrade Libre Office to 1:5.2.7-1+deb9u4 (DSA-4178).
14323 - Upgrade libmad to 0.15.1b-8+deb9u1 (DSA-4192).
14326 - Enable the removal of OpenPGP keyblock in Whisperback (closes: #7797).
14327 - Show the logo in Whisperback's About menu (closes: #13198).
14328 - Use the same font in all the Whisperback report (Closes: #11272).
14329 - Update tails-bugs@tails.boum OpenPGP key (Closes: #15534).
14331 * Minor improvements
14332 - Stop installing python-qt4 and python-trezor (Closes: #15391).
14333 - Make WhisperBack easier to find in the GNOME Overview (Closes: #13299).
14335 -- Tails developers <tails@boum.org> Tue, 08 May 2018 01:47:22 +0200
14337 tails (3.6.2) unstable; urgency=medium
14340 - Upgrade Tor Browser to 7.5.3 (MFSA 2018-10, Closes: #15459).
14341 - Upgrade Thunderbird to 1:52.7.0-1~deb9u1.0tails1 (DSA-4155,
14343 - Upgrade libicu to 57.1-6+deb9u2 (DSA-4150).
14344 - Upgrade intel-microcode to 3.20180312.1~bpo9+1. Implements
14345 IBRS/IBPB/STIPB support, Spectre-v2 mitigation for: Sandybridge,
14346 Ivy Bridge, Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake
14350 - Tor Browser AppArmor profile:
14351 * Grant the main Firefox process access to machine-id: needed for
14352 IBus support (Closes: #15437).
14353 * Allow access to extensions installed by the user such as Tails
14354 Verification (Closes: #15434).
14355 - Remove packages needed to support Video Acceleration API
14356 (VA-API) because they breaks opening GNOME Settings and Totem in
14357 Tails 3.6 on some computers (only NVIDIA for now but perhaps
14358 other hardware is affected). (Closes: #15433, #15449)
14359 - Upgrade Linux to 4.15.11-1 and bump the aufs submodule (Closes:
14361 - tails-documentation script:
14362 * open translated documentation page in Tor Browser when online
14364 * use documented syntax for os.execv (Refs: #15332)
14365 * re-add support for passing a HTML anchor as the second
14367 - Fix issue where the tails-persistence-setup user's guid would be
14368 changed when it was the uid that was intended (Closes: #15422).
14370 -- Tails developers <tails@boum.org> Thu, 29 Mar 2018 17:49:42 +0200
14372 tails (3.6.1) unstable; urgency=medium
14375 - Upgrade Tor Browser to 7.5.2 (MFSA 2018-08 i.e. CVE-2018-5146).
14376 - Upgrade libvorbis to 1.3.5-4+deb9u2 (DSA 4140-1 aka. CVE-2018-5146).
14377 - Upgrade curl to 7.52.1-5+deb9u5 (DSA 4136-1).
14378 - Upgrade samba to 2:4.5.12+dfsg-2+deb9u2 (DSA 4135-1).
14381 - Fix ISO build reproducibility (Closes: #15400)
14382 - Disable Selfrando: Tor Browser upstream currently enables it only
14383 in non-release builds
14384 (https://trac.torproject.org/projects/tor/ticket/24912#comment:8).
14386 -- Tails developers <tails@boum.org> Fri, 16 Mar 2018 22:42:00 +0000
14388 tails (3.6) unstable; urgency=medium
14391 - Upgrade Tor Browser to 7.5.1.
14392 - Upgrade Tor to 0.3.2.10. (Closes: #15158)
14393 - Add ability to lock the screen. (Closes: #5684)
14394 - Add initial support for Meek bridges. (Closes: #8243)
14395 - Upgrade to Thunderbird 52.6.0. (Closes: #15298)
14396 - Enable Thunderbird AppArmor profile. (Closes: 11973)
14397 - Upgrade Linux to 4.15.0-1. (Closes: #15309).
14398 - Upgrade systemd to 237.
14399 - Upgrade Electrum to 3.0.6. (Closes: #15022)
14400 - Upgrade the base system to the Debian Stretch 9.4 point-release
14402 - Port a few shell scripts to Python thanks to GoodCrypto. (Closes: #11198)
14405 - Upgrade Intel processor microcode firmware. (Closes: #15173).
14406 - Upgrade poppler to 0.48.0-2+deb9u1. (CVE-2017-14929, CVE-2017-1000456)
14407 - Upgrade tiff to 4.0.8-2+deb9u2 (CVE-2017-9935, CVE-2017-11335,
14408 CVE-2017-12944, CVE-2017-13726, CVE-2017-13727, CVE-2017-18013)
14409 - Upgrade ffmpeg to 7:3.2.10-1~deb9u1. (CVE-2017-17081)
14410 - Upgrade libtasn1-6 to 4.10-1.1+deb9u1. (CVE-2017-10790, CVE-2018-6003)
14411 - Upgrade Libre Office to 1:5.2.7-1+deb9u2. (CVE-2018-6871)
14412 - Upgrade libvorbis to 1.3.5-4+deb9u1. (CVE-2017-14632, CVE-2017-14633)
14413 - Upgrade gcc to 6.3.0-18+deb9u1.
14414 - Upgrade util-linux to 2.29.2-1+deb9u1. (CVE-2018-7738)
14415 - Upgrade isc-dhcp to 4.3.5-3+deb9u1 (CVE-2017-3144, CVE-2018-5732,
14418 * Minor improvements
14419 - Avoid noisy warning at boot time by creating tails-upgrade-frontend's
14420 trusted GnuPG homedir with stricter permissions, then making it looser.
14422 - Drop (broken) Thunderbird dedicated SocksPort. (Closes: #12460)
14423 - Drop customized update-ca-certificates.service. (Closes: #14756)
14424 - Update AppArmor cupsd profile. (Closes: #15029)
14425 - Improve UX when GDM does not start. (Closes: #14521)
14426 - Install packages needed to support Video Acceleration API.
14428 - Upgrade aufs-dkms for Linux 4.15. (Closes: #15132).
14429 - Ship pdf-redact-tools, thanks to dachary <loic@dachary.org>.
14431 - Additional Software Packages: convert to python3 and PEP-8.
14433 - Additional Software Packages: do not check for updates every time the
14434 network gets reconnected. (Closes: #9819)
14435 - Revert to xorg-xserver from Stretch. (Closes: #15232)
14436 - Open Tails documentation in Tor Browser when online. (Closes: #15332)
14437 - Disable Enigmail's Memory Hole feature. (Closes: #15201)
14438 - Persistence Setup: stop depending on Synaptic. (Closes: #15263)
14441 - Additional Software Packages: fix the "incomplete online upgrade
14442 process" bug in offline mode (Closes: #14570)
14443 - Additional Software Packages: do not block Desktop opening.
14445 - Install OpenPGP Applet 1.1. (Closes: #6398).
14446 - Repair rng-tools using a real start-stop-daemon program.
14448 - Tails installer: fix bug with unicode status messages. (Closes: #15254)
14451 - Abort if tails-custom-apt-sources failed.
14452 - Abort the ISO build when DKMS modules are not built. (Closes: #14789).
14453 - Improve how we track dependencies in build hooks. (Closes: #14818)
14454 - Fix (potential) rare race condition during build.
14455 - Ensure the SquashFS has /etc/hostname properly configured.
14457 - Bump builder VM's RAM. (Closes: #15310)
14460 - Log the list of systemd jobs when systemctl is-system-running fails.
14462 - Allow more time for 'systemctl is-system-running' to succeed.
14463 - Only support SikuliX, not Sikuli.
14464 - Disable SPICE clipboard sharing.
14465 - Don't flood the debug logger with the journal contents.
14466 - Rescue exception.
14467 - Enter a name into the Thunderbird account configuration.
14469 - Fix the "I do not see ..." step's case. (Closes: #14929)
14470 - Mark scenarios that use the "The Report an Error launcher will…" step
14471 as fragile (Closes: #15321)
14472 - Test that Tor Browser opens docs when online. (Closes: #15332)
14473 - Adapt test after warning moved to after Unsafe Browser verification
14474 dialog. (Closes: #8775)
14475 - Dogtailify electrum.feature.
14476 - Add additional software packages feature. (Closes: #14572)
14477 - Disable test that is broken due to a Tor Browser bug. (refs: #15336)
14479 -- Tails developers <tails@boum.org> Mon, 12 Mar 2018 21:28:29 +0100
14481 tails (3.5) unstable; urgency=medium
14484 - Upgrade amd64-microcode to 3.20171205.1, for the mitigation
14485 against Spectre (CVE-2017-5715) (Closes: #15148).
14486 - Upgrade Tor Browser to 7.5-build3 (Closes: #15197).
14487 - Upgrade Thunderbird to 1:52.5.2-2~deb9u1.0tails1 (Closes: #15033)
14488 - Upgrade gdk-pixbuf to 2.36.5-2+deb9u2.0tails1 (Closes: #15177).
14489 - Upgrade bind9 to 1:9.10.3.dfsg.P4-12.3+deb9u4.
14490 - Upgrade libxml2 to 2.9.4+dfsg1-2.2+deb9u2.
14492 * Minor improvements
14493 - Upgrade Linux to 4.14.13, which is the first kernel that has the
14494 "[x86] microcode/AMD: Add support for fam17h microcode loading"
14495 commit, that's needed to load the AMD fam17h microcode for
14496 mitigating the Spectre vulnerability (CVE-2017-5715).
14499 - Drop Claws Mail persistence setting migration. Whenever
14500 persistent Claws Mail setting is enabled, this creates an empty
14501 ~/.icedove/ directory, that prevents Thunderbird from starting
14503 - Don't prevent the GNOME Applications button from opening its menu if
14504 time syncing resulted in a shift back in time (Closes: #14250).
14505 - Tails Installer: when cloning Tails to another USB drive, check
14506 if the target device has enough space *before* any destructive
14507 actions are made (Closes: #14622).
14508 - Tor Browser: make "Print to file" work again, for all locales
14509 (Closes: #13403, #15024).
14512 - Fix option passed to cmp: -q is not supported but --quiet is.
14513 Spotted on feature/buster that's the first branch that exercises
14514 this code, but there's no reason to fix it only there.
14517 - Adapt tests for Tor Launcher 0.2.14.3, i.e. the one shipped with
14518 Tor Browser 7.5 in Tails 3.5 (Closes: #15064).
14519 - Add support for creating arbitrarily sized partitions.
14520 - Add a "Try cloning Tails to a too small partition" scenario
14521 (regression test for #14622).
14523 -- Tails developers <tails@boum.org> Tue, 23 Jan 2018 00:57:58 +0100
14525 tails (3.4) unstable; urgency=medium
14528 - Install Linux 4.14.0-3 from sid (Closes: #14976). This enables
14529 the kernel-side mitigations for Meltdown.
14530 - Upgrade curl to 7.52.1-5+deb9u3.
14531 - Upgrade enigmail to 2:1.9.9-1~deb9u1.
14532 - Upgrade gimp to 2.8.18-1+deb9u1.
14533 - Upgrade imagemagick to 8:6.9.7.4+dfsg-11+deb9u4.
14534 - Upgrade libav (ffmpeg) to 7:3.2.9-1~deb9u1.
14535 - Upgrade libxcursor to 1:1.1.14-1+deb9u1.
14536 - Upgrade libxml-libxml-perl to 2.0128+dfsg-1+deb9u1.
14537 - Upgrade poppler to 0.48.0-2+deb9u1.
14538 - Upgrade rsync to 3.1.2-1 3.1.2-1+deb9u1.
14539 - Upgrade samba to 2:4.5.12+dfsg-2+deb9u1.
14540 - Upgrade sensible-utils to 0.0.9+deb9u1.
14541 - Upgrade tor to 0.3.1.9-1~d90.stretch+1.
14543 * Minor improvements
14544 - Display TopIcons systray on the left of the system menu. This
14545 fixes #14796 (on Buster, it is displayed in the middle of the
14546 screen, on the left of the clock) and an annoying UX problem we
14547 have on Stretch: OpenPGP applet is in the middle of icons that
14548 share the exact same (modern, GNOME Shell-like) behaviour, which
14549 is disturbing when opening one of the modern menus and moving
14550 the mouse left/right to the others, because in the middle one
14551 icon won't react as expected, and the nice blue bottom border
14552 continuity is broken.
14553 - Use the "intel" X.Org driver for integrated graphics in Intel
14554 i5-7300HQ (Closes: #14990).
14555 - Enable HashKnownHosts in the OpenSSH client (Closes: #14995).
14556 Debian enables HashKnownHosts by default via /etc/ssh/ssh_config
14557 for good reasons, let's not revert to the upstream default.
14558 - Pin the AppArmor feature set to the Stretch's kernel one. Linux
14559 4.14 brings new AppArmor mediation features and the policy
14560 shipped in Stretch may not be ready for it. So let's disable
14561 these new features to avoid breaking stuff: it's too hard to
14562 check if all the policy for apps we ship (and that users install
14563 themselves) has the right rules to cope with these new mediation
14567 - Don't delete downloaded debs after install (Closes: #10958).
14568 - Install xul-ext-ublock-origin from sid to make the dashboard
14569 work again(Closes: #14993). Thanks to cacahuatl
14570 <cacahuatl@autistici.org> for the patch!
14571 - Additional software feature: use debconf priority critical to
14572 prevent failure when installing packages otherwise requiring
14573 manual configuration (Closes: #6038)
14574 - Don't include anything under /lib/live/mount/medium/ in the
14575 readahead list (Closes: #14964). This fixes the boot time
14576 regression introduced in Tails 3.3.
14579 - Display a more helpful error message when the 'origin' remote
14580 does not point to the official Tails Git repository. This task
14581 calls git_base_branch_head() which relies on the fact 'origin'
14582 points to our official repo.
14583 - Vagrant: never build the wiki early. This has caused several
14584 issues throughout the years, the lastest instance being the
14585 reopening of #14933. (Closes: #14933)
14586 - Install libelf-dev during the time we need it for building DKMS modules.
14587 - Make the DKMS build hook verbose, and display DKMS modules build
14588 logs on failure. This hook is a recurring cause of headaches,
14589 let's simplify debugging.
14590 - Remove obsolete duplicate build of the virtualbox-guest DKMS
14594 - Log the list of systemd jobs when systemctl is-system-running
14595 fails (Closes: #14772). Listing the units is not enough: in most
14596 cases I've seen, is-system-running returns "starting" which
14597 means the job queue is not empty, and to debug that we need the
14599 - Only support SikuliX; drop support for Sikuli.
14600 - Disable SPICE clipboard sharing in the guest. It could only mess
14601 things up, and in fact has confused me by suddenly setting my
14602 *host's* clipboard to "ATTACK AT DAWN"... :)
14603 - Decode Base64.decode64 return value appropriately; it returns
14604 strings encoded in ASCII-8bit.
14605 - Don't flood the debug logger with the journal contents.
14606 - Handle case where $vm is undefined during an extremely early
14608 - Allow more time for 'systemctl is-system-running' to
14609 succeed. (Refs: #14772)
14610 - Make Sikuli attempt to find replacements on FindFailed by
14611 employing fuzz, or "lowering the similarity factor". The
14612 replacements (if found) are saved among the artifacts, and
14613 serves as potential drop-in-replacements for outdated
14614 images. The main use case for this is when the font
14615 configuration in Tails changes, which normally invalidates a
14616 large part of our images given that our default high similarity
14617 factor. We also add the `--fuzzy-image-matching` where the
14618 replacements are used in case of FindFailed, so the tests can
14619 proceed beyond the first FindFailed. The idea is that a full
14620 test suite run will produce replacements for potentially *all*
14622 - Fix our findAny() vs findfailed_hook. For findAny() it might be
14623 expected that some images won't be found, so we shouldn't use
14624 our findfailed_hook, which is about dealing with the situation
14625 where images need to be updated.
14626 - Make sure Pidgin's D-Bus policy changes are applied (Closes:
14627 #15007). Without the HUP there's a race that we sometimes lose.
14628 - Nump the Unsafe Browser's start page image (Closes: #15006).
14629 - Hot-plug a 'pcnet' network device instead of 'virtio' on Sid,
14630 since the latter is not detected on Sid (Closes: #14819).
14632 -- Tails developers <tails@boum.org> Mon, 08 Jan 2018 16:57:07 +0100
14634 tails (3.3) unstable; urgency=medium
14637 - Upgrade the base system to the Debian Stretch 9.2 point-release
14638 which gives us tons of bugfixes (Closes: #14714).
14639 - Install Linux 4.13.0-1 (Closes: #14789).
14642 - Upgrade Thunderbird to 52.4.0 (Closes: #14963).
14643 - Upgrade Tor Browser to 7.0.10 (Closes: #14940).
14644 - Upgrade gdk-pixbuf to 2.36.5-2+deb9u1.0tails1 (Closes: #14729).
14646 * Minor improvements
14647 - Upgrade to Tor 0.3.1.8-2~d90.stretch+1, a new stable Tor series.
14648 - tails-documentation: rewrite in Python + use WebKit for display
14649 instead of the Tor Browser. Since Tor Browser 7.0.8 rendering of
14650 local pages (like our docs) fail (#14962) so this is probably a
14651 temporary workaround of that.
14652 - Replace the Unsafe Browser's warning pages with static,
14653 pure-HTML versions. This is truly a *temporary* workaround for
14655 - Update deb.tails.boum.org APT repo key (Closes: #14927)
14656 - Refresh Tor Browser AppArmor profile patch to apply on top of
14657 torbrowser-launcher 0.2.8-4's (Closes: #14923).
14658 - Drop obsolete manual enabling of AppArmor on the kernel
14659 command-line: it's now enabled by default, so the (Tails -
14660 Debian) delta gets smaller. :)
14663 - Install Tails Installer 5.0.2. Fixes:
14664 * Most notably, fix an issue preventing Tails Installer from
14665 installing to drives containing a non-Tails partition that
14666 (obviously) has affected a lot of users. (Closes: #14755).
14667 * Fix an issue that made the resulting installations unbootable
14668 if Tails Installer was using a too recent udisks2, e.g. the
14669 one currently in Debian Sid (Closes: #14809).
14670 * Code clean-ups (Closes: #14721, #14722, #14723).
14671 - Fix UEFI boot for USB sticks installed with Universal USB
14672 Installer (Closes: #8992).
14673 - Force Tor Browser and Thunderbird to enable accessibility
14674 support even if no a11y feature is enabled in GNOME yet (Closes:
14676 - Mark our custom Desktop launchers as trusted (Closes: #14793,
14678 - Add a systemd --user target for bits of GNOME
14679 EarlyInitialization managed by systemd, and make the keyboard
14680 layout configuration as part of it. This fixes an issue where
14681 the layout chosen in the Greeter sometimes wasn't applied in the
14682 GNOME session (Closes: #12543).
14685 - auto/{build,clean,config}: run with `set -eu`.
14686 - Add script to sanity check the website. Currently it ensures all
14687 blog posts and security advisories have valid Ikiwiki 'meta
14688 date' directives, since we depend on it for reproducibility.
14689 Also make passing this sanity check a pre-condition for building
14690 the website (Closes: #12726, #14767).
14691 - Abort the ISO build when DKMS modules were not built.
14692 - Take into account where DKMS modules get installed nowadays.
14693 - auto/build: normalize file timestamps in wiki/src before
14694 building. The copy of the website included in the ISO image has
14695 "Posted" timestamps that apparently match when we cloned the Git
14696 repository, which affects reproducibility. (Closes: #14933).
14697 - Fix reproducibility of builds of topic branches that lag behind
14698 their base branch with the mergebasebranch build option enabled.
14699 Two otherwise identical merge commits done at different times
14700 get different IDs, and we happen to embed in the ISO the ID of
14701 the commit we're building from. (Closes: #14946)
14704 - Bump timeout for "I can save the current page as", otherwise the
14705 "The Tor Browser directory is usable" scenario fails randomly
14706 when the system is under load.
14707 - New scenario: installing Tails to an eligible drive with an
14708 existing filesystem. This is a regression test for #14755.
14709 - New scenario: re-installing over an existing Tails installation.
14711 -- Tails developers <tails@boum.org> Tue, 14 Nov 2017 04:53:27 +0100
14713 tails (3.2) unstable; urgency=medium
14716 - Upgrade Linux packages to the Debian kernel 4.12.0-2, based on
14717 mainline Linux 4.12.12 (Closes: #11831, #12732, #14673).
14720 - Upgrade Tor Browser to 7.0.6-build3 (Closes: #14696).
14721 - Upgrade to Thunderbird 52.3.0 (Closes: #12639).
14722 - Deny access to Pidgin's D-Bus service (Closes: #14612). That D-Bus
14723 interface is dangerous because it allows _any_ application running
14724 as `amnesia' that has access to the session bus to extract
14725 basically any information from Pidgin and to reconfigure it:
14726 https://developer.pidgin.im/wiki/DbusHowto
14727 - Block loading of Bluetooth kernel modules (Closes: #14655) and
14728 block Bluetooth devices with rfkill (Closes: #14655).
14729 - Add localhost.localdomain to the hosts file to prevent loopback
14730 leaks to Tor circuits (Closes: #13574). Thanks to tailshark for
14733 * Minor improvements
14734 - Upgrade to Tails Installer 5.0.1 (Closes: #8859, #8860, #12707). This
14735 version gets rid of the splash screen, detects when Tails is already
14736 installed on the target device (and then proposes to upgrade),
14737 and generally improves the UX. It also increases the Tails partition
14738 size and refuses to install to devices smaller than 8 GB.
14739 - Deprecate Thunderbird's preferences/0000tails.js (Closes: #12680).
14740 - Install the BookletImposer PDF imposition toolkit (Closes: #12686).
14742 * Fallback to ~/Tor Browser for uploads (Closes: #8917).
14743 * Silence some common operations that always are denied and
14744 otherwise would spam the journal (Closes: #14606)
14745 - Shell library: remove now unused functions (Closes: #12685).
14746 - Add pppoe to the installed packages (Closes #13463). Thanks to geb
14748 - Replace syslinux:i386 with syslinux:amd64 in the ISO9660
14749 filesystem (Closes: #13513).
14750 - htpdate: fix date header regexp (Closes: #10495). It seems that
14751 some servers (sometimes) do not send their headers with first
14752 letter uppercased, hence a lot of failures to find the date in it.
14753 - Install aufs-dkms from Debian unstable (Closes: #12732).
14754 - Install vim-tiny instead of vim-nox (Closes: #12687). On Stretch,
14755 vim-nox started pulling ruby and rake in the ISO. I think vim-tiny
14756 would be good enough, and would save a few MiB in the ISO. Those
14757 who use vim more intensively and want another flavour of vim are
14758 likely to need persistence anyway, and can thus install a more
14759 featureful vim with the additional software packages feature.
14760 - Remove gksu and its and gconf's dependencies (Closes: #12738). We
14761 use pkexec instead of gksudo. gksu is unmaintained, buggy
14762 (e.g. #12000), and it is the only reason we ship GConf, which we
14763 want to remove. The other removals are:
14764 * libgnomevfs2-extra, which was previously used for SSH/FTP support in
14765 Nautilus, but isn't needed for that any more.
14766 * libgnome2-bin which provides gnome-open, which isn't required by
14767 any application in Tails (as far as we know).
14768 * Configurations and scripts that become obsolete because of these
14770 - Refresh torbrowser-AppArmor-profile.patch to apply cleanly on top
14771 of torbrowser-launcher 0.2.8-1 (Closes: #14602).
14772 - Switch from Florence to GNOME's on-screen keyboard (Closes: #8281)
14773 and incidentally improve accessibility in GTK+ 2.0 and Qt
14774 applications. This drops Florence and the corresponding GNOME
14776 - Make ./HACKING.mdwn a symlink again (Closes: #13600).
14777 - Implement refresh-translations --force .
14778 - Rework how we handle the individual POT files of our applications.
14779 Comparing the new temporary POT files we generate with the
14780 temporary POT files we generated last time (if ever, and if we
14781 did, for which branch?) is not relevant; these POT files are only
14782 used for merging into a new tails.pot and *that* one is relevant
14783 to diff against the old tails.pot.
14784 - Update the Tails signing key. (Closes: #11747)
14786 * Ensure reproducible permissions for /etc/hostname (Closes:
14788 * Patch desktop-file-utils to make its mimeinfo.cache reproducible
14790 * Patch glib2.0 to make its giomodule.cache reproducible (Closes:
14792 * Patch gdk-pixbuf to make its loaders.cache reproducible (Closes:
14794 * Patch gtk2.0 and gtk3.0 to make their immodules.cache
14795 reproducible (Closes: #13440).
14796 * Remove GCconf: it is a source of non-determinism in the
14797 filesystem (element order in /var/lib/gconf/defaults/%gconf-tree-*.xml)
14798 which made Tails unreproducible.
14799 * Ignore comment updates in POT files, which was a source of
14800 non-determinism and therefore prevented Tails from being
14801 reproducible (Closes: #12641).
14802 - Kernel hardening:
14803 * Increase mmap randomization to the maximum supported value
14804 (Closes: #11840). This improves ASLR effectiveness, and makes
14805 address-space fragmentation a bit worse.
14806 * Stop explicitly enabling kaslr: it's enabled by default in
14807 Debian, and this kernel parameter is not supported anymore.
14808 * Disable kexec, to make our attack surface a bit smaller.
14811 - Start Nautilus silently in the background when run as root
14812 (Closes: #12034). Otherwise, after closing Nautilus one gets the
14813 prompt back only after 5-15 seconds, which confuses users and makes
14814 our doc more complicated than it should.
14815 - Ensure pinentry-gtk2 run by Seahorse has the correct $DISPLAY set
14819 - build-manifest-extra-packages.yml: remove squashfs-tools version
14820 we don't use anymore (Closes: #12684). Apparently our
14821 apt-get/debootstrap wrapper tricks are enough to detect the
14822 version of squashfs-tools we actually install and use.
14823 - Merge base branch earlier, i.e. in auto/config instead of
14824 auto/build (Closes: #14459). Previously, a given build from a topic
14825 branch would mix inconsistent versions of things.
14826 - Fail builds started before SOURCE_DATE_EPOCH (Closes:
14827 #12352). Such builds would not be reproducible, and this is an
14828 assumption (a reasonable one!) that we do all over the place, so
14829 let's fail early. While we're at it, let's fail if
14830 SOURCE_DATE_EPOCH is not set as well. Actually we would fail any
14831 way if that was the case when reaching our
14832 99-zzzzzz_reproducible-builds-post-processing build hook, but
14836 - Test the GNOME Root Terminal.
14837 - Take into account that Tails Installer 5.0.1 refuses to install
14838 Tails to devices smaller than 8 GiB. It'll still allow *upgrading*
14839 such sticks though.
14840 - Use 7200 MiB virtual USB drives when we really mean 8 GiB. In the
14841 real world, USB sticks labeled "8 GB" can be much smaller, so
14842 Tails Installer will accept anything that's at least 7200 MiB.
14843 This commit makes us exercise something closer to what happens in
14844 the real world, and incidentally it'll save storage space on our
14845 isotesters and improve test suite performance a bit. :)
14846 - Have unclutter poll every 0.1s instead of continuously. On current
14847 sid, virt-viewer eats a full CPU and doesn't do its job when
14848 "unclutter -idle 0" is running.
14849 - Adapt tests for Tails Installer 5.0.1.
14850 - Workaround Pidgin's DBus interface being blocked since we actually
14851 depend on it for some tests.
14852 - Test that Pidgin's DBus interface is blocked.
14853 - Save more data on test suite failures (Refs: #13541):
14854 * When Tor fails to bootstrap, save Tor logs and chutney nodes
14856 * When Htpdate fails to synchronize the clock, save its logs.
14857 * Always save the systemd journal on failure.
14858 - When testing emergency shutdown, wait longer for Tails to tell
14859 us it has finished wiping the memory. The goal here is to help
14860 us understand whether (Refs: #13462) is a bug in the emergency
14861 shutdown feature or in our test suite.
14862 - Restart nautilus-desktop if Desktop icons are not visible
14864 - Test suite: fix assert_raise() when using ruby-test-unit >=
14865 3.2.5 (Closes: #14654). ruby-test-unit 3.2.5 added native Java
14866 exception support for JRuby. The fact we defined the :Java
14867 constant was enough to trigger that JRuby-specific code, which
14869 - Test suite: take into account that click-to-play is not required
14870 anymore for WebM videos in Tor Browser (Closes: #14586).
14872 -- Tails developers <tails@boum.org> Mon, 25 Sep 2017 22:23:01 +0200
14874 tails (3.1) unstable; urgency=medium
14877 - Upgrade Tor Browser to 7.0.4-build1 (Closes: #13577).
14878 - Upgrade Linux to 4.9.30-2+deb9u3.
14879 - Upgrade libtiff to 4.0.8-2+deb9u1.
14880 - Upgrade bind9 to 1:9.10.3.dfsg.P4-12.3+deb9u2.
14881 - Upgrate evince to 3.22.1-3+deb9u1.
14882 - Upgrade imagemagick 8:6.9.7.4+dfsg-11+deb9u1.
14883 - Ensure Thunderbird cleans its temporary directory. (Closes: #13340).
14885 * Minor improvements
14886 - Patch gconf to produce reproducible XML output (refs: #12738). This is
14887 the temporary solution for #12738 in Tails 3.1 which will be reverted
14888 (and fixed permanently by removing gconf) in Tails 3.2.
14889 - Apply Debian bts patch to cracklib to produce reproducible dictionnaries
14891 - Upgrade to Debian 9.1 (Closes: #13178).
14894 - Replace faulty URL in htpdate neutral pool (Closes: #13472).
14895 - Keep installing a version of Enigmail compatible with Thunderbird 45.x
14897 - Fix the time syncing and Tor notifications translations (Closes: #13437).
14900 - Upgrade the Vagrant basebox for building ISO images to Stretch
14902 - Fix on-disk build by bumping Vagrant build VM memory to 768M
14904 - Fix rescue build option by exporting TAILS_BUILD_FAILURE_RESCUE
14908 - mark gnome screenshot scenario as fragile (refs: #13458)
14909 - mark UEFI scenario as fragile (refs: #13459).
14911 -- Tails developers <tails@boum.org> Sat, 05 Aug 2017 15:25:51 +0200
14913 tails (3.0.1) unstable; urgency=medium
14916 - Upgrade tor to 0.3.0.9-1~d90.stretch+1 (Closes: #13253).
14917 - Upgrade Linux to 4.9.30-2+deb9u2.
14918 - Upgrade libc to 2.24-11+deb9u1.
14919 - Upgrade libexpat1 to 2.2.0-2+deb9u1.
14920 - Upgrade libgcrypt20 to 1.7.6-2+deb9u1.
14921 - Upgrade libgnutls30 to 3.5.8-5+deb9u1.
14922 - Enable Debian security APT sources (Closes: #12309).
14924 * Minor improvements
14925 - Use a higher resolution image in Tails persistence setup
14929 - Forcibly set $SSH_AUTH_SOCK before starting GNOME
14930 Shell. Apparently, due to a race condition, GNOME keyring
14931 sometimes fails to tell the session manager about the correct
14932 SSH_AUTH_SOCK, and thus GNOME Terminal hasn't this variable set
14933 and any ssh process started in there won't use the (perfectly
14934 working) SSH agent (Closes: #12481).
14935 - Fix issue that made Tails Installer rejects working USB drives,
14936 pretending they're not "removable" (Closes: #12696).
14937 - Make behavior of the power button and lid close actions in the Greeter
14938 consistent with the regular GNOME session (Closes: #13000).
14941 - Track the latest debian-security archive for the corresponding
14942 APT sources, and not for the unrelated jessie-updates (Closes:
14944 - Print APT sources used in the build VM, to help debugging issues
14947 -- Tails developers <tails@boum.org> Tue, 04 Jul 2017 15:59:18 +0200
14949 tails (3.0) unstable; urgency=medium
14952 - Upgrade Tor Browser to 7.0.1 (Closes: #12635, #12657).
14953 - Upgrade to a new snapshot of the Debian and Torproject
14954 APT repositories: respectively 2017060904 and 2017060903
14957 * Minor improvements
14958 - Tor Browser: enable Electrolysis (e10s), i.e. render content in a separate
14959 child process, which will allow to improve performance and security
14960 further along the road. This required us to drop our branding add-on
14961 and re-implement its functionality in our Tor Browser wrapper
14963 - Clean obsolete cached packages when using the Additional Software Packages
14964 feature (Closes: #12400).
14965 - Improve KeePassX database migration handling (Closes: #12375).
14966 - Upgrade OnionShare to 0.9.2, from Debian sid as it has been removed
14967 from Stretch (Closes: #12610).
14968 - Upgrade Tor to 0.3.0.8 (Closes: #12656).
14969 - Drop obsolete bilibop patch, that was applied in 0.5.2.1.
14970 - Include disk space usage information in the WhisperBack bug reports.
14971 - Reorder technical details in WhisperBack bug reports in way that makes
14972 more sense when reading them.
14973 - Convert lc.py to Python 3.
14974 - Simplify some Python code thanks to subprocess.check_ouput.
14975 - Set the initial keyboard focus on the "Start Tails" button
14976 in Tails Greeter (Closes: #12509).
14977 - Convert Tails Greeter's Debian packaging to current best practices.
14980 - Fix persistent Thunderbird configuration migration when there is
14981 a mimeTypes.rdf, that doesn't contain any associations to "icedove"
14982 or "/usr/bin/iceweasel" (Closes: #12580).
14983 - Fix persistent browser bookmarks, by generating them from an sqlite dump
14985 - Use the "intel" X.Org driver for Intel Atom/Celeron/Pentium Processor
14986 x5-E8000/J3xxx/N3xxx Integrated Graphics Controller.
14987 - `exec' from our Thunderbird wrapper so it doesn't remain running.
14988 - Tails Installer: don't allow installing on non-removable drives
14990 - Fetch the torbrowser-launcher sources from Debian sid:
14991 it's been removed from Debian testing.
14992 Refresh torbrowser-AppArmor-profile.patch accordingly.
14993 - Unsafe Browser: remove the search bar, that's currently buggy
14994 and its presence only encourages unsupported usage (Closes: #12573).
14995 - Unsafe Browser: disable searching in the address bar. It can result
14996 in leaking hostnames and credentials to the default search
14997 engine operator (Closes: #12540).
14998 - Make our omni.ja modifications reproducible (Closes: #12620).
14999 - Generate the fontconfig cache in a reproducible manner (Closes: #12567).
15000 - Don't include torrents/rss.html in the ISO. It's not generated
15001 in a deterministic manner and is worthless in the ISO (Closes: #12619).
15002 - Improve the language → default keyboard layout mapping
15003 in Tails Greeter (Closes: #12547).
15004 - Don't close Tails Greeter's main window when Alt-F4 is pressed
15008 - Run emergency_shutdown.feature after usb_*.feature, to reduce disk
15009 space requirements (Closes: #12565).
15010 - Deal with server messages in Pidgin.
15011 - Improve Pidgin connectivity check robustness.
15012 - Flag the Synaptic test as fragile (i.e. #12586).
15013 - Optimization: only test once that Tails, booted on DVD, eventually
15014 shuts down after wiping memory.
15015 - Move tests about the shutdown applet to a dedicated feature,
15016 as they have nothing to do with Tails' "emergency" shutdown feature.
15017 - Adapt the network connectivity check to Stretch, and improve it to check
15018 both link and IP connectivity (Closes: #12602).
15019 - Apply a fix from upstream Git to mutter, to fix some of its interactions
15020 with dogtail (Closes: #11718).
15021 - Mark "Scenario: Watching a WebM video" as fragile (i.e. #10442).
15024 - Set create_box -e, to make the vagrant box generation a bit more robust.
15026 - Install kernel from backports and Tails build deps before performing
15027 APT upgrade, to avoid useless bandwidth usage (Closes: #12529).
15028 - Update submodules after merging the base branch (Closes: #12556).
15029 - Rakefile: fix date comparison in basebox:clean_old (Closes: #12575).
15030 - Rakefile: have basebox:clean_old delete baseboxes more than 4 months old
15032 - Also check for fuzzy patches' .orig files at the end of our build hooks,
15033 so we detect any fuzzy patches applied by hooks (Closes: #12617).
15034 - Remove .orig files for patches we allow to be fuzzy.
15035 - Don't pre-build the wiki when mergebasebranch is enabled.
15036 When pre-building the wiki, we modify the PO files which results in a
15037 conflict from the base branch merge in case it modifies the same
15038 files, which breaks the build (Closes: #12611).
15039 - Rakefile: add a task that removes all tails-builder-* libvirt volumes
15042 -- Tails developers <tails@boum.org> Sat, 10 Jun 2017 14:39:10 +0000
15044 tails (3.0~rc1) unstable; urgency=medium
15047 - Install Thunderbird 1:45.8.0-3+tails2 and handle the Icedove → Thunderbird
15048 migration, including wrt. persistent data (Closes: #11712, #12242).
15049 This package also has the patch from
15050 https://bugzilla.mozilla.org/show_bug.cgi?id=1281959 applied,
15051 to ease future integration of the Thunderbird AppArmor profile.
15052 Also, drop the Claws → Icedove migration path.
15053 - Upgrade to a new snapshot of the Debian and Torproject
15054 APT repositories: 2017051803 (Closes: #12554).
15055 - Upgrade Linux packages to the Debian kernel 4.9.0-3, based on
15056 mainline Linux 4.9.25.
15057 - Replace the kexec-based memory erasure feature with the Linux kernel's
15058 memory poisoning (Closes: #12354, #12428). The kexec-based implementation
15059 was not reliable enough and provided a poor UX. Instead, we now return
15060 to the initramfs on shutdown and unmount all filesystems there, so their
15061 content and corresponding caches are erased.
15062 - Upgrade Tor Browser to 7.0a4 based on Firefox 52.1.1esr (Closes:
15064 * Unfortunately e10s (multi-process Firefox) is disabled (#12569).
15065 * Unfortunately persistent bookmarks created for the first time
15066 in Tails 3.0~rc1 is broken (#12568).
15067 * Adds exceptions for the extensions Tails installs on top of
15068 the vanilla Tor Browser (Closes: #11419).
15069 - Upgrade tor to 0.3.0.7-1 (Closes: #12485) and log both to the
15070 usual file and the journal (Closes: #12412).
15071 - Merge the code that makes Tails almost build reproducibly (Refs:
15072 #5630); we still have issues with the fontconfig cache (Refs:
15075 * Minor improvements
15076 - Add a HACKING document for new code contributors (Closes:
15078 - Rename tor-controlport-filter to onion-grater (Closes: #12394)
15079 and import patches killing the delta against Whonix version
15081 - Improve onion-grater; thanks to Joy SN <joysn1980@yahoo.com>
15082 for the original patches (Closes: #12173):
15083 · add --listen-interface
15084 · make stdout/stderr unbuffered to ensure Python exceptions are logged
15085 · use yaml.safe_load()
15086 - Improve KeePassX database migration handling (refs: #12375).
15087 - Electrum: set coin selection strategy to 'Privacy' (Closes: #12177).
15088 - Allow Onion Circuits to access /proc/pid/status.
15089 - Make gdm-shell-tails.desktop more similar to the one shipped
15090 in gnome-shell 3.22.3-3 (refs: #12364).
15091 - Greeter: have the help window point to updated documentation,
15092 use WebKit2 instead of the deprecated WebKit, and hide the sidebar
15094 - Use exec to start KeePassX, i.e. avoid leaving the wrapper running.
15097 - Install xserver-xorg-legacy, to fix support for various graphics
15098 adapters that still don't work with rootless X.Org (Closes: #12542).
15099 - Use the "intel" X.Org driver for Intel Q35 and Intel Atom
15100 D4xx/D5xx/N4xx/N5xx graphics controllers (refs: #12219).
15101 - Give UEFI bootloaders upper-case filenames (Closes: #12511).
15102 Some UEFI firmware, such as the one in the ThinkPad X220, only recognize
15103 them if they have an upper-case name.
15104 - KeePassX: enable "Automatically save after each change" again,
15105 like we did in Tails 2.x (fixes a regression introduced
15107 - Install packages needed by the "Test speakers" functionality
15109 - Fix automatic upgrades when one is already applied (Closed:
15111 - When generating the network device blacklist, also blacklist
15112 network drivers from the staging directory (Closes: #12362).
15113 - htpdate pool: replace www.sarava.org with leap.se. The former
15114 has been down for a while and it's not clear when it's going to
15115 be stable again. The latter should be reliable.
15118 - Check that dirmngr used the configured keyserver (Closes: #12371).
15119 - Sanity check that Chutney starts all nodes in the network.
15120 - Disable the Sandbox option for all nodes, until Tor#21943
15121 is fixed (Closes: #12512).
15122 - Wait for the desktop icons to be displayed in the "Tails desktop is ready"
15123 step. Let's not try interacting with the desktop earlier.
15124 - Add tests for memory erasure on "normal" shutdown (refs: #12428).
15125 - Add tests for memory erasure on "emergency" shutdown, and run some
15126 with network enabled (refs: #12354).
15127 - Have eject_cdrom run eject(1) like it used to do in the past.
15128 Otherwise the machine is immediately halted and we cannot test
15129 whether memory has been erased.
15130 - Pass mount_USB_drive structured data instead of free-form text.
15131 - Test that MAC spoofing and "Disable network" works for
15132 hotplugged networking devices (Refs: #12362).
15135 - Generate the Vagrant base box locally as part of the build process,
15136 instead of downloading it: one less binary blob as input in the build
15137 process (refs: #12409).
15138 - Use Vagrant for builds on Jenkins too (Closes: #11972).
15139 - Tell build script to be more verbose.
15140 - Respect the 'ARTIFACTS' environment variable if set.
15141 - Add a second disk to handle the apt-cacher-ng cache, and store
15142 the corresponding logs in there (Closes: #11979).
15143 - Use APT snapshots in Vagrant build VMs, create/use a basebox that matches
15144 the branch/tag/commit being tested, and provision a new VM for each build
15145 (Closes: #11980, #11981).
15146 - Ship all build dependencies in the Vagrant basebox, to save some
15147 time when building ISOs.
15148 - Make basebox generation compatible with both GnuPG 1.x and 2.x.
15149 - Set LC_ALL=C, mostly to suppress some warnings.
15150 - Support forcing VM cleanup before/after build.
15151 - Add tasks for cleaning up old or all base boxes (refs: #12409).
15152 - Add build option useful for debugging build failures.
15153 - Remove obsolete build options.
15154 - Make auto/scripts/utils.sh more reusable, use it in Rakefile,
15155 auto/build and setup-tails-builder.
15156 - Add an option controlling whether to merge the base branch.
15157 - Add "rake test" target and import logics from puppet-tails'
15158 wrap_test_suite script.
15159 - Build Tails as a release simply when HEAD is tagged, i.e. we do not
15160 require building from a detached head any more.
15161 - Sanity check compression choice when building a release.
15162 - Use the host's resolv.conf when building the Vagrant base box.
15163 Since systemd-networkd is used to manage resolv.conf inside the base box,
15164 and it hasn't been initialized yet (we are not booting it, just chrooting
15165 into it) DNS is broken otherwise.
15166 - Release process: "release" a new base box when freezing.
15167 - Chown/scp artifacts with a single command to limit overhead and warnings
15168 noise caused by repeated SSH calls.
15169 - Add a build options to use a custom CPU model, and custom
15170 machine type, for reproducibility testing (refs: #12345).
15171 - Add support for installing Tor Browser nightly builds.
15173 -- Tails developers <tails@boum.org> Sat, 20 May 2017 16:48:45 +0200
15175 tails (3.0~beta4) unstable; urgency=medium
15178 - All changes brought by Tails 2.12.
15179 - Upgrade to a new snapshot of the Debian and Torproject
15180 APT repositories (2017041704).
15182 * Security improvements
15183 - Enable the buddy page allocator free poisoning (Closes: #12089).
15184 - Enable slub/slab allocator free poisoning (Closes: #12090).
15185 - Create IUKs (automatic upgrades) in a reproducible manner
15188 * Minor improvements
15189 - Firewall: forbid the _apt user to talk to DNS ports. APT works very well
15190 without DNS access since we only have Onion APT sources, so let's silence
15192 - Replace Pidgin's "systray" icon with the guifications plugin
15193 (Closes: #11741). We're trying to remove as much as we can from
15194 the set of icons managed by TopIcons extension flavours, in the hope
15195 it's enough to cancel the problems we've seen with them (#10576, #11737).
15196 - Disable apt-daily.timer, that can only cause problems in our context
15198 - Do not let pppd-dns manage /etc/resolv.conf (Closes: #12401).
15199 - Ensure rootless X.Org can access /dev/fb0 when started by GDM.
15200 - Include the amdgpu module in the initramfs (refs: #12218).
15201 - Tails Greeter: don't mention 'firewall' anymore (#12382).
15202 - Tails Greeter: avoid the popover menu for Formats being cut,
15203 in most cases (Closes: #12249).
15204 - Tails Greeter: disable the screensaver (Closes: #12370).
15205 - Tails Greeter: fix behavior when pressing Enter in the language selection
15206 menu (Closes: #12359).
15209 - Install speech-dispatcher-espeak-ng to fix the Orca screen reader
15211 - Install xserver-xorg-video-intel and use it on a few graphics adapters
15212 that are not supported correctly by the modesetting driver (refs: #12219).
15213 More PCI IDs will be added as new affected hardware is reported.
15216 - Run on a Q35 2.8 machine (Closes: #11605).
15217 - Deprecate xtightvncviewer in favor of tigervnc-viewer.
15218 - Test the Unsafe Browser in 3 random supported languages, not all.
15219 This should be enough to identify most future regressions in this area,
15220 and will be much faster than testing them all.
15221 - Pidgin tests: switch to an image that doesn't depend on the
15222 topic of tails@conference.riseup.net.
15223 - Fix a problematic use of try_for.
15224 - Fix VM.select_virtual_desktop() and VM.do_focus().
15225 - Random Gherkin improvements.
15226 - Fix a focus issue for GNOME Terminal vs. Tails Installer.
15227 - Adjust to kernel memory poisoning being enabled, which breaks the way
15228 we used to test memory erasure (refs: #12354):
15229 · Drop "no memory erasure" and "memory erasure" tests, that can't work
15231 · Test erasure of memory freed by a killed userspace process.
15232 · Test that memory poisoning applies to unmounted tmpfs.
15233 · Test that memory poisoning applies to read and write cache
15234 for unmounted vfat and LUKS-encrypted ext4.
15235 · Run erase_memory a bit later, it requires less disk space nowadays.
15237 -- Tails developers <tails@boum.org> Tue, 18 Apr 2017 13:01:25 +0000
15239 tails (2.12) unstable; urgency=medium
15242 - Completely remove I2P. :( We have decided to remove I2P (see
15243 #11276) due to our failure of finding someone interested in
15244 maintaining it in Tails (Closes: #12263).
15245 - Upgrade the Linux kernel to 4.9.13-1~bpo8+1 (Closes: #12122).
15248 - Upgrade Tor Browser to 6.5.2 based on Firefox 45.9. (Closes:
15250 - Mount a dedicated filesystem on /var/tmp, to mitigate the
15251 hardlinks permissions open by the user-tmp abstraction. See
15252 https://labs.riseup.net/code/issues/9949#note-23 for details
15254 - Protect against CVE-2017-2636 by disabling the n-hdlc kernel
15255 module (Closes: #12315).
15256 - Ensure /etc/resolv.conf is owned by root:root in the SquashFS.
15257 lb_chroot_resolv will "cp -a" it from the source tree, so it
15258 inherits its ownership from the whoever cloned the Git
15259 repository. This has two problems. First, this results in unsafe
15260 permissions on this file (e.g. a Vagrant build results in the
15261 'amnesia' user having write access to it).
15262 - Upgrade libjasper1 to 1.900.1-debian1-2.4+deb8u3
15263 - Upgrade gstreamer and its plugins to 1.4.4-2+deb8u1.
15264 - Upgrade eject to 2.1.5+deb1+cvs20081104-13.1+deb8u1.
15265 - Upgrade imagemagick to 8:6.8.9.9-5+deb8u8.
15266 - Upgrade pidgin to 2.11.0-0+deb8u2.
15267 - Upgrade samba to 2:4.2.14+dfsg-0+deb8u5.
15270 * Minor improvements
15271 - Don't add the live user to the "audio" group. This should not be
15272 needed on a modern Linux desktop system anymore (Closes:
15274 - Install virtualbox-* 5.1.14-dfsg-3~bpo8+1 from our custom APT
15275 repository (Closes: #12307).
15276 - Install virtualbox-guest-* from sid. The version currently in
15277 jessie-backports is not compatible with Linux 4.9, and there's
15278 basically no chance that it gets updated (the maintainer asked
15279 for them to be *removed* from jessie-backports) (Closes:
15281 - Pull ttdnsd from our custom APT repository. It's gone from the
15282 TorProject one. We removed ttdnsd on feature/stretch already, so
15283 we'll need to pull it from our custom APT repository only for
15285 - Clean up libdvd-pkg build files, again. This cleanup operation
15286 was mistakenly removed in commit c4e8744 (Closes: #11273).
15287 - Install gnome-sound-recorder (Closes #10950). Thanks to Austin
15288 English <austinenglish@gmail.com> for the patch!
15289 - Stop restarting tor if bootstrapping stalls. It seems tor might
15290 have fixed the issues we used (see: #10238, #9516) to experience
15291 with the bootstrap process stalling and requiring a restart to
15292 kickstart it (Closes: #12411).
15293 - tor.sh: communicate via the UNIX socket instead of TCP port.
15294 This makes the library usable when run inside systemd units that
15295 have `PrivateNetwork=yes` set.
15296 - Get tor's bootstrap progress via GETINFO instead of log
15298 - Upgrade tor to 0.2.9.10-1~d80.jessie+1
15301 - mirror-pool-dispatcher: bump maximum expected mirrors.json size
15302 to 32 KiB. This fixes an error where Tails Upgrader would
15303 complain with "cannot choose a download server" (Closes:
15307 - Retry curl and APT operations up to 20 times to make the ISO
15308 build more robust wrt. unreliable Internet connectivity. Thanks
15309 to Arnaud <arnaud@preev.io> for the patch!
15310 - Install ikiwiki from jessie-backports, instead of our patched
15311 one. Our changes were merged in 3.20161219, and jessie-backports
15312 now has 3.20170111~bpo8+1 (Closes: #12051).
15313 - Fix FTBFS when installing a .deb via config/chroot_local-packages
15314 by being more flexible when matching local packages in the apt
15315 list file (Closes: #12374). Thanks to Arnaud <arnaud@preev.io>
15317 - auto/build: support Stretch's GnuPG v2 keyring filename.
15320 - Try possible fix for #11508. IPv6Packet:s' source is accessed by
15321 `.ipv6_saddr`, not `ip_saddr` (that's for IPv4Packet). So, let's
15322 just try and see which one of the two each packet has, because
15323 one of them must be there! Also, given that UDPPacket can be
15324 either IPv4 or IPv6 it seems safest to try to parse each packet
15325 as IPv6Packet first -- that way we keep looking at transport
15326 layer protocols for IPv4 only, and treat everything IPv6 as the
15327 same, which makes sense, since we should block all IPv6, so
15328 everything should be treated the same at all times.
15329 - Changes due to #12411:
15330 * Raise special exception for Tor bootstrap failures.
15331 * Remove obsolete debug logging now that we don't log anything
15332 interesting for `restart-tor` any more.
15334 -- Tails developers <tails@boum.org> Tue, 18 Apr 2017 17:41:46 +0200
15336 tails (3.0~beta3) unstable; urgency=medium
15338 * Major new features and changes
15339 - Make the "Formats" settings in Tails Greeter take effect (Closes: #12079,
15340 new feature that was broken since it was introduced in 3.0~alpha1).
15341 - Upgrade to a new snapshot of the Debian and Torproject
15342 APT repositories (2017031702).
15345 - Stop including I2P: we decided (#11276) to remove I2P, due to our failure
15346 at finding someone to maintain it in Tails (Closes: #12263).
15349 - Upgrade MAT to 0.6.1-4: fixes silent failure of the Nautilus
15350 contextual menu extension.
15351 - Ensure /etc/resolv.conf is owned by root:root in the SquashFS
15353 - Protect against CVE-2017-2636 by disabling the n-hdlc kernel module
15356 * Minor improvements
15357 - Reintroduce the X11 guest utilities for VirtualBox (regression
15358 introduced in 3.0~beta2).
15359 - Upgrade X.Org server and the modesetting driver (hopefully helps
15361 - Automate the migration from KeePassX databases generated on Tails 2.x
15362 to the format required by KeePassX 2.0.x (Closes: #10956, #12369).
15363 - Add keyboard shortcuts in Tails Greeter (Closes: #12186, #12063).
15364 - Install dbus-user-session (regression introduced in 3.0~beta2).
15365 - Manage temporary directories in a declarative way (tmpfiles.d).
15366 - Replace references to the /var/run compatibility symlink
15367 with the canonical /run.
15368 - Update our Torbirdy patchset to the latest one sent upstream.
15369 - Install mesa-utils, so that Qt 5 can detect whether software based
15370 rendering is needed.
15371 - Have Tails Greeter honor the "debug" kernel command-line option,
15372 for easier debugging (Closes: #12373).
15373 - Refactor Tails Greeter to reduce code duplication (Closes: #12247).
15376 - Fix sizing of zenity dialogs (Closes: #12313, regression introduced
15378 - Fix confusing, spurious error messages in command-line applications
15379 wrapped with torsocks:
15380 · Ship a /etc/mailname file with content "localhost".
15381 Otherwise something (Git? libc6?) tries to resolve the "amnesia" host
15382 name, which fails, and a confusing error message is displayed
15383 (Closes: #12205, regression introduced in 3.0~alpha1).
15384 · Have torsocks allow UDP connections to the loopback interface,
15385 with AllowOutboundLocalhost 2 (Closes: #11736).
15388 - Improve debugging info logging for PacketFu parsing issues,
15389 and implement a plausible fix (refs: #11508).
15390 - Try to make "double-click on desktop launcher" more reliable.
15391 - Fix selection of ISO in Tails Installer.
15392 - Re-enable the GnuPG tests that require a keyserver, pointing them
15393 to an Onion service we run on Chutney, that redirects all TCP traffic
15394 to a real, clearnet keyserver (Closes: #12211).
15395 - Implement a workaround for checking the configured keyserver in GnuPG,
15396 until a better fix is implemented (refs: #12371).
15397 - Fix the "Report an Error launcher" scenario in German.
15400 - Retry curl and APT operations up to 20 times to make the ISO build
15401 more robust wrt. unreliable Internet connectivity.
15402 Thanks to Arnaud <arnaud@preev.io> for the patch!
15403 - Install ikiwiki from jessie-backports, instead of our patched one
15405 - Clean up libdvd-pkg build files, again (Closes: #11273).
15406 - Rakefile: fix TAILS_OFFLINE_BUILD exported variable name.
15407 - Adjust apt-mirror to support branches based on feature/stretch
15408 that don't use frozen APT snapshots.
15410 -- Tails developers <tails@boum.org> Sun, 19 Mar 2017 15:10:28 +0100
15412 tails (3.0~beta2) unstable; urgency=medium
15414 * All changes brought by Tails 2.11, except:
15415 - the test suite changes, that are not all compatible with this branch;
15416 - the "Tails 3.0 will require a 64-bit processor" notification:
15417 this advance warning is not useful on a release series
15418 that's 64-bit only.
15420 * Major new features and changes
15421 - Upgrade to a new snapshot of the Debian APT repositories (2017030802),
15422 and of the Torproject ones (2017030801).
15423 - Upgrade Linux to 4.9.0-2 (version 4.9.13-1).
15425 * Minor improvements
15426 - Improve GNOME Shell Window List styling. (Closes: #12233)
15429 - Make it possible to start graphical applications in the Root Terminal.
15433 - Improve robustness when dealing with notifications. (Closes: #11464)
15434 - Bump timeout when waiting for 'Tor is ready' notification.
15435 - Fix the incremental upgrade test.
15436 - Drop a few obsolete test cases, update a number of images.
15437 - Adapt firewall leak test to new DHCP source IP address.
15438 - Adjust Seahorse and Enigmail tests to the keyserver that is now used.
15440 -- Tails developers <tails@boum.org> Wed, 08 Mar 2017 16:29:44 +0000
15442 tails (2.11) unstable; urgency=medium
15445 - Upgrade Tor Browser to 6.5.1 based on Firefox 45.8. (Closes:
15447 - Fix CVE-2017-6074 (local root privilege escalation) by disabling
15448 the 'dccp' module. (Closes: #12280)
15449 - Disable kernel modules for some uncommon network protocol. These
15450 are the ones recommended by CIS. (Part of: #6457)
15451 - Disable modules we blacklist for security reasons. Blacklisted
15452 (via `blacklist MODULENAME`) modules are only blocked from being
15453 loaded during the boot process, but are still loadable with an
15454 explicit `modprobe MODULENAME`, and (worse!) via kernel module
15456 - Upgrade linux-image-4.8.0-0.bpo.2-686-unsigned to 4.8.15-2~bpo8+2.
15457 - Upgrade bind9 to 1:9.9.5.dfsg-9+deb8u10.
15458 - Upgrade imagemagick to 8:6.8.9.9-5+deb8u7.
15459 - Upgrade libevent-2.0-5 to 2.0.21-stable-2+deb8u1.
15460 - Upgrade libgd3 to 2.1.0-5+deb8u9.
15461 - Upgrade libjasper1 to 1.900.1-debian1-2.4+deb8u2.
15462 - Upgrade liblcms2-2 to 2.6-3+deb8u1.
15463 - Upgrade libxpm4 to 1:3.5.12-0+deb8u1.
15464 - Upgrade login to 1:4.2-3+deb8u3.
15465 - Upgrade ntfs-3g to 1:2014.2.15AR.2-1+deb8u3.
15466 - Upgrade openjdk-7-jre to 7u121-2.6.8-2~deb8u1.
15467 - Upgrade openssl to 1.0.1t-1+deb8u6.
15468 - Upgrade tcpdump to 4.9.0-1~deb8u1.
15469 - Upgrade vim to 2:7.4.488-7+deb8u2.
15470 - Upgrade libreoffice to 1:4.3.3-2+deb8u6.
15472 * Minor improvements
15473 - import-translations: also import PO files for French from
15474 Transifex. The translation team for French switched to Transifex
15475 even for our custom programs:
15476 https://mailman.boum.org/pipermail/tails-l10n/2016-November/004312.html
15477 - Notify the user, if running on a 32-bit processor, that it won't
15478 be supported in Tails 3.0 anymore. (Closes: #12193)
15479 - Notify I2P users that I2P will be removed in Tails
15480 2.12. (Closes: #12271)
15483 - Disable -proposed-updates at boot time. If a Debian point
15484 release happens right after a freeze but we have decided to
15485 enable it before the freeze to get (at least most of) it, then
15486 we get in the situation where -proposed-updates is enabled in
15487 the final release, which we don't want. We only want it enabled
15488 at build time. (Closes: #12169)
15489 - Ferm: Use the variable when referring to the Live user. The
15490 firewall will fail to start during early boot otherwise since
15491 the "amnesia" user hasn't been created yet. (Closes: #12208)
15492 - Tor Browser: Don't show offline warning when opening local
15493 documentation. (Closes: #12269)
15494 - tails-virt-notify-user: use the tails-documentation helper to
15495 improve UX when one is not connected to Tor yet, and display
15496 localized doc when available.
15497 - Fix rare issue causing automatic upgrades to not apply properly
15498 (Closes: #8449, and hopefully #11839 as well):
15499 * Allow the tails-install-iuk user to run "/usr/bin/nocache
15500 /bin/cp *" as root.
15501 * Install tails-iuk 2.8, which will use nocache for various file
15502 operations, and sync writes to the installation medium.
15503 - Install Linux 4.8.15 to prevent GNOME from freezing with Intel
15504 GM965/GL960 Integrated Graphics. (Closes: #12217, but fixes tons
15505 of other small bugs)
15508 - Add 'offline' option, making it possible to build Tails offline
15509 (if all needed resources are present in your cache). (Closes:
15513 - Encapsulate exec_helper's class to not "pollute" the global
15514 namespace with all our helpers. This is an example of how we can
15515 work towards #9030.
15516 - Extend remote shell with *safe* file operations. Now we can
15517 read/write/append *any* characters without worrying that it will
15518 do crazy things by being passed through the shell, as was the
15519 case before. This commit also:
15520 * adds some better reporting of errors happening on the server
15521 side by communicating back the exception thrown.
15522 * removes the `user` parameter from the VM.file_* methods. They
15523 were not used, any way, and simply do not feel like they
15524 fit. I think the only reason we had it initially was because
15525 it was implemented via the command interface, where a user
15526 concept makes a lot of sense.
15527 - debug_log() Dogtail script content on failure.
15528 - Add a very precise timestamp to each debug_log().
15529 - Make robust_notification_wait() ensure the applet is closed. In
15530 robust_notification_wait() when we close the notification
15531 applet, other windows may change position, creating a racy
15532 situation for any immediately following action aimed at one such
15533 window. (Closes: #10381)
15534 - Fix I2P's Pidgin test. The initial conversation (that determines
15535 the title of the conversation window) is now made by a different
15536 IRC service than before.
15537 - Use lossless compression for the VNC viewer with --view.
15538 Otherwise the VNC viewer is not a good place to extract test
15539 suite images from, at least with xtigervncviewer.
15540 - Add optional pause() notification feature to the test suite. It
15541 will run a user-configurable arbitrary shell command when
15542 pause() is called, e.g. on failure when --interactive-debugging
15543 is used. This is pretty useful when multitasking with long test
15544 suite runs, so you immediately are notified when a test fails
15545 (or when you reached a temporary pause() breakpoint). (Closes:
15547 - Add the possibility to run Python code in a persistent session
15548 in the remote shell and use this for Dogtail to significantly
15549 improve its performance by saving state and reusing it between
15550 commands. This changes the semantics of the creation of Dogtail
15551 objects. Previously they just created the code that then would
15552 be run once an actionable method was called (.wait, .click etc),
15553 but now it works like in Python, that Dogtail will try to find
15554 the graphical element upon object creation. (Closes: #12059)
15555 - Test that we don't ship any -proposed-updates APT sources.
15557 - Make force_new_tor_circuit() respect NEWNYM rate limiting.
15558 - Add retry magic for lost click when opening Tails' documentation
15559 from the desktop launcher. (Closes: #12131)
15561 -- Tails developers <tails@boum.org> Mon, 06 Mar 2017 17:14:52 +0100
15563 tails (3.0~beta1) experimental; urgency=medium
15565 * All changes brought by Tails 2.7.1, 2.9.1 and 2.10.
15567 * Major new features and changes
15568 - Redesigned Tails Greeter.
15569 - Upgrade to a new snapshot (2017013002) of the Debian and Torproject
15571 - Upgrade Linux to 4.9.0-1.
15574 - Reject packets sent on the LAN to the NetBIOS name service
15576 - Seahorse: use the Tor OnionBalance hidden service pool,
15577 which provides transport encryption and authentication of the keyserver.
15579 * Minor improvements
15580 - Include adwaita-qt* and enable it by default, so that Qt applications
15581 integrate nicely into a GNOME environment (Closes: #11790).
15582 - Add support for the TREZOR hardware wallet in Electrum (Closes: #10964).
15583 - AppArmor: allow all programs to read /etc/tor/torsocks.conf via
15584 abstractions/base, to ease maintenance.
15585 - Don't (try to) bind the Power button to the shutdown action
15587 - Enable natural scrolling (Closes: #11969).
15588 - Update uBlock Origin patterns + settings file.
15589 - live-persist: remove Squeeze → Wheezy migration code.
15590 - Update pre-existing persistent GnuPG configuration on login
15592 - Upgrader: use the alpha channel when the next version will be an
15593 alpha, beta, or RC. This will allow users of 3.0~betaN to upgrade to
15594 the next beta or RC, without having to type any command-line
15598 - Fix "upgrade from ISO" when run from a 32-bit system,
15599 such as Tails 2.x (Closes: #11873).
15600 - Fix ability to read videos over HTTPS with Totem (Closes: #11963).
15601 - Re-introduce default directories in $HOME, which fixes
15602 Spice file transfers (Closes: #11968).
15603 - Re-enable tap-to-click (Closes: #11993).
15604 - Lower systemd's DefaultTimeoutStopSec, to get rid of a long delay
15605 before memory wiping starts. This also prevents shutdown from ever
15606 being blocked by any buggy service that takes a while to stop
15608 - Drop Jessie APT sources.
15609 - Re-add VirtualBox DKMS modules.
15610 - Fix GnuPG communication with keyservers, by using the Tor OnionBalance
15611 hidden service pool (Closes: #12202).
15612 - Fix Enigmail communication with keyservers, by teaching Torbirdy
15613 not to break it (Closes: #11948):
15614 · Patch Torbirdy to allow not breaking keyserver communication when
15615 using GnuPG v2.1+, and to use a better default keyserver.
15616 · Torbirdy: enable the new behaviour made possible by the aforementioned
15617 patch (extensions.enigmail.already_torified).
15618 · Torbirdy: drop our custom keyserver configuration, since the
15619 aforementioned patch makes it the default.
15622 - Don't install gnome-system-log anymore (Closes: #12133).
15623 It's deprecated in GNOME, and mostly useless anyway as it's not
15624 Journal-aware. It's replacement (gnome-logs) is not usable
15625 enough in the context of Tails, and most users who can read logs
15626 should manage to do it with journalctl, so don't install it either.
15627 - Drop multiarch handling: Tails 3.0 will be amd64-only (Closes: #11961).
15630 - Disable eatmydata usage and caching: in current Stretch, debootstrap fails
15631 if we use eatmydata + the operation mode picked by live-build when caching
15632 is enabled (Closes: #12052).
15633 - Bump disk space (and memory for in-RAM builds) requirements.
15634 - Follow replacement of python-reportbug with python3-reportbug.
15635 - Don't try to deinstall packages that are unknown on Stretch.
15636 - Move AppArmor aliases to a dedicated file, and include it.
15637 This will avoid maintaining these settings as a patch.
15638 - Don't attempt to remove the usr.bin.chromium-browser AppArmor profile:
15639 it's not shipped in Debian anymore.
15642 - Add optional pause() notification (Closes: #12175).
15643 - Make the remote shell's file operations robust (Closes: #11887).
15644 - Update a number of test cases for Stretch, sometimes by converting
15646 - Drop usage and tests of read-only persistence.
15647 We won't have this option anymore, and it's not even sure we'll
15648 reintroduce it (Refs: #12093, Closes: #12055).
15649 - Adjust CONFIGURED_KEYSERVER_HOSTNAME to match current settings.
15650 - Test suite: clean up disks between features.
15652 * Adjustments for Debian 9 (Stretch) with no or very little user-visible impact
15653 - Adjust dpkg-divert path: it has moved.
15654 - Replace xfonts-wqy with fonts-wqy-microhei + fonts-wqy-zenhei.
15655 The former was removed from Debian testing, and the latter are recommended
15656 by task-chinese-s-desktop and task-chinese-t-desktop.
15657 - Install virtualbox* from sid.
15658 It was removed from testing due to https://bugs.debian.org/794466.
15659 - Drop deprecated settings from org/gnome/settings-daemon/plugins/power.
15660 - Update settings name in org/gnome/desktop/peripherals/touchpad, and drop
15662 - Adjust to changed Liferea's .desktop filename.
15663 - Also torify Liferea when started via its (new) D-Bus service.
15664 - Install hunspell-pt-br instead of hunspell-pt-pt.
15665 Tor Browser 6.5 moved from pt-PT to pt-BR, which is fine vs
15666 spellcheckers in Jessie since its hunspell-pt provides both -pt and
15667 -br, but in Stretch they are separate packages.
15668 - AppArmor: adjust usr.sbin.cupsd profile so it loads successfully
15670 - Migrate from netstat to ss.
15671 - Update extensions.enigmail.configuredVersion.
15672 - Remove the jessie-proposed-updates APT sources.
15674 -- Tails developers <tails@boum.org> Wed, 01 Feb 2017 19:23:03 +0000
15676 tails (2.10) unstable; urgency=medium
15678 * Major new features and changes
15679 - Upgrade the Linux kernel to 4.8.0-0.bpo.2 (Closes: #11886).
15680 - Install OnionShare from jessie-backports. Also install
15681 python3-stem from jessie-backports to allow the use of ephemeral
15682 onion services (Closes: #7870).
15683 - Completely rewrite tor-controlport-filter. Now we can safely
15684 support OnionShare, Tor Browser's per-tab circuit view and
15687 * Handle multiple sessions simultaneously.
15688 * Separate data (filters) from code.
15689 * Use python3-stem to allow our filter to be a lot more
15690 oblivious of the control language (Closes: #6788).
15691 * Allow restricting STREAM events to only those generated by the
15692 subscribed client application.
15693 * Allow rewriting commands and responses arbitrarily.
15694 * Make tor-controlport-filter reusable for others by e.g. making
15695 it possible to pass the listen port, and Tor control
15696 cookie/socket paths as arguments (Closes: #6742). We hear
15697 Whonix plan to use it! :)
15698 - Upgrade Tor to 0.2.9.9-1~d80.jessie+1, the new stable series
15702 - Upgrade Tor Browser to 6.5 based on Firefox 45.7 (Closes: #12159)
15703 - Upgrade Icedove to 1:45.6.0-1~deb8u1+tail1s.
15704 - Upgrade bind9-packages to 1:9.9.5.dfsg-9+deb8u9.
15705 - Upgrade pcscd to 1.8.13-1+deb8u1.
15706 - Upgrade libgd3 to 2.1.0-5+deb8u8.
15707 - Upgrade libxml2 to 2.9.1+dfsg1-5+deb8u4.
15708 - Upgrade tor to 0.2.9.9-1~d80.jessie+1.
15709 - Upgrade samba-libs to 2:4.2.14+dfsg-0+deb8u2.
15711 * Minor improvements
15712 - Enable and use the Debian Jessie proposed-updates APT
15713 repository, anticipating on the Jessie 8.7 point-release
15715 - Enable the per-tab circuit view in Tor Browser (Closes: #9365).
15716 - Change syslinux menu entries from "Live" to "Tails" (Closes:
15717 #11975). Also replace the confusing "failsafe" wording with
15718 "Troubleshooting Mode" (Closes: #11365).
15719 - Make OnionCircuits use the filtered control port (Closes:
15721 - Make tor-launcher use the filtered control port.
15722 - Run OnionCircuits directly as the Live user, instead of a
15723 separate user. This will make it compatible with the Orca screen
15724 reader (Closes: #11197).
15725 - Run tor-controlport-filter on port 9051, and the unfiltered one
15726 on 9052. This simplifies client configurations and assumptions
15727 made in many applications that use Tor's ControlPort. It's the
15728 exception that we connect to the unfiltered version, so this
15729 seems like the more sane approach.
15730 - Remove tor-arm (Nyx) (Closes: #9811).
15731 - Remove AddTrust_External_Root.pem from our website CA bundle. We
15732 now only use Let's Encrypt (Closes: #11811).
15733 - Configure APT to use Debian's Onion services instead of the
15734 clearnet ones (Closes: #11556).
15735 - Replaced AdBlock Plus with uBlock Origin (Closes: #9833). This
15736 incidentally also makes our filter lists lighter by
15737 de-duplicating common patterns among the EasyList filters
15738 (Closes: #6908). Thanks to spriver for this first major code
15740 - Install OpenPGP Applet 1.0 (and libgtk3-simplelist-perl) from
15741 Jessie backports (Closes: #11899).
15742 - Add support for exFAT (Closes: #9659).
15743 - Disable unprivileged BPF. Since upgrading to kernel 4.6,
15744 unprivileged users can use the bpf() syscall, which is a
15745 security concern, even with JIT disabled. So we disable that.
15746 This feature wasn't available before Linux 4.6, so disabling it
15747 should not cause any regressions (Closes: #11827).
15748 - Add and enable AppArmor profiles for OnionCircuits and OnoinShare.
15749 - Raise the maximum number of loop devices to 32 (Closes: #12065).
15750 - Drop kernel.dmesg_restrict customization: it's enabled by
15751 default since 4.8.4-1~exp1 (Closes: #11886).
15752 - Upgrade Electrum to 2.7.9-1.
15753 - Make the Electrum proxy configuration apply after upgrading to
15754 2.7.9-1. These changes incidentally makes Electrum behave nicer:
15755 users will now not be presented the network configuration part
15756 of the setup wizard -- a server will be picked randomly, and
15757 Electrum will auto-connect. The automated test suite is adjusted
15758 accordingly (Closes: #12140).
15759 - Remove unused Browser profile seed file localstore.rdf which was
15760 made obsolete in Firefox 34.
15761 - Tor Browser: switch from pt-PT to pt-BR langpack. The upstream
15762 Tor Browser did this in version 6.5 (Refs: #12159).
15766 * use gdm-password instead of gdm-autologin, to fix switching to
15767 the VT where the desktop session lives on Stretch (Closes:
15769 * Fix more options scrolledwindow size in Stretch (Closes:
15771 - Tails Installer: remove unused code warning about missing
15772 extlinux in Tails Installer (Closes: #11196).
15773 - Update APT pinning to cover all binary packages built from
15774 src:mesa so we ensure installing mesa from jessie-backports
15776 - Install xserver-xorg-video-amdgpu. This should help supporting
15777 newer AMD graphics adapters. (Closes #11850)
15778 - Fix firewall startup during early boot, by referring to the
15779 "amnesia" user via its UID (Closes: #7018).
15780 - Include all amd64-microcodes.
15781 - refresh-translations: ignore
15782 config/chroot_local-includes/usr/share/doc/tails/website/.
15783 Otherwise, if the website has been built already, PO tools
15784 complain that there are files with translatable strings in
15785 there, which are not listed in POTFILES.in.
15786 - Make uBlock Origin's button appear on first run. Otherwise it
15787 will only appear on browser runs after the first one. This bug
15788 also affected Adblock Plus (Closes: #12145).
15791 - Be more careful when unmounting the tmpfs used as workspace
15792 during builds, fixing an issue that made Jenkins' ISO builders
15793 prone to failures (Closes: #12009).
15794 - Upgrade the Vagrant basebox to 20170105. The only big change is
15795 that we now install the backported kernel in the builder VM, to
15796 make building possible on Debian Sid (Closes: #12081).
15797 - Ensure the VirtualBox guest DKMS modules are built for the
15798 kernel we want them for. In some situations, depending on the
15799 version of the running kernel, the modules would not be built
15800 for the 686 kernel, which is the one that needs the VirtualBox
15801 guest modules. This commit ensures the VirtualBox guest modules
15802 are built and installed regardless of the how the build
15803 environment looks like (Closes: #12139).
15806 - Replace the filesystem shares support with a helper for easily
15807 sharing files from the host to the guest using virtual disks
15809 - Do not test sending email when testing POP3. We cannot clean
15810 that email up (easily) since when we use POP3 deletions won't
15811 affect the remote inbox, only our local one, resulting in the
15812 quota being reached eventually (Closes: #12006).
15813 - Have APT tests configure APT to use non-onion sources. Our test
15814 suite uses Chutney to create a virtual, private Tor network, and
15815 thus doesn't support connections to Onion services running in
15816 the real Tor network (Refs: #11556).
15817 - Allow connections to Tor's control port during stream isolation
15818 tests, but only for those applications where we expect that.
15819 - Fix Electrum tests after upgrading to 2.7.9-1.
15820 - Make encryption.feature pass for Tails 2.10~rc1.
15821 - Adapt tests after the Donation campaign was disabled (Refs:
15823 - Fix 'The "Tails documentation" link on the Desktop works'
15824 scenario. The TailsOfflineDocHomepage.png image doesn't match
15825 what we see any more (I have no clue why), so let's use Dogtail
15826 and solve this once and for all, hopefully.
15827 - Work around Tails freezing during memory wiping. These
15828 workarounds should be reverted once #11786 is fixed
15829 properly. (Refs: #10776, #11786)
15830 - Support both xtigervncviewer and xtightvncviewer for --view.
15831 xtightvncviewer is a transitional package in Sid, which depends
15832 on tigervnc-viewer (which ships xtigervncviewer), so by keeping
15833 the dep and supporting both binaries, --view will work on both
15834 Sid and Jessie (Closes: #12129).
15835 - Test suite: bump image after upgrading to Tor Browser 6.5 (Refs:
15837 - Add debugging info for when PacketFu misbehaves, and be more
15838 careful when to save pcap artifacts (Refs: #11508).
15840 -- Tails developers <tails@boum.org> Mon, 23 Jan 2017 11:38:37 +0100
15842 tails (2.9.1) unstable; urgency=medium
15845 - Upgrade Tor Browser to 6.0.8 based on Firefox 45.6. If you pay
15846 close attention you'll see that we import -build1 but there was
15847 a -build2. The only change is Tor Button 1.9.5.13 which makes
15848 some changes to the donation campaign banner in `about:tor`,
15849 which we safely can skip. (Closes: #12028)
15850 - Upgrade Icedove to 45.5.1-1~deb8u1+tails1. (Closes: #12029)
15851 - Upgrade APT-related packages to 1.0.9.8.4.
15853 * Minor improvements
15854 - Switch to DuckDuckGo as the default search engine in the tor
15855 Browser. This is what Tor Browser has, and Disconnect.me (the
15856 previous default) has been re-directing to DDG for some time,
15857 which has been confusing users. In addition, we localize the DDG
15858 user interface for the locales with availablelangpacks. (Closes:
15860 - Improve the display name for the Wikipedia search plugin.
15861 - Enable contrib and non-free for our own APT repos.
15862 - Upgrade Tor to 0.2.8.10. (Closes: #12015)
15863 - Upgrade obfs4proxy to 0.0.7-1~tpo1.
15866 - AppArmor Totem profile: add permissions needed to avoid warning
15867 on startup. (Closes: #11984)
15868 - Upgrade the VirtualBox Guest additions and modules to version
15869 5.1.8. This should prevent Xorg from crashing unless the video
15870 memory for the VMs are significantly bumped. (Closes: #11965)
15871 Users will still have to enable I/O APIC due to a bug in Linux.
15872 - Drop unwanted search plugins from the Tor Browser langpacks.
15873 Otherwise they are only removed from English locales. Note that
15874 the langpacks contain copies of the English plugins, not
15875 localized versions, so we actually lose nothing.
15878 - Add support for SikuliX, which recently hit Debian Unstable,
15879 while still supporting Sikuli for Jessie users. (Closes: #11991)
15880 - Fix some instances where we were trying to use the mouse outside
15881 of the Sikuli screen.
15882 - Use "TorBirdy" instead of "amnesia branding" as the "anchor"
15883 addon. I.e. the addon that we use to find the other ones. The
15884 "amnesia branding" addon has been removed, so we must use
15885 something else. (Fixup: #11906)
15886 - Dogtailify "the support documentation page opens in Tor Browser"
15887 step. We previously relied on Sikuli, and the image was made
15888 outdated thanks to our donation campaign. No more! (Closes:
15890 - Resolve dl.amnesia.boum.org instead of picking a static address.
15891 Just hours after updating the dustri.org IP address, its web
15892 server went down => test suite failures. Let's make this test as
15893 robust as actually downloading the Tails ISO image -- if that
15894 fails, we probably have more serious problems on our hands than
15895 a failing test suite. (Closes: #11960)
15896 - Switch MAT scenario from testing PDFs to PNGs. Also add
15897 anti-test and test using using a tool *different* from MAT, the
15898 tool being tested here. (Closes: #11901)
15900 -- Tails Developers <tails@boum.org> Wed, 14 Dec 2016 13:19:16 +0100
15902 tails (2.7.1) unstable; urgency=medium
15905 - Upgrade Tor Browser to 6.0.7 (build3) based on Firefox 45.5.1.
15906 - Upgrade gstreamer0.10-based packages to 0.10.31-3+nmu4+deb8u2.
15907 - Upgrade imagemagick-based packages to 8:6.8.9.9-5+deb8u6.
15908 - Upgrade libicu52 to 52.1-8+deb8u4.
15909 - Upgrade vim-based packages to 2:7.4.488-7+deb8u1.
15911 * Minor improvements
15912 - Reserve 64 MiB for the kernel and 128 MiB for privileged
15913 processes before the memory is wiped. We hope that this might
15914 help (but not solve, sadly) some crashes experienced while
15918 - Make the wiki shipped inside Tails build deterministically
15920 * Enable ikiwiki's "deterministic" option, and require it when
15922 * Use our custom backport of discount (2.2.1-1~bpo8+1~0.tails1),
15923 to fix reproducibility issues (Debian#782315). This can be
15924 dropped once our ISO builders use Stretch.
15925 * Install ikiwiki from our builder-jessie APT suite, to make the
15926 pagestats plugin output deterministic.
15927 - refresh-translations: don't update PO files unless something
15928 other than POT-Creation-Date was changed. (Closes: #11967)
15929 - Fix Vagrant's is_release? check. Per auto/build, we consider it
15930 a release when we build from detached head, and HEAD is tagged.
15931 - Enforce `cleanall` when building a release. I.e. don't allow the
15932 user supplied options to override this behaviour. This is
15933 important since Vagrant caches wiki builds, and we do not want
15934 leftovers from a previous builds ending up in a release. Also,
15935 this is required for making Tails images build reproducibly.
15936 - Make the build system's `cleanall` option really clean
15937 everything. At the moment it doesn't clean the cached wiki
15938 build (which basically was its only job).
15939 - import-package: support contrib and non-free sections.
15942 - Wait a bit between opening the shutdown applet menu, and
15943 clicking one of its widgets. (Closes: #11616).
15944 - Adapt Icedove test after removing the amnesia branding add-on.
15946 - Replace --pause-on-fail with --interactive-debugging. It does
15947 the same thing, but also offers an interactive Ruby shell, via
15948 pry, with the Cucumber world context.
15950 -- Tails developers <tails@boum.org> Wed, 30 Nov 2016 17:27:37 +0100
15952 tails (3.0~alpha1) experimental; urgency=medium
15954 * Major new features and changes
15955 - Upgrade to a snapshot of Debian 9 (Stretch) from 2016-11-15.
15956 - Switch userpace from 32-bit to 64-bit (Closes: #8183), and accordingly:
15957 · Memory erasure: drop the "one instance of sdmem per 2 GiB of RAM" tweak,
15958 that is not needed on x86-64.
15959 · Display a "sorry!" message when trying to boot on a 32-bit BIOS system
15961 - Switch GNOME Shell to its default black theme (Closes: #11789).
15963 * Minor improvements
15964 - Install the cirrus and modesetting X.Org drivers (Closes: #10962).
15965 - Install the 'amdgpu' driver for the AMD Radeon cards (refs: #11850).
15966 - Stop disabling kernel modesetting for QXL (refs: #11518).
15967 - Replace TopIcons with gnome-shell-extension-top-icons-plus.
15968 The former causes plenty of trouble and is apparently abandoned
15969 upstream. The latter is actively maintained upstream, and packaged
15970 in Debian. (refs: #10576)
15971 - Use torsocks to torify Git, and drop tsocks entirely. tsocks has been
15972 unmaintained for years in Debian, and was removed from testing
15973 for a while (Closes: #10955).
15974 - Replace Florence's "systray" icon with the Florence Indicator GNOME Shell
15975 extension (refs: #8312). And then, don't automatically start Florence:
15976 the Florence Indicator GNOME Shell extension will start it the first time
15977 one tries to display it. This should save a tiny bit of RAM.
15978 - Harden AppArmor Totem profiles.
15979 - Switch to the Debian-packaged aufs kernel module (Closes: #11829).
15980 - Configure the firewall to not allow root to connect to Tor at all,
15981 which is possible now that APT uses a dedicated user for network
15983 - Fix firewall startup during early boot, by referring to the "amnesia"
15984 user via its UID (refs: #7018).
15985 - Install hunspell dictionaries instead of myspell ones, for a few more
15986 languages: Spanish, Italian, Portuguese and Russian. Only Farsi keeps
15987 using a myspell dictionary for now.
15990 - Stop installing BookletImposer PDF imposition toolkit.
15991 It's unmaintained upstream and thus won't be part of Debian Stretch.
15992 - Stop installing ekeyd: it's unmaintained, very rarely used, poorly
15993 designed (dedicated daemon), and security sensitive (Closes: #7687).
15994 - Stop shipping ttdnsd. It was only useful for developers and power-users
15995 who can install it themselves as needed. It's been unmaintained upstream
15996 for many years. It's very buggy so we had to remove it from the DNS
15997 resolution loop years ago. It's not in Debian. And it's one of the only
15998 two bits of Tails that still relied on tsocks, that is RC-buggy,
15999 unmaintained in Debian, and not in Stretch at the moment. So it has
16000 become clear that the cost of keeping ttdnsd now outweighs the benefits
16001 it brought (refs: #10959).
16004 - Bump disk space (and memory for in-RAM builds) requirements.
16005 - Support new live-config configuration directory naming, again and again.
16006 - Use the lowest compression level for the SquashFS when compressing it
16007 with gzip. This makes our development builds faster, and the resulting
16008 ISO image only a little bit bigger (Closes: #9788).
16009 - Configure initramfs compression later, to make the build faster.
16012 - Various refactoring while we were at it.
16013 - Port tests to Dogtail: installation, upgrade, notification detection,
16014 Synaptic, Gobby, and some of Tor Browser.
16015 - Workaround GNOME Shell being buggy for Dogtail (refs: #11718).
16016 - Update a bunch of test suite images for Stretch.
16017 - Mark created disk as temporary when we don't need to keep it around.
16018 - Simplify adding NetworkManager connections, and rely more on the defaults.
16019 Not providing the complete configuration file makes us test something
16020 closer to what happens when a user adds a Wi-Fi connection themselves.
16021 - Adjust the minimum allowed memory pattern coverage before wiping.
16022 - Always sync the time from the host when restoring from a snapshot.
16023 Previously we wouldn't do it when the network was plugged but Tor wasn't
16024 running, which can cause issues if we *then* start Tor since the time
16026 - Adjust to the fact that we now support running as a 64-bit guest
16027 in VirtualBox, and simplify code since we now include a 64-bit userland.
16028 - Improve how we restart Tor/I2P after restoring from a snapshot.
16029 - Adjust PolicyKit tests for Stretch.
16030 - Work around Tails stopping on shut down due to #11730.
16031 This should be reverted once #11730 is fixed properly.
16032 - Update the screenshot scenario.
16033 - Fix pcap file saving on MAC spoofing failure (Closes: #11698).
16034 - Test that notifications are actually shown.
16035 - Drop obsolete workaround for Florence sometimes not being hidden
16036 on startup (#11398).
16037 - Avoid remote shell deadlock.
16038 - Install at-spi2-core from Debian Sid.
16039 With the current version in Stretch, at-spi-bus-launcher crashes on
16040 start, breaking parts of GNOME's accessibility, and Dogtail.
16041 For details, see https://bugs.debian.org/840618.
16042 - Check that the MAC address is spoofed for manually added persistent
16043 NetworkManager connections created on Jessie and Stretch (refs: #11931).
16044 - Use nc.traditional in tests that rely on its behaviour.
16045 - Adjust expected notification text to cope with #11941.
16047 * Adjustments for Debian 9 (Stretch) with no or very little user-visible impact
16048 - Adjust APT sources and pinning for Stretch.
16049 - Don't install gnome-media, which is not part of testing/sid anymore.
16050 We already install the only bits it was providing or depending on.
16051 - Don't install gnome-themes: it's gone in Stretch.
16052 - Stop installing GStreamer 0.10 explicitly: it won't be in Stretch,
16053 and some bits are gone already.
16054 - Refresh and unfuzzy patches for Stretch. Replace some of them with
16055 programmatic patching, as patches break the build whenever
16057 - Drop start_AppArmor_earlier.diff: on Stretch, AppArmor starts much earlier
16059 - Accept iceweasel-l10n-* that don't provide any search engine:
16060 on Stretch, at least iceweasel-l10n-ar_1%3a43.0.4-1_all.deb doesn't.
16061 - Stop deleting 75-persistent-net-generator.rules: obsolete in Stretch.
16062 It was removed in systemd (220-7).
16063 - Tell live-boot we're still using aufs: recent live-boot defaults
16064 to overlayfs, which we don't use yet.
16065 - Don't remove imagemagick in 11-localize_browser: cups-filters depends on it
16067 - Explicitly install bc: needed by our 2010-pidgin live-config hook.
16068 - Remove gcc-4.9-base and gcc-5 via a chroot hook, taking into account
16069 that GCC 5 is the default on Stretch.
16070 - Switch to openjdk-8-jre: openjdk-7-jre is not in Stretch anymore.
16071 - gcalctool was renamed to gnome-calculator.
16072 - Don't try to delete non-existing AppArmor profile for ntpd: it was moved
16073 to the ntp package in Stretch.
16074 - Build DKMS modules with GCC 5: Stretch hasn't 4.8 anymore.
16075 - Don't try to reload or disable an initscript that we don't patch,
16076 and that doesn't exist anymore.
16077 - Support the case when /usr/src/libdvd-pkg does not exist.
16078 Apparently this can happen on Stretch.
16079 - Adjust to the move of /etc/gnome/defaults.list in Stretch
16081 - Stop installing xserver-xorg-input-vmmouse. It's obsolete and conflicts
16082 with recent kernels: https://bugs.debian.org/831420
16083 - Install open-vm-tools from sid: it's been removed from testing.
16084 - Install the gobby package, instead of the (now gone) transitional
16086 - apparmor-adjust-tor-profile.diff: drop bits that are useless, and
16087 prevent Tor from starting, on Stretch.
16088 - Tor Daemon Status: declare compatibility with GNOME Shell 3.20.
16089 - Shutdown helper: declare compatibility with GNOME Shell 3.20.
16090 - Drop 43-adjust_path_to_ibus-unikey_binaries hook: it was a workaround
16091 for a bug (Debian#714932) that was fixed.
16092 - Use netcat-openbsd instead of connect-proxy for torifying SSH.
16093 connect-proxy seems barely maintained in Debian and was removed from
16094 testing due to https://bugs.debian.org/830423.
16095 - Don't disable gdomap service: we don't include it anymore.
16096 unar in Jessie depended on gnustep-base-runtime (that ships gdomap),
16097 but this is not the case in Stretch anymore.
16098 - Install system-config-printer-common instead of system-config-printer,
16099 and drop customization that were needed only for the latter:
16100 system-config-printer (1.5.7-2) extracts into a new -common package
16101 the bits needed by gnome-control-center (Closes: #11505).
16102 - Adjust haveged AppArmor profile to work with Linux 4.x on Stretch.
16103 - cupsd AppArmor profile: update list of backends, and add aufs-specific
16104 tweak that Stretch needs (refs: #11699).
16105 - Revert to GNOME's default font antialiasing/hinting.
16106 We fixed on rgba/slight when converting some manual fontconfig stuff
16107 to GNOME's layer on top of it, but at least from a fresh Stretch
16108 install (2016-08-24) we got grayscale/slight. It could be that some
16109 auto-detection is involved, so the values would be different depending
16110 on the actual hardware. Any way, let's try to decrease our delta here.
16111 - Adjust haveged arguments customization for Stretch (Closes: 11522).
16112 - Display the date in the desktop top bar, as we did in Jessie and older.
16114 - Drop patch to keep haveged, saned, spice-vdagent and laptop-mode running
16115 on shutdown. These patches are no-ops on Stretch, where these services
16116 have native systemd unit files. It's not worth porting these patches:
16117 saned is socket-activated so in most cases it does not have to be shut
16118 down, and we expect that the other ones can be stopped pretty quickly.
16119 Let's bring back this kind of optimization if, and only if, we identify
16120 an actual problem to fix in this area :)
16121 - Don't delete downloaded debs after install: apt(8) >= 1.2~exp1 deletes
16122 them by default, which is not nice for users who use it to preseed
16123 their persistent APT cache. (Closes: #10958)
16124 - Hide "OpenJDK Java 8 Policy Tool" from the Applications menu.
16125 - Don't ship GCC 6: we don't ship compilers in Tails usually.
16126 - Don't ship gcc-5-base: on Stretch we ship gcc-6-base instead.
16127 - Don't start shipping libdvdcss2-dbgsym nor paxctld.
16128 - Adjust default web browser customization: GNOME in Debian now defaults
16129 to Firefox ESR (refs: #11440).
16130 - Install libreoffice-gtk3: on Stretch this is needed to have Gtk+ 3 widgets
16131 and a Gtk/GNOMEish print dialog.
16132 - Explicitly install gtk2-engines-pixbuf, as it's not pulled automatically
16133 on Stretch, and it's needed to theme GTK+ 2 applications in a nice way
16135 - AppArmor gnome abstraction: allow reading /etc/xdg/*-mimeapps.list
16137 - Drop obsolete disabling of GNOME Keyring's GnuPG agent feature.
16138 That feature was removed upstream.
16139 - Explicitly select pinentry-gtk2 as our preferred pinentry program.
16140 On Stretch, gnome-keyring depends on pinentry-gnome3, and then that one
16141 is selected by default. It does not feel worth it to introduce a hackish
16142 solution such as a fake pinentry-gnome3 package, so let's ignore it and
16143 just make sure we are using the pinentry program we prefer
16145 - Drop keep_memlockd_on_shutdown.diff: it's been a no-op since Tails 2.0
16147 - Drop custom NetworkManager plugin configuration: these tweaks are not
16148 needed on Stretch anymore.
16149 - Disable new style network interface naming scheme.
16150 It has little value for a live system, so let's stick to what we are
16151 used to, and avoid having to adjust code/config/test suite
16153 - Drop obsolete NM configuration wrt. sending hostname in DHCP requests
16155 - Update APT pinning to cover all binary packages built from src:mesa
16157 - Don't try to install gnupg-curl: it doesn't exist anymore in Stretch.
16158 - Install seahorse-nautilus from sid. It's been removed from testing.
16159 - Drop workaround for Debian bug #645466, that was fixed in 2014
16161 - Allow the "_apt" user to use Tor: in Stretch, APT network operations
16162 are performed with the "_apt" user and not root.
16163 - Make sure that 'localhost' points to the IPv4 loopback address.
16164 - Make desktop launchers executable (Closes: #11927).
16165 - Disable Wayland usage in GDM (Closes: #11923).
16166 - Fix AppArmor profile for gst-plugin-scanner (Closes: #11928).
16167 - Change Nautilus' default zoom level to 'small' (Closes: #11716).
16168 The icons in GNOME Files and on the desktop are too huge otherwise. With
16169 this new setting, they are similar in size to what we had in Jessie.
16170 - Fix broken symlink preventing Enigmail from being enabled.
16171 - Configure NetworkManager to not touch MAC addresses (refs: #11931).
16172 Its default behaviour on Debian Stretch is to reset the MAC address to the
16173 permanent one, and we did not make up our mind yet wrt. replacing
16174 our custom MAC spoofing system with NM's own one (refs: #11293).
16175 - Patch NetworkManager so that it does not leak the hostname in DHCP
16176 requests (Closes: #11720).
16177 - Deal with the fact that the NetworkManager dispatcher scripts are now
16178 sometimes called with an empty first argument (Closes: #11938).
16179 - Upgrade to GnuPG 2.1.15-9, and accordingly:
16180 · Remove the CA certificate for sks-keyservers.net, that we installed
16181 in the system-wide CAs directory: it is now included in the dirmngr
16182 package. Stop trusting it for non-GnuPG operations.
16183 · Make dirmngr use the sks-keyservers.net CA certificate from Debian.
16184 · Move keyserver proxy configuration to dirmngr.conf, and drop the
16185 keyserver-options that are obsolete or now the default.
16187 -- intrigeri <intrigeri@boum.org> Thu, 17 Nov 2016 16:19:21 +0000
16189 tails (2.7) unstable; urgency=medium
16192 - Upgrade to Linux 4.7. (Closes: #11885, #11818)
16193 - Upgrade to Tor 0.2.8.9. (Closes: #11832, #11891)
16194 - Upgrade Tor Browser to 6.0.6 based on Firefox 45.5. (Closes: #11910)
16195 - Upgrade Icedove to 1:45.4.0-1~deb8u1+tails1. (Closes: #11854,
16197 - Upgrade imagemagick to 8:6.8.9.9-5+deb8u5.
16198 - Upgrade openssl to 1.0.1t-1+deb8u5.
16199 - Upgrade libarchive to 3.1.2-11+deb8u3.
16200 - Upgrade bind9 to 1:9.9.5.dfsg-9+deb8u8.
16201 - Upgrade libav to 6:11.8-1~deb8u1.
16202 - Upgrade ghostscript to 9.06~dfsg-2+deb8u3.
16203 - Upgrade c-ares to 1.10.0-2+deb8u1.
16204 - Upgrade nspr to 2:4.12-1+debu8u1.
16205 - Upgrade nss to 2:3.26-1+debu8u1.
16206 - Upgrade tar to 1.27.1-2+deb8u1.
16207 - Upgrade curl to 7.38.0-4+deb8u5.
16208 - Upgrade libgd3 to 2.1.0-5+deb8u7.
16209 - Upgrade opendjk-7 to 7u111-2.6.7-2~deb8u1.
16210 - Upgrade mat to 0.5.2-3+deb8u1.
16211 - Upgrade libxslt to 1.1.28-2+deb8u2.
16212 - Upgrade pillow to 2.6.1-2+deb8u3.
16214 * Minor improvements
16215 - Ship Let's encrypt intermediate certificate to prepare the
16216 the next certificate renewal of our website. Also unify the
16217 way our upgrades and security checkers verify this SSL
16218 certificate using our dedicated perl lib code. (Closes: #11810)
16221 - Fix multiarch support in Synaptic. (Closes: #11820)
16222 - Set default spelling language to en_US in Icedove. (Closes: #11037)
16225 - Disable debootstrap merged-usr option. (Closes: #11903)
16228 - Add test for incremental upgrades. (Closes: #6309)
16229 - Add tests for Icedove. (Closes: #6304)
16230 - Decrease timeout to Tails Greeter to speed up testing of branches
16231 where it is broken. (Closes: #11449)
16232 - Add a ID field to the remote shell responses to filter out
16233 unrelated ones. (Closes: #11846)
16234 - Reliabily wait for the Greeter PostLogin script. (Closes: #5666)
16235 - Reliabily type the kernel command line in the prompt at the boot
16236 menu to ensure the remote shell is started. (Closes: #10777)
16237 - Remove DVDROM device when not used, to workaround QEMU/Libvirt
16238 compatibility issue. (Closes: #11874)
16240 -- Tails developers <tails@boum.org> Sun, 13 Nov 2016 14:46:04 +0100
16242 tails (2.6) unstable; urgency=medium
16244 * Major new features and changes
16245 - Install Tor 0.2.8.7. (Closes: #11351)
16246 - Enable kASLR in the Linux kernel. (Closes: #11281)
16247 - Upgrade Icedove to 1:45.2.0-1~deb8u1+tails1: (Closes: #11714)
16248 · Drop auto-fetched configurations using Oauth2. They do not
16249 work together with Torbirdy since it disables needed
16250 functionality (like JavaScript and cookies) in the embedded
16251 browser. This should make auto-configuration work for GMail
16252 again, for instance. (Closes: ##11536)
16253 · Pin Icedove to be installed from our APT repo. Debian's
16254 Icedove packages still do not have our secure Icedove
16255 autoconfig wizard patches applied, so installing them would be
16256 a serious security regression. (Closes: #11613)
16257 · Add missing icedove-l10n-* packages to our custom APT
16258 repository (Closes: #11550)
16259 - Upgrade to Linux 4.6: (Closes: #10298)
16260 · Install the 686 kernel flavour instead of the obsolete 586
16262 · APT, dpkg: add amd64 architecture. The amd64 kernel flavour is
16263 not built anymore for the i386 architecture, so we need to use
16265 · Build and install the out-of-tree aufs4 module. (Closes: #10298)
16266 · Disable kernel modesetting for QXL: it's not compatible with
16267 Jessie's QXL X.Org driver.
16270 - Hopefully fixed an issue which would sometimes make the Greeter
16271 ignore the "disable networking" or "bridge mode"
16272 options. (Closes: #11593)
16274 * Minor improvements
16275 - Install firmware-intel-sound and firmware-ti-connectivity. This
16276 adds support for some sound cards and Wi-Fi adapters. (Closes:
16278 - Install OpenPGP Applet from Debian. (Closes: #10190)
16279 - Port the "About Tails" dialog to python3.
16280 - Run our initramfs memory erasure hook earlier (Closes:
16281 #10733). The goal here is to:
16282 · save a few seconds on shutdown (it might matter especially for
16283 the emergency one);
16284 · work in a less heavily multitasking / event-driven
16285 environment, for more robust operation.
16286 - Install rngd, and make rng-tools initscript return success when
16287 it can't find any hardware RNG device. Most Tails systems around
16288 probably have no such device, and we don't want systemd to
16289 believe they failed to boot properly. (Closes: #5650)
16290 - Don't force using the vboxvideo X.Org driver. According to our
16291 tests, this forced setting is:
16292 · harmful: it breaks X startup when the vboxvideo *kernel*
16294 · useless: X.Org now autodetects the vboxvideo X.Org driver and
16295 uses it when running in VirtualBox and the vboxvideo kernel
16297 - Port boot-profile to python3 (Closes: #10083). Thanks to
16298 heartsucker <heartsucker@autistici.org> for the patch!
16299 - Include /proc/cmdline and the content of persistent APT sources
16300 in WhisperBack bug reports. (Closes: #11675, #11635)
16301 - Disable non-free APT sources at boot time. (Closes: #10130)
16302 - Have a dedicated page for the homepage of Tor Browser in
16303 Tails. (Closes: # 11725)
16304 - Only build the VirtualBox kernel modules for the 32-bit kernel.
16305 It's both hard and useless to build it for 64-bit in the current
16306 state of things, as long as we're shipping a 32-bit userspace.
16307 Also, install virtualbox-* from jessie-backports, since the
16308 version in Jessie is not compatible with Linux 4.x.
16311 - Don't install+remove dpatch during the build. It's not been
16312 needed in this hook for ages.
16313 - Bump BUILD_SPACE_REQUIREMENT: at least one of us needed that to
16314 build feature/10298-linux-4.x-aufs with the gzipcomp option.
16317 - Send Tails Installer's debug log to the Cucumber debug log on
16318 failure. This is meant to debug #10720 since I can't
16319 reproduce it locally.
16320 - Give the system under testing 2 vCPUs. (Closes: #6729)
16321 - Split scenarios from checks.feature. (Closes: #5707)
16322 - Add retry-logic to the Synaptic tests. (Closes: #10412, #10441,
16324 - Run usb_upgrade.feature earlier, when there is enough free disk
16325 space left. (Closes: #11582)
16326 - Use more recent virtual hardware in the system under test,
16327 i.e. USB 3.0 (nec-xhci) on a pc-i440fx-2.5 machine. Switching
16328 USB controllers has helped with problems we see on Jenkins when
16329 booting from USB (#11588). Also, there are chances that more
16330 recent virtual hardware sees more testing these days, so it
16331 sounds potentially useful to "upgrade".
16332 - Add support for Cucumber 2.4. (Closes: #11690)
16333 - Always write {pretty,debug} logs and JSON output to the artifact
16335 - Disable info level logging on Chutney nodes to save disk
16336 space. For our network all these add up to > 1 GiB and we didn't
16337 take this into account when budgeting RAM to the isotesters on
16340 -- Tails developers <tails@boum.org> Tue, 20 Sep 2016 04:16:33 +0200
16342 tails (2.5) unstable; urgency=medium
16344 * Major new features and changes
16345 - Upgrade Icedove to 1:45.1.0-1~deb8u1+tails2. (Closes: #11530)
16346 · Fix long delay causing bad UX in the autoconfig wizard,
16347 when it does not manage to guess proper settings on some domains.
16349 · Better support sending email through some ISPs, such as Riseup.
16351 · Fix spurious error message when creating an account and providing
16352 its password. (Closes: #11550)
16355 - Upgrade Tor Browser to 6.0.3 based on Firefox 45.3. (Closes: #11611)
16356 - Upgrade GIMP to 2.8.14-1+deb8u1.
16357 - Upgrade libav to 6:11.7-1~deb8u1.
16358 - Upgrade expat to 2.1.0-6+deb8u3.
16359 - Upgrade libgd3 to 2.1.0-5+deb8u6.
16360 - Upgrade libmodule-build-perl to 0.421000-2+deb8u1.
16361 - Upgrade perl to 5.20.2-3+deb8u6.
16362 - Upgrade Pidgin to 2.11.0-0+deb8u1.
16363 - Upgrade LibreOffice to 1:4.3.3-2+deb8u5.
16364 - Upgrade libxslt1.1 to 1.1.28-2+deb8u1.
16365 - Upgrade Linux to 3.16.7-ckt25-2+deb8u3.
16366 - Upgrade OpenSSH to 1:6.7p1-5+deb8u3.
16367 - Upgrade p7zip to 9.20.1~dfsg.1-4.1+deb8u2.
16369 * Minor improvements
16370 - htpdate: replace obsolete and unreliable URIs in HTP pools, and decrease
16371 timeout for HTTP operations for more robust time synchronization.
16373 - Hide settings panel for the Online Accounts component of GNOME,
16374 that we don't support. (Closes: #11545)
16375 - Vastly improve graphics performance in KVM guest with QXL driver.
16377 - Fix graphics artifacts in Tor Browser in KVM guest with QXL driver.
16381 - Wrap Pidgin in a more maintainable way. (Closes: #11567)
16384 - Add a test scenario for the persistence "dotfiles" feature.
16386 - Improve robustness of most APT, Git, SFTP and SSH scenarios,
16387 enough to enable them on Jenkins. (Closes: #10444, #10496, #10498)
16388 - Improve robustness of checking for persistence partition. (Closes: #11558)
16389 - Treat Tails booting from /dev/sda as OK, to support all cases
16390 including a weird one caused by hybrid ISO images. (Closes: #10504)
16391 - Bump a bunch of timeouts to cope with the occasional slowness on Jenkins.
16392 - Only query A records when exercising DNS lookups, to improve robustness.
16394 -- Tails developers <tails@boum.org> Sun, 31 Jul 2016 16:50:35 +0000
16396 tails (2.4) unstable; urgency=medium
16398 * Major new features and changes
16399 - Upgrade Tor Browser to 6.0.1 based on Firefox 45.2. (Closes:
16401 - Enable Icedove's automatic configuration wizard. We patch the
16402 wizard to only use secure protocols when probing, and only
16403 accept secure protocols, while keeping the improvements done by
16404 TorBirdy in its own non-automatic configuration wizard. (Closes:
16408 - Upgrade bsdtar and libarchive13 to 3.1.2-11+deb8u1.
16409 - Upgrade icedove to 38.8.0-1~deb8u1+tails3.
16410 - Upgrade imagemagick to 8:6.8.9.9-5+deb8u3.
16411 - Upgrade libexpat1 to 2.1.0-6+deb8u2.
16412 - Upgrade libgd3 to 2.1.0-5+deb8u3.
16413 - Upgrade gdk-pixbuf-based packages to 2.31.1-2+deb8u5.
16414 - Upgrade libidn11 to 1.29-1+deb8u1.
16415 - Upgrade libndp0 to 1.4-2+deb8u1.
16416 - Upgrade poppler-based packages to 0.26.5-2+deb8u1.
16417 - Upgrade librsvg2-2 to 2.40.5-1+deb8u2.
16418 - Upgrade libsmbclient to 2:4.2.10+dfsg-0+deb8u3.
16419 - Upgrade OpenSSL to 1.0.1k-3+deb8u5.
16420 - Upgrade libtasn1-6 to 4.2-3+deb8u2.
16421 - Upgrade libxml2 to 2.9.1+dfsg1-5+deb8u2.
16422 - Upgrade openjdk-7-jre to 7u101-2.6.6-1~deb8u1.
16425 - Enable Packetization Layer Path MTU Discovery for IPv4. If any
16426 system on the path to the remote host has a MTU smaller than the
16427 standard Ethernet one, then Tails will receive an ICMP packet
16428 asking it to send smaller packets. Our firewall will drop such
16429 ICMP packets to the floor, and then the TCP connection won't
16430 work properly. This can happen to any TCP connection, but so far
16431 it's been reported as breaking obfs4 for actual users. Thanks to
16432 Yawning for the help! (Closes: #9268)
16433 - Make Tails Upgrader ship other locales than English. (Closes:
16435 - Make it possible to add local USB printers again. Bugfix on
16436 Tails 2.0. (Closes #10965).
16438 * Minor improvements
16439 - Remove custom SSH ciphers and MACs settings. (Closes: #7315)
16440 - Bring back "minimize" and "maximize" buttons in titlebars by
16441 default. (Closes: #11270)
16442 - Icedove improvements:
16443 * Stop patching in our default into Torbirdy. We've upstreamed
16444 some parts, and the rest we set with pref branch overrides in
16445 /etc/xul-ext/torbirdy.js. (Closes: #10905)
16446 * Use hkps keyserver in Enigmail. (Closes: #10906)
16447 * Default to POP if persistence is enabled, IMAP is
16448 not. (Closes: #10574)
16449 * Disable remote email account creation in Icedove. (Closes:
16451 - Firewall hardening (Closes: #11391):
16452 * Don't accept RELATED packets. This enables quite a lot of code
16453 in the kernel that we don't need. Let's reduce the attack
16455 * Restrict debian-tor user to NEW TCP syn packets. It doesn't
16456 need to do more, so let's do a little bit of security in
16458 * Disable netfilter's nf_conntrack_helper.
16459 * Fix disabling of automatic conntrack helper assignment.
16460 - Kernel hardening:
16461 * Set various kernel boot options: slab_nomerge slub_debug=FZ
16462 mce=0 vsyscall=none. (Closes: #11143)
16463 * Remove the kernel .map files. These are only useful for kernel
16464 debugging and slightly make things easier for malware, perhaps
16465 and otherwise just occupy disk space. Also stop exposing
16466 kernel memory addresses through /proc etc. (Closes: #10951)
16467 - Drop zenity hacks to "focus" the negative answer. Jessie's
16468 zenity introduced the --default-cancel option, finally!
16470 - Drop useless APT pinning for Linux.
16471 - Remove gnome-tweak-tool. (Closes: #11237)
16472 - Install python-dogtail, to enable accessibility technologies in
16473 our automated test suite (see below). (Part of: #10721)
16474 - Install libdrm and mesa from jessie-backports. (Closes: #11303)
16475 - Remove hledger. (Closes: #11346)
16476 - Don't pre-configure the #tails chan on the default OFTC account.
16478 - Install onioncircuits from jessie-backports. (Closes: #11443)
16479 - Remove nmh. (Closes: #10477)
16480 - Drop Debian experimental APT source: we don't use it.
16481 - Use APT codenames (e.g. "stretch") instead of suites, to be
16482 compatible with our tagged APT snapshots.
16483 - Drop module-assistant hook and its cleanup. We've not been using
16485 - Remove 'Reboot' and 'Power Off' entries from Applications →
16486 System Tools. (Closes: #11075)
16487 - Pin our custom APT repo to the same level as Debian ones, and
16488 explicitly pin higher the packages we want to pull from our custom
16489 APT repo, when needed.
16490 - config/chroot_local-hooks/59-libdvd-pkg: verify libdvdcss
16491 package installation. (Closes: #11420)
16492 - Make Tails Upgrader use our new mirror pool design. (Closes:
16494 - Drop custom OpenSSH client ciphers and MACs settings. We did a
16495 pretty bad job at maintaining them compared to the Debian
16496 upstream. (Closes: #7315)
16497 - Install jessie-backports version of all binary packages built
16498 from src:hplip. This adds support for quite a few new
16500 - Install printer-driver-postscript-hp, which adds support for
16501 some more printers.
16504 - Use a freezable APT repo when building Tails. This is a first
16505 step towards reproducible builds, and improves our QA and
16506 development processes by making our builds more predictable. For
16507 details, see: https://tails.boum.org/contribute/APT_repository/
16508 - There has been a massive amount of improvements to the
16509 Vagrant-based build system, and now it could be considered the
16510 de-facto build system for Tails! Improvements and fixes include:
16511 * Migrate Vagrant to use libvirt/KVM instead of
16512 Virtualbox. (Closes: #6354)
16513 * Make apt-get stuff non-interactive while provisioning.
16514 Because there is no interaction, so that will results in
16516 * Bump disk space (=> RAM for RAM builds) needed to build with
16517 Vagrant. Since the Jessie migration it seems impossible to
16518 keep this low enough to fit in 8 GiB or RAM. For this reason
16519 we also drop the space optimization where we build inside a
16520 crazy aufs stack; now we just build in a tmpfs.
16521 * Clean up apt-cacher-ng cache on vm:provision to save disk
16522 space on the builder.
16523 * Add convenient Rake task for SSH:ing into the builder VM:
16525 * Add rake task for generating a new Vagrant base box.
16526 * Automatically provision the VM on build to keep things up-to-date.
16527 * Don't enable extproxy unless explicitly given as an
16528 option. Previously it would automatically be enabled when
16529 `http_proxy` is set in the environment, unlike what is
16530 documented. This will hopefully lead to fewer surprises for users
16531 who e.g. point http_proxy to a torified polipo, or similar.
16532 * Re-fetch tags when running build-tails with Vagrant. That
16533 should fix an annoyance related to #7182 that I frequently
16534 encounter: when I, as the RM, rebuild the release image the
16535 second time from the force-updated tag, the build system would
16536 not have the force-updated tag. (Closes: #7182)
16537 * Make sure we use the intended locale in the Tails builder VM.
16538 Since we communicate via SSH, and e.g. Debian forward the
16539 locale env vars by default, we have to take some steps
16540 ensuring we do not do that.
16541 - Pull monkeysphere from stretch to avoid failing to install under
16542 eatmydata. Patch submitted by Cyril Brulebois <cyril@debamax.com>.
16545 - Add wrapper around dogtail (inside Tails) for "remote" usage in
16546 the automated test suite. This provides a simple interface for
16547 generating dogtail python code, sending it to the guest, and
16548 executing it, and should allow us to write more robust tests
16549 leveraging assistive technologies. (Closes: #10721)
16550 - A few previously sikuli-based tests has been migrated to use
16551 dogtail instead, e.g. GNOME Applications menu interaction.
16552 - Add a test for re-configuring an existing persistent volume.
16553 This is a regression test for #10809. (Closes: #10834)
16554 - Use a simulated Tor network provided by Chutney in the automated
16555 test suite. The main motivation here is improved robustness --
16556 since the "Tor network" we now use will exit from the host
16557 running the automated test suite, we won't have to deal with Tor
16558 network blocking, or unreliable circuits. Performance should
16559 also be improved. (Closes: #9521)
16560 - Drop the usage of Tor Check in our tests. It doesn't make sense
16561 now when we use Chutney since that always means it will report
16562 that Tor is not being used.
16563 - Stop testing obsolete pluggable transports.
16564 - Completely rewrite the firewall leak detector to something more
16565 flexible and expressive.
16566 - Run tcpdump with --immediate-mode for the network sniffer. With
16567 this option, "packets are delivered to tcpdump as soon as they
16568 arrive, rather than being buffered for efficiency" which is
16569 required to make the sniffing work reliable the way we use it.
16570 - Remove most scenarios testing "tordate". It just isn't working
16571 well in Tails, so we shouldn't expect the tests to actually work
16572 all of the time. (Closes: #10440)
16573 - Close Pidgin before we inspect or persist its accounts.xml.
16574 I've seen a case when that file is _not_ saved (and thus, not
16575 persisted) if we shut down the system while Pidgin is still
16576 running. (Closes: #11413)
16577 - Close the GNOME Notification bar by pressing ESC, instead of
16578 opening the Applications menu. The Applications menu often
16579 covers other elements that we're looking for on the
16580 screen. (Closes #11401)
16581 - Hide Florence keyboard window when it doesn't vanish by itself
16582 (Closes: #11398) and wait a bit less for Florence to disappear
16585 -- Tails developers <tails@boum.org> Mon, 06 Jun 2016 20:10:56 +0200
16587 tails (2.3) unstable; urgency=medium
16590 - Upgrade Tor Browser to 5.5.5. (Fixes: #11362)
16591 - Upgrade icedove to 38.7.0-1~deb8u1
16592 - Upgrade git to 1:2.1.4-2.1+deb8u2
16593 - Upgrade libgd3 to 2.1.0-5+deb8u1
16594 - Upgrade pidgin-otr to 4.0.1-1+deb8u1
16595 - Upgrade srtp to 1.4.5~20130609~dfsg-1.1+deb8u1
16596 - Upgrade imagemagick to 8:6.8.9.9-5+deb8u1
16597 - Upgrade samba to 2:4.2.10+dfsg-0+deb8u2
16598 - Upgrade openssh to 1:6.7p1-5+deb8u2
16601 - Refresh Tor Browser's AppArmor profile patch against the one from
16602 torbrowser-launcher 0.2.4-1. (Fixes: #11264)
16603 - Pull monkeysphere from stretch to avoid failing to install under
16604 eatmydata. (Fixes: #11170)
16605 - Start gpg-agent with no-grab option due to issues with pinentry and
16606 GNOME's top bar. (Fixes: #11038)
16607 - Tails Installer: Update error message to match new name of 'Clone
16608 & Install'. (Fixes: #11238)
16610 * Cope with a missing geoipdb. (Fixes: #11203)
16611 * Make both panes of the window scrollable. (Fixes #11192)
16612 - WhisperBack: Workaround socks bug. When the Tor fails to connect to
16613 the host, WisperBack used to display a ValueError. This is caused by
16614 a socks bug that is solved in upstream's master but not in Tails.
16615 This commit workarounds this bug Unclear error message in WhisperBack
16616 when failing to connect to the server. (Fixes: #11136)
16618 * Minor improvements
16619 - Upgrade to Debian 8.4, a Debian point release with many minor upgrades
16620 and fixes to various packages . (Fixes: #11232)
16621 - Upgrade I2P to 0.9.25. (Fixes: #11363)
16622 - Pin pinentry-gtk2 to jessie-backports. The new version allows pasting
16623 passwords from the clipboard. (Fixes: #11239)
16624 - config/chroot_local-hooks/59-libdvd-pkg: cleanup /usr/src/libdvd-pkg.
16626 - Make the Tor Status "disconnected" icon more contrasted with the
16627 "connected" one. (Fixes: #11199)
16630 - Add UTF-8 support to OTR Bot. (Fixes: #10866)
16631 - Don't explicitly depend on openjdk-7-jre or any JRE for that
16632 matter. Sikuli will pull in a suitable one, so depending on one
16633 ourselves is only risks causing trouble. (Fixes: #11335)
16635 -- Tails developers <tails@boum.org> Mon, 25 Apr 2016 14:12:22 +0200
16637 tails (2.2.1) unstable; urgency=medium
16640 - Upgrade Tor Browser to 5.5.4. (Closes: #11254)
16641 - Upgrade bind9-related packages to 1:9.9.5.dfsg-9+deb8u6
16642 - Upgrade libotr to 4.1.0-2+deb8u1
16643 - Upgrade samba-related packages to 2:4.1.17+dfsg-2+deb8u2.
16644 - Upgrade libgraphite2 to 1.3.6-1~deb8u1.
16646 -- Tails developers <tails@boum.org> Thu, 17 Mar 2016 15:03:52 +0100
16648 tails (2.2) unstable; urgency=medium
16650 * Major new features and changes
16651 - Replace Vidalia (which has been unmaintained for years) with:
16653 * the Tor Status GNOME Shell extension, which adds a System Status
16654 icon indicating whether Tor is ready or not.
16655 * Onion Circuits, a simple Tor circuit monitoring tool.
16658 - Upgrade Tor Browser to 5.5.3 (Closes: #11189).
16659 - Upgrade Linux to 3.16.7-ckt20-1+deb8u4.
16660 - Upgrade cpio to 2.11+dfsg-4.1+deb8u1.
16661 - Upgrade glibc to 2.19-18+deb8u3.
16662 - Upgrade libav to 6:11.6-1~deb8u1.
16663 - Upgrade libgraphite2 to 1.3.5-1~deb8u1.
16664 - Upgrade libjasper1 to 1.900.1-debian1-2.4+deb8u1.
16665 - Upgrade libreoffice to 4.3.3-2+deb8u3.
16666 - Upgrade libssh2 to 1.4.3-4.1+deb8u1.
16667 - Upgrade openssl to 1.0.1k-3+deb8u4.
16668 - Upgrade perl to 5.20.2-3+deb8u4.
16669 - Upgrade python-imaging, python-pil to 2.6.1-2 2.6.1-2+deb8u2.
16672 - Hide "Laptop Mode Tools Configuration" menu entry. We don't
16673 support configuring l-m-t in Tails, and it doesn't work out of
16674 the box. (Closes: #11074)
16676 * Actually write a string when saving bug report to
16677 disk. (Closes: #11133)
16678 * Add missing argument to OpenPGP dialog so the optional OpenPGP
16679 key can be added again. (Closes: #11033)
16681 * Minor improvements
16682 - Upgrade I2P to 0.9.24-1~deb8u+1.
16683 - Add support for viewing DRM protected DVD videos using
16684 libdvdcss2. Patch series submitted by Austin English
16685 <austinenglish@gmail.com>. (Closes: #7674)
16686 - Automatically save KeePassX database after every change by default.
16688 - Implement Tor stream isolation for WhisperBack
16689 - Delete unused tor-tsocks-mua.conf previously used by Claws
16690 Mail. (Closes: #10904)
16691 - Add set -u to all gettext:ized shell scripts. In gettext-base <
16692 1.8.2, like the one we had in Wheezy, gettext.sh references the
16693 environment variable ZSH_VERSION, which we do not set. This has
16694 prevented us from doing `set -u` without various hacks. (Closes:
16696 - Also set -e in some shell scripts which lacked it for no good
16698 - Make Git verify the integrity of transferred objects. (Closes:
16700 - Remove LAlt+Shift and LShift+RShift keyboard layout toggling
16701 shortcuts. (Closes: #10913, #11042)
16704 - Reorder the execution of feature to decrease peak disk
16705 usage. (Closes: #10503)
16706 - Paste into the GTK file chooser, instead of typing. (Closes:
16708 - Pidgin: wait a bit for text to have stopped scrolling before we
16709 click on it. (Closes: #10783)
16710 - Fix step that runs commands in GNOME Terminal, that was broken
16711 on Jessie when a Terminal is running already. (Closes: #11176)
16712 - Let ruby-rjb guess JAVA_HOME instead fixing on one jvm
16713 version. (Closes: #11190)
16716 - Upgrade build system to Debian Jessie. This includes migrating to a
16717 new Vagrant basebox based on Debian Jessie.
16718 - Rakefile: print git status when there are uncommitted
16719 changes. Patch submitted by Austin English
16720 <austinenglish@gmail.com>. (Closes: #11108)
16721 - .gitignore: add .rake_tasks~. Patch submitted by Austin English
16722 <austinenglish@gmail.com>. (Closes: #11134)
16723 - config/amnesia: use --show-field over sed filtering. Patch
16724 submitted by Chris Lamb <lamby@debian.org>.
16725 - Umount and clean up leftover temporary directories from old
16726 builds. (Closes: #10772)
16728 -- Tails developers <tails@boum.org> Mon, 07 Mar 2016 18:09:50 +0100
16730 tails (2.0.1) unstable; urgency=medium
16732 * Major new features and changes
16733 - Enable the Tor Browser's font fingerprinting protection
16734 (Closes: #11000). We do it for all browsers (including
16735 the Unsafe Browser and I2P Browser mainly to avoid making our
16736 automated test suite overly complex. This implied to set an appropriate
16737 working directory when launching the Tor Browser, to accommodate for
16738 the assumptions it makes about this.
16741 - Upgrade Tor Browser to 5.5.2 (Closes: #11105).
16744 - Repair 32-bit UEFI support (Closes: #11007); bugfix on 2.0.
16745 - Add libgnome2-bin to installed packages list to provide gnome-open,
16746 which fixes URL handling at least in KeePassX, Electrum and Icedove
16747 (Closes: #11031); bugfix on 2.0. Thanks to segfault for the patch!
16749 * Minor improvements
16750 - Refactor and de-duplicate the chrooted browsers' configuration:
16751 prefs.js, userChrome.css (Closes: #9896).
16752 - Make the -profile Tor Launcher workaround simpler (Closes: #7943).
16753 - Move Torbutton environment configuration to the tor-browser script,
16754 instead of polluting the default system environment with it.
16755 - Refresh patch against the Tor Browser AppArmor profile
16757 - Propagate Tor Launcher options via the wrapper.
16758 - Move tor-launcher script to /usr/local/bin.
16759 - Move tor-launcher-standalone to /usr/local/lib.
16760 - Move Tor Launcher env configuration closer to the place where it is used,
16761 for simplicity's sake.
16764 - Mass update browser and Tor Launcher related images due to font change,
16765 caused by Tor Browser 5.5's font fingerprinting protection
16766 (Closes: #11097). And then, use separate PrintToFile.png for the browsers,
16767 and Evince, since it cannot be shared anymore.
16768 - Adjust to the refactored chrooted browsers configuration handling.
16769 - Test that Tor Launcher uses the correct Tor Browser libraries.
16770 - Allow more slack when verifying that the date that was set.
16771 - Bump a bit the timeout used when waiting for the remote shell.
16772 - Bump timeout for the process to disappear, when closing Evince.
16773 - Bump timeout when saving persistence configuration.
16774 - Bump timeout for bootstrapping I2P.
16777 - Remove no longer relevant places.sqlite cleanup procedure.
16779 -- Tails developers <tails@boum.org> Fri, 12 Feb 2016 13:00:15 +0000
16781 tails (2.0) unstable; urgency=medium
16783 * Major new features and changes
16784 - Upgrade to Debian 8 (Jessie).
16785 - Migrate to GNOME Shell in Classic mode.
16786 - Use systemd as PID 1, and convert all custom initscripts to systemd units.
16787 - Remove the Windows camouflage feature: our call for help to port
16788 it to GNOME Shell (issued in January, 2015) was unsuccessful.
16789 - Remove Claws Mail: Icedove is now the default email client
16791 - Upgrade Tor Browser to 5.5 (Closes: #10858, #10983).
16794 - Minimally sandbox many services with systemd's namespacing features.
16795 - Upgrade Linux to 3.16.7-ckt20-1+deb8u3.
16796 - Upgrade Git to 1:2.1.4-2.1+deb8u1.
16797 - Upgrade Perl to 5.20.2-3+deb8u3.
16798 - Upgrade bind9-related packages to 1:9.9.5.dfsg-9+deb8u5.
16799 - Upgrade FUSE to 2.9.3-15+deb8u2.
16800 - Upgrade isc-dhcp-client tot 4.3.1-6+deb8u2.
16801 - Upgrade libpng12-0 to 1.2.50-2+deb8u2.
16802 - Upgrade OpenSSH client to 1:6.7p1-5+deb8u1.
16805 - Restore the logo in the "About Tails" dialog.
16806 - Don't tell the user that "Tor is ready" before htpdate is done
16808 - Upgrader wrapper: make the check for free memory more accurate
16809 (Closes: #10540, #8263).
16810 - Allow the desktop user, when active, to configure printers;
16811 fixes regression introduced in Tails 1.1 (Closes: #8443).
16812 - Close Vidalia before we restart Tor. Otherwise Vidalia will be running
16813 and showing errors while we make sure that Tor bootstraps, which could
16815 - Allow Totem to read DVDs, by installing apparmor-profiles-extra
16816 from jessie-backports (Closes: #9990).
16817 - Make memory erasure on shutdown more robust (Closes: #9707, #10487):
16818 · don't forcefully overcommit memory
16819 · don't kill the allocating task
16820 · make sure the kernel doesn't starve from memory
16821 · make parallel sdmem handling faster and more robust
16822 - Don't offer the option, in Tor Browser, to open a downloaded file with
16823 an external application (Closes: #9285). Our AppArmor confinement was
16824 blocking most such actions anyway, resulting in poor UX; bugfix on 1.3.
16825 Accordingly, remove the now-obsolete exception we had in the Tor
16826 Browser AppArmor profile, that allowed executing seahorse-tool.
16827 - Fix performance issue in Tails Upgrader, that made it very slow to apply
16828 an automatic upgrade; bugfix on 1.7 (Closes: #10757).
16829 - Use our wrapper script to start Icedove from the GNOME menus.
16830 - Make it possible to localize our Icedove wrapper script.
16831 - List Icedove persistence option in the same position where Claws Mail
16832 used to be, in the persistent volume assistant (Closes: #10832).
16833 - Fix Electrum by installing the version from Debian Testing
16834 (Closes: #10754). We need version >=2.5.4-2, see #9713;
16835 bugfix on 2.0~beta1. And, explicitly install python-qt4 to enable
16836 Electrum's GUI: it's a Recommends, and we're not pulling it ourselves
16837 via other means anymore.
16838 - Restore default file associations (Closes: #10798);
16839 bugfix on 2.0~beta1.
16840 - Update 'nopersistent' boot parameter to 'nopersistence'; bugfix on 0.12
16841 (Closes: #10831). Thanks to live-media=removable, this had no security
16842 impact in practice.
16843 - Repair dotfiles persistence feature, by adding a symlink from
16844 /lib/live/mount/persistence to /live/persistence; bugfix on 2.0~beta1
16846 - Fix ability to re-configure an existing persistent volume using
16847 the GUI; bugfix on 2.0~beta1 (Closes: #10809).
16848 - Associate armored OpenPGP public keys named *.key with Seahorse,
16849 to workaround https://bugs.freedesktop.org/show_bug.cgi?id=93656;
16850 bugfix on 1.1 (Closes: #10889).
16851 - Update the list of enabled GNOME Shell extensions, which might fix
16852 the "GNOME Shell sometimes leaves Classic mode" bug seen in 2.0~beta1:
16853 · Remove obsolete "Alternative Status Menu", that is not shipped
16855 · Explicitly enable the GNOME Shell extensions that build
16857 - Make _get_tg_setting() compatible with set -u (Closes: #10785).
16858 - laptop-mode-tools: don't control autosuspend. Some USB input
16859 devices don't support autosuspend. This change might help fix
16860 #10850, but even if it doesn't, it makes sense to me that we
16861 don't let laptop-mode-tools fiddle with this on a Live system
16862 (Closes (for now): #10850).
16864 * Minor improvements
16865 - Remove obsolete code from various places.
16867 · hide all windows while logging in
16868 · resize and re-position the panel when the screen size grows
16869 · PostLogin: log into the Journal instead of a dedicated log file
16870 · use localectl to set the system locale and keyboard mapping
16871 · delete the Live user's password if no administration password is set
16873 · port to GDBus greeter interface, and adjust to other GDM
16876 · port to UDisks2, and from Qt4 to GTK3
16877 · adapt to work on other GNU/Linux operating systems than Tails
16878 · clean up enough upstream code and packaging bits to make it
16879 deserve being uploaded to Debian
16880 · rename everything from liveusb-creator to tails-installer
16881 - Port tails-perl5lib to GTK3 and UDisks2. In passing, do some minor
16882 refactoring and a GUI improvement.
16883 - Persistent Volume Assistant:
16884 · port to GTK3 and UDisks2
16885 · handle errors when deleting persistent volume (Closes: #8435)
16886 · remove obsolete workarounds
16887 - Don't install UDisks v1.
16888 - Adapt custom udev and polkit rules to UDisks v2 (Closes: #9054, #9270).
16889 - Adjust import-translations' post-import step for Tails Installer,
16890 to match how its i18n system works nowadays.
16891 - Use socket activation for CUPS, to save some boot time.
16892 - Set memlockd.service's OOMScoreAdjust to -1000.
16893 - Don't bother creating /var/lib/live in tails-detect-virtualization.
16894 If it does not exist at this point, we have bigger and more
16895 noticeable problems.
16896 - Simplify the virtualization detection & reporting system, and do it
16897 as a non-root user with systemd-detect-virt rather than virt-what.
16898 - Replace rsyslog with the systemd Journal (Closes: #8320), and adjust
16899 WhisperBack's logs handling accordingly.
16900 - Drop tails-save-im-environment.
16901 It's not been used since we stopped automatically starting the web browser.
16902 - Add a hook that aborts the build if any *.orig file is found. Such files
16903 appear mainly when a patch of ours is fuzzy. In most cases they are no big
16904 deal, but in some cases they end up being taken into account
16906 - Replace the tor+http shim with apt-transport-tor (Closes: #8198).
16907 - Install gnome-tweak-tool.
16908 - Don't bother testing if we're using dependency based boot.
16909 - Drop workaround to start spice-vdagent in GDM (Closes: #8025).
16910 This has been fixed in Jessie proper.
16911 - Don't install ipheth-utils anymore. It seems to be obsolete
16912 in current desktop environments.
16913 - Stop installing the buggy unrar-free, superseded in Jessie (Closes: #5838)
16914 - Drop all custom fontconfig configuration, and configure fonts rendering
16916 - Drop zenity patch (zenity-fix-whitespacing-box-sizes.diff),
16917 that was applied upstream.
16918 - Install libnet-dbus-perl (currently 1.1.0) from jessie-backports,
16919 it brings new features we need.
16920 - Have the security check and the upgrader wait for Tor having bootstrapped
16921 with systemd unit ordering.
16922 - Get rid of tails-security-check's wrapper.
16923 Its only purpose was to wait for Tor to have bootstrapped,
16924 which is now done via systemd.
16925 - Don't allow the amnesia and tails-upgrade-frontend users to run
16926 tor-has-bootstrapped as root with sudo. They don't need it anymore,
16927 thanks to using systemd for starting relevant units only once Tor
16929 - Install python-nautilus, that enables MAT's context menu item in Nautilus.
16931 - Configure GDM with a snippet file instead of patching its
16932 greeter.dconf-defaults.
16934 · port to Python 3 and GObject Introspection (Closes: #7755)
16935 · migrate from the gnutls module to the ssl one
16936 · use PGP/MIME for better attachments handling
16937 · migrate from the gnupginterface module to the gnupg one
16938 · natively support SOCKS ⇒ don't wrap with torsocks anymore
16940 · don't try to include the obsolete .xession-errors in bug reports
16942 - chroot-browser.sh: don't use static DISPLAY.
16943 - Simplify debugging:
16944 · don't hide the emergency shutdown's stdout
16945 · tails-unblock-network: trace commands so that they end up in the Journal
16946 - Configure the console codeset at ISO build time, instead of setting it
16947 to a constant via the Greeter's PostLogin.default.
16948 - Order the AppArmor policy compiling in a way that is less of a blocker
16950 - Include the major KMS modules in the initramfs. This helps seamless
16951 transition to X.Org when booting, and back to text mode on shutdown,
16952 can help for proper graphics hardware reinitialization post-kexec,
16953 and should improve GNOME Shell support in some virtual machines.
16954 - Always show the Universal Access menu icon in the GNOME panel.
16955 - Drop notification for not-migrated-yet persistence configuration,
16956 and persistence settings disabled due to wrong access rights.
16957 That migration happened more two years ago.
16958 - Remove the restricted network detector, that has been broken for too long;
16959 see #10560 for next steps (Closes: #8328).
16960 - Remove unsupported, never completed kiosk mode support.
16961 - clock_gettime_monotonic: use Perl's own function to get the integer part,
16962 instead of forking out to sed.
16963 - Don't (try to) disable lvm2 initscripts anymore. Both the original reason
16964 and the implementation are obsolete on Jessie.
16965 - Lower potential for confusion (#8443), by removing system-config-printer.
16966 One GUI to configure printers is enough (Closes: #8505).
16967 - Add "set -u" to tails-unblock-network.
16968 - Add a systemd target whose completion indicates that Tor has bootstrapped,
16969 and use it everywhere sensible (Closes: #9393).
16970 - Disable udev's 75-persistent-net-generator.rules, to preventing races
16971 between MAC spoofing and interface naming.
16972 - Replace patch against NetworkManager.conf with drop-in files.
16973 - Replace resolvconf with simpler NetworkManager and dhclient configuration.
16975 - Replace patching of the gdomap, i2p, hdparm, tor and ttdnsd initscripts
16976 with 'systemctl disable' (Closes: #9881).
16977 - Replace patches that wrapped apps with torsocks with dynamic patching with
16978 a hook, to ease maintenance. Also, patch D-Bus services as needed
16980 - Notify the user if running Tails inside non-free virtualization software
16981 that does not try to hide its nature (Closes: #5315).
16982 Thanks to Austin English <austinenglish@gmail.com> for the patch.
16983 - Declare htpdate.service as being needed for time-sync.target, to ensure
16984 that "services where correct time is essential should be ordered after
16986 - Convert some of the X session startup programs to `systemd --user' units.
16987 - Let the Pidgin wrapper pass through additional command-line arguments
16989 - Move out of the $PATH a bunch of programs that users should generally
16990 not run directly: connect-socks, end-profile, getTorBrowserUserAgent,
16991 generate-tor-browser-profile, kill-boot-profile, tails-spoof-mac,
16992 tails-set-wireless-devices-state, tails-configure-keyboard,
16993 do_not_ever_run_me, boot-profile, tails-unblock-network,
16994 tor-controlport-filter, tails-virt-notify-user, tails-htp-notify-user,
16995 udev-watchdog-wrapper (Closes: #10658)
16996 - Upgrade I2P to 0.9.23-2~deb8u+1.
16997 - Disable I2P's time syncing support.
16998 - Install Torbirdy from official Jessie backports, instead of from
16999 our own APT repository (Closes: #10804).
17000 - Make GNOME Disks' passphrase strength checking new feature work,
17001 by installing cracklib-runtime (Closes: #10862).
17002 - Add support for Japanese in Tor Browser.
17003 - Install xserver-xorg-video-intel from Jessie Backports (currently:
17004 2.99.917-2~bpo8+1). This adds support for recent chips such as
17005 Intel Broadwell's HD Graphics (Closes: #10841).
17006 - Improve a little bit post-Greeter network unblocking:
17007 · Sleep a bit longer between deleting the blacklist, and triggering udev;
17008 this might help cure #9012.
17009 · Increase logging, so that we get more information next time someone
17011 · Touch /etc/modprobe.d/ after deleting the blacklist; this might help,
17012 in case all this is caused by some aufs bug.
17013 - Enable and use the Debian jessie-proposed-updates APT repository,
17014 anticipating on the Jessie 8.3 point-release (Closes: #10897).
17015 - Upgrade most firmware packages to 20160110-1.
17016 - Upgrade Intel CPU microcodes to 3.20151106.1~deb8u1.
17017 - Disable IPv6 for the default wired connection, so that
17018 NetworkManager does not spam the logs with IPv6 router
17019 solicitation failure. Note that this does not fix the problem
17020 for other connections (Partially closes: #10939).
17023 - Adapt to the new desktop environment and applications' look.
17024 - Adapt new changed nmcli syntax and output.
17025 - New NetworkManager connection files must be manually loaded in Jessie.
17026 - Adapt to new pkexec behavior.
17027 - Adapt to how we now disable networking.
17028 - Use sysctl instead of echo:ing into /proc/sys.
17029 - Use oom_score_adj instead of the older oom_adj.
17030 - Adapt everything depending on logs to the use of the Journal.
17031 - Port to UDisks v2.
17032 - Check that the system partition is an EFI System Partition.
17033 - Add ldlinux.c32 to the list of bootloader files that are expected
17034 to be modified when we run syslinux (Closes: #9053).
17035 - Use apt(8) instead of apt-get(8).
17036 - Don't hide the cursor after opening the GNOME apps menu.
17037 - Convert the remote shell to into a systemd native service and a Python 3,
17038 script that uses the sd_notify facility (Closes: #9057). Also, set its
17039 OOM score adjustment value via its unit file, and not from the test suite.
17040 - Adjust to match where screenshots are saved nowadays.
17041 - Check that all system units have started (Closes: #8262)
17042 - Simplify the "too small device" test.
17043 - Spawn `poweroff' and `halt' in the background, and don't wait for them
17044 to return: anything else would be racy vs. the remote shell's stopping.
17045 - Bump video memory allocated to the system under test, to fix out of video
17047 - When configuring the CPU to lack PAE support, use a qemu32 CPU instead
17048 of a Pentium one: the latter makes GNOME Shell crash.
17049 See #8778 for details about how Mesa's CPU features detection has
17050 room for improvement.
17051 - Adjust free(1) output parsing for Jessie.
17052 - vm-execute: rename --type option to --spawn.
17053 - Add method to set the X.Org clipboard, and install its dependency
17055 - Paste URLs in one go, to work around issue with lost key presses
17056 in the browser (Closes: #10467).
17057 - Reliably wait for Synaptic's search button to fade in.
17058 - Take into account that the sticky bit is not set on block devices
17060 - Ensure that we can use a NetworkManager connection stored in persistence
17062 - Use a stricter regexp when extracting logs for dropped packets.
17063 - Clone the host CPU for the test suite guests (Closes: #8778).
17064 - Run ping as root (aufs does not support file capabilities so we don't
17065 get cap_net_raw+ep, and if built on a filesystem that does support
17066 file capabilities, then /bin/ping is not setupd root).
17067 - Escape regexp special characters when constructing the firewall log
17068 parsing regexp, and pass -P to grep, since Ruby uses PCRE.
17069 - Adjust is_persistent?() helper to findmnt changes in Jessie.
17070 - Rework in depth how we measure pattern coverage in memory, with more
17071 reliable Linux OOM and VM settings, fundamental improvements
17072 in what exactly we measure, and custom OOM adjutments for fillram
17073 processes (Closes: #9705).
17074 - Use blkid instead of parted to determine the filesystem type.
17075 - Use --kiosk mode instead of --fullscreen in virt-viewer, to remove
17076 the tiny border of the in-viewer menu.
17077 - Remove now redundant desktop screenshot directory scenario.
17078 - Adapt GNOME notification handling for Debian Jessie (Closes: #8782)
17079 - Disable screen blanking in the automated test suite, which occasionally
17080 breaks some test cases (Closes: #10403).
17081 - Move upgrade scenarios to the feature dedicated to them.
17082 - Don't make libvirt storage volumes executable.
17083 - Refactor the PAUSE_ON_FAIL functionality, so that we can use `pause()`
17084 as a breakpoint when debugging.
17085 - Drop non-essential Totem test that is mostly a duplicate, and too painful
17086 to be worth automating on Jessie.
17087 - Retry Totem HTTPS test with a new Tor circuit on failure.
17088 - Replace iptables status regexp-based parser with a new XML-based
17089 status analyzer: the previous implementation could not be adjusted
17090 to the new ip6tables' output (Closes: #9704).
17091 - Don't reboot in one instance when it is not needed.
17092 - Optimize memory erasure anti-test: block the boot to save CPU on the host.
17093 - Update I2P tests for Jessie, and generally make them more robust.
17094 - Update Electrum tests for 2.5.4-2 (Closes: #10758).
17095 - Add workaround for libvirt vs. guestfs permissions issue, to allow
17096 running the test suite on current Debian sid.
17097 - Fix buggy code, that happened to work by mistake, in the Seahorse
17098 test cases; bugfix on 1.8.
17099 - Update test suite images due to CSS change on Tails' website.
17100 - Adapt Tor Browser tests to work with the 5.5 series.
17101 - Automatically test downloading files in Tor Browser.
17102 - Remove obsolete scenario, that tested opening a downloaded file with
17103 an external application, which we do not support anymore.
17104 - Improve robustness of the "Tails OpenPGP keys" scenario (Closes: #10378).
17105 - Automatically test the "Diable all networking" feature (Closes: #10430).
17106 - Automatically test that SSH works over LAN (Closes: #9087).
17107 - Bump some statuc sleeps to fix a few race conditions (Closes: #5330).
17108 - Automatically test that an emergency shutdown triggers on boot
17109 medium removal (Closes: #5472).
17110 - Make the AppArmor checks actually detect errors (Closes: #10926).
17113 - Bump amount of disk space needed to build Tails with Vagrant.
17114 The addition of the Japanese Tor Browser tarball made us reach
17115 the limit of the previous value.
17117 * Adjustments for Debian 8 (Jessie) with no or very little user-visible impact
17118 - Free the fixed UIDs/GIDs we need before creating the corresponding users.
17119 - Replace the real gnome-backgrounds with a fake, equivs generated one
17120 (Closes: #8055). Jessie's gnome-shell depends on gnome-backgrounds,
17121 which is too fat to ship considering we're not using it.
17122 - AppArmor: adjust CUPS profile to support our Live system environment
17124 · Mangle lib/live/mount/overlay/... as usual for aufs.
17125 · Pass the the attach_disconnected flag, that's needed for compatibility
17127 - Make sure we don't ship geoclue* (Closes: #7949).
17128 - Drop deprecated GDM configuration file.
17129 - Don't add the Live user to the deprecated 'fuse' group.
17130 - Drop hidepid mount option for /proc (Closes: #8256). In its current,
17131 simplistic form it cannot be supported by systemd.
17132 - Don't manually load acpi-cpufreq at boot time. It fails to load
17133 whenever no device it supports is present, which makes the
17134 systemd-modules-load.service fail. These days, the kernel
17135 should just automatically load such modules when they are needed.
17136 - Drop sysvinit-specific (sensigs.omit.d) tweaks for memlockd.
17137 - Disable the GDM unit file's Restart=always, that breaks our "emergency
17138 shutdown on boot medium removal" feature.
17139 - Update the implementation of the memory erasure on shutdown feature:
17140 · check for rebooting state using systemctl, instead of the obsolete
17141 $RUNLEVEL (Closes: #8306)
17142 · the kexec-load initscript normally silently exits unless systemd is
17143 currently running a reboot job. This is not the case when the emergency
17144 shutdown has been triggered, so we removed this check
17145 · migrate tails-kexec to the /lib/systemd/system-shutdown/ facility
17146 · don't (try to) switch to tty1 on emergency shutdown: it apparently
17147 requires data that we haven't locked into memory, and then it blocks
17148 the whole emergency shutdown process
17149 - Display a slightly darker version of the desktop wallpaper on the screen
17150 saver, instead of the default flashy "Debian 8" branding (Closes: #9038).
17151 - Disable software autorun from external media.
17152 - Disable a few unneeded D-Bus services. Some of these services are
17153 automatically started (via D-Bus activation) when GNOME Shell tries
17154 to use them. The only "use" I've seen for them, except eating
17155 precious RAM, is to display "No appointment today" in the calendar pop-up.
17157 - Prevent NetworkManager services from starting at boot time
17158 (Closes: #8313). We start them ourselves after changing the MAC address.
17159 - Unfuzzy all patches (Closes: #8268) and drop a few obsolete ones.
17160 - Adapt IBus configuration for Jessie (Closes: #8270), i.e. merge the two
17161 places where we configure keyboard layout and input methods: both are now
17162 configured in the same place in Jessie's GNOME.
17163 - Migrate panel launchers to the favorite apps list (Closes: #7992).
17164 - Drop pre-GNOME Shell menu tweaks.
17165 - Hide "Log out" button in the GNOME Shell menu (Closes: #8364).
17166 - Add a custom shutdown-helper GNOME Shell extension (Closes: #8302, #5684
17167 and #5878) that removes the press-Alt-to-turn-shutdown-button-into-Suspend
17168 functionality from the GNOME user menu, and makes Restart and Shutdown
17169 immediate, without further user interaction. Accordingly remove our custom
17170 Shutdown Helper panel applet (#8302).
17171 - Drop GNOME Panel configuration, now deprecated.
17172 - Disable GNOME Shell's screen lock feature.
17173 We're not there yet (see #5684).
17174 - Disable GNOME Shell screen locker's user switch feature.
17175 - Explicitly install libany-moose-perl (Closes: #8051).
17176 It's needed by our OpenPGP applet. On Wheezy, this package was pulled
17177 by some other dependency. This is not the case anymore on Jessie.
17178 - Don't install notification-daemon nor gnome-mag: GNOME Shell has taken
17179 over this functionality (Closes: #7481).
17180 - Don't install ntfsprogs: superseded on Jessie.
17181 - Don't install barry-util: not part of Jessie.
17182 - Link udev-watchdog dynamically, and lock it plus its dependencies
17184 - Migrate from gdm-simple-greeter to a custom gdm-tails session
17186 - Update Plymouth installation and configuration:
17187 · install the plymouth packages via chroot_local-hooks: lb 2.x's "standard"
17188 packages list pulls console-common in, which plymouth now conflicts with
17189 · don't patch the plymouth initscript anymore, that was superseded
17190 by native systemd unit files
17191 · mask the plymouth-{halt,kexec,poweroff,reboot,shutdown} services,
17192 to prevent them from occupying the active TTY with an (empty) splash
17193 screen on shutdown/reboot, that would hide the messages we want to show
17194 to the user via tails-kexec (Closes: #9032)
17195 - Migrate GNOME keyboard layout settings from libgnomekbd to input-sources
17197 - Explicitly install syslinux-efi, that we need and is not automatically
17198 pulled by anything else anymore.
17199 - Workaround #7248 for GDM: use a solid blue background picture,
17200 instead of a solid color fill, in the Greeter session.
17201 - De-install gcc-4.8-base and gcc-4.9 at the end of the ISO build process.
17202 - Revert the "Wrap syndaemon to always use -t" Wheezy-specific workaround.
17203 - htpdate: run date(1) in a Jessie-compatible (and nicer) way.
17204 - Remove obsolete dconf screenshot settings and the corresponding test.
17205 - Drop our patched python-dbus{,-dev} package (Closes: #9177).
17206 - live-persist: stop overriding live-boot's functions, we now have
17207 a recent enough blkid.
17208 - Adjust sdmem initramfs bits for Jessie:
17209 · Directly call poweroff instead of halt -p.
17210 · Don't pass -n to poweroff and reboot, it's not supported anymore.
17211 - Wrap text in the Unsafe Browser startup warning dialog
17212 (Jessie's zenity does not wrap it itself).
17213 - Associate application/pgp-keys with Seahorse's "Import Key" application
17215 - Install topIcons GNOME Shell extension (v28), to work around the fact
17216 that a few of the applets we use hijack the notification area.
17217 - "cd /" to fix permissions issue at tails-persistence-setup startup
17219 - Install gstreamer1.0-libav, so that Totem can play H264-encoded videos.
17220 - Adjust APT sources configuration:
17221 · remove explicit jessie and jessie-updates sources:
17222 automatically added by live-build
17223 · add Debian testing
17224 · add jessie-backports
17225 - Firewall: white-list access to the accessibility daemon (Closes: #8075).
17226 - Adjust to changed desktop notification behavior and supported feature set
17228 · pass the DBUS_SESSION_BUS_ADDRESS used by the GNOME session
17230 · update waiting for a notification handler: gnome-panel and nm-applet
17231 are obsolete, GNOME Shell is now providing this facility, so instead
17232 wait for a process that starts once GNOME Shell is ready, namely
17233 ibus-daemon (Closes: #8685)
17234 · port tails-warn-about-disabled-persistence and tails-virt-notify-user
17235 to notification actions (instead of hyperlinks), and make the latter
17236 transient; to this end, add support to Desktop::Notify for "hints"
17237 and notification actions
17238 · tails-security-check: use a dialog box instead of desktop notifications
17239 · MAC spoofing failure notification: remove the link to the documentation;
17240 it was broken on Tails/Wheezy already, see #10559 for next steps
17241 - Don't explicitly install gnome-panel nor gnome-menus, so that they go away
17242 whenever the Greeter does not pull them in anymore.
17243 - Install gkbd-capplet, that provides gkbd-keyboard-display (Closes: #8363).
17244 - Install Tor 0.2.7 from deb.torproject.org: we don't need to rebuild it
17245 ourselves for seccomp support anymore.
17246 - Wrap Seahorse with torsocks when it is started as a D-Bus service too
17248 - Rename the AppArmor profile for Tor, so it applies to the system-wide
17249 Tor service we run (Closes: #10528).
17250 - Essentially revert ALSA state handling to how it was pre-Jessie, so that
17251 mixer levels are unmuted and sanitized at boot time (Closes: #7591).
17252 - Pass --yes to apt-get when installing imagemagick.
17253 - Make removable devices, that we support installing Tails to, user writable:
17254 Tails Installer requires raw block device access to such devices
17255 (Closes: #8273). Similarly, allow the amnesia user, when active, to open
17256 non-system devices for writing with udisks2. This is roughly udisks2's
17257 equivalent of having direct write access to raw block storage devices.
17258 Here too, Tails Installer uses this functionality.
17259 - Disable networkd to prevent any risk of DNS leaks it might cause; and
17260 disable timesyncd, as we have our own time synchronization mechanism.
17261 They are not enabled by default in Jessie, but may be in Stretch,
17262 so let's be explicit about it.
17263 - Mask hwclock-save.service, to avoid sync'ing the system clock
17264 to the hardware clock on shutdown (Closes: #9363).
17265 - apparmor-adjust-cupsd-profile.diff: adjust to parse fine on Jessie
17267 - Explicitly use tor@default.service when it's the one we mean.
17268 - Refactor GNOME/X env exporting to Tails' shell library, and grab
17269 more of useful bits of the desktop session environment.
17270 Then, use the result in the test suite's remote shell.
17271 - Stop tweaking /etc/modules. It's 2015, the kernel should load these things
17272 automatically (Closes: #10609).
17273 - Have systemd hardening let Tor modify its configuration (needed by Tor
17274 Launcher), and start obfs4proy (Closes: #10696, #10724).
17275 - Bump extensions.adblockplus.currentVersion and
17276 extensions.enigmail.configuredVersion to match what we currently get
17278 - I2P: switch from 'service' to 'systemctl' where possible.
17280 -- Tails developers <tails@boum.org> Mon, 25 Jan 2016 18:06:33 +0100
17282 tails (1.8.2) unstable; urgency=medium
17285 - Upgrade Tor Browser to 5.0.7.
17286 - Upgrade Linux to 3.16.7-ckt20-1+deb8u2.
17287 - Upgrade foomatic-filters to 4.0.17-1+deb7u1.
17288 - Upgrade git to 1:1.7.10.4-1+wheezy2.
17289 - Upgrade Icedove to 38.5.0-1~deb7u1.
17290 - Upgrade libxml2-related packages to 2.8.0+dfsg1-7+wheezy5.
17291 - Upgrade OpenSSL-related packages to 1.0.1e-2+deb7u19.
17292 - Upgrade libsmbclient to 2:3.6.6-6+deb7u6.
17294 -- Tails developers <tails@boum.org> Sat, 09 Jan 2016 16:27:27 +0100
17296 tails (1.8.1) unstable; urgency=medium
17299 - Upgrade Tor Browser to 5.0.6.
17300 - Upgrade Linux to 3.16.7-ckt20-1+deb8u1
17301 - Upgrade gdkpixbuf to 2.26.1-1+deb7u3
17302 - Upgrade bind9 tools to 1:9.8.4.dfsg.P1-6+nmu2+deb7u8
17305 - Fix time synchronization in bridge mode by refreshing our patch
17306 against Tor's AppArmor profile.
17308 -- Tails developers <tails@boum.org> Fri, 18 Dec 2015 19:05:18 +0000
17310 tails (1.8) unstable; urgency=medium
17313 - Upgrade Tor to 0.2.7.6-1~d70.wheezy+1+tails1.
17314 - Upgrade Tor Browser to 5.0.5. (Closes: #10751)
17315 - Upgrade LibreOffice to 1:3.5.4+dfsg2-0+deb7u5.
17316 - Upgrade krb5-based packages to 1.10.1+dfsg-5+deb7u6.
17317 - Upgrade Linux to 3.16.7-ckt11-1+deb8u6.
17318 - Upgrade wpasupplicant to 1.0-3+deb7u3.
17319 - Upgrade libpng12-0 to 1.2.49-1+deb7u1.
17320 - Upgrade openjdk-7 to 7u91-2.6.3-1~deb7u1.
17321 - Upgrade libnspr4 to 2:4.9.2-1+deb7u3
17322 - Upgrade dpkg to 1.16.17.
17323 - Upgrade gnutls26 to 2.12.20-8+deb7u4.
17324 - Upgrade Icedove to 1:38.0.1-1~deb7u1.
17325 - Upgrade OpenSSL to 1.0.1e-2+deb7u18.
17328 - Upgrade to Electrum 2.5.4-2~d70.wheezy+1+tails1. Now Electrum
17329 should work again. Note that the documentation has not been
17330 adapted to the slight changes in the Electrum account setup
17333 * Minor improvements
17334 - Upgrade I2P to 0.9.23-2~deb7u+1.
17335 - Rebase our patch against the Tor Browser AppArmor profile on top
17336 of the one shipped in torbrowser-launcher 0.2.1-2.
17337 - Warn if the claws-mail persistence is enabled and contains a
17338 Claws Mail configuration when starting icedove. (Closes: #10458)
17339 - Replace the Claws Mail GNOME launcher with Icedove. (Closes:
17341 - Remove the Claws Mail persistence feature from the Persistence
17342 Assistant. (Closes: #10742)
17345 - Simplify ISO image naming rules by using the base rule we use
17346 for Jenkins all the time, except when building from a tag
17347 (i.e. building a release). (Closes: #10349)
17350 - Lower the waiting time for USB installation in the test suite.
17351 So far we were waiting up to one hour, which is just the same as
17352 our Jenkins inactivity timeout, so in practice when Tails
17353 Installer fails and displays an error message, instead of
17354 reporting that the job failed (which is the point of the
17355 exercise) we abort the job due to this timeout which
17356 communicates less clearly that there's probably a bug. (Closes:
17358 - Remove the check for the sound icon in the systray in the
17359 Windows Camouflage tests. (Closes: #10493)
17360 - Retry running whois when "LIMIT EXCEEDED" is in its output for
17361 increased robustness. (Closes: #10523)
17362 - Make Seahorse tests more robust. (Closes: #9095, #10501)
17363 - Make the handling of Pidgin's account manager more robust.
17366 -- Tails developers <tails@boum.org> Mon, 14 Dec 2015 23:07:19 +0100
17368 tails (1.7) unstable; urgency=medium
17370 * Major new features and changes
17371 - Upgrade Tor Browser to 5.0.4. (Closes: #10456)
17372 - Add a technology preview of the Icedove Email client (a
17373 rebranded version of Mozilla Thunderbird), including OpenPGP
17374 support via the Enigmail add-on, general security and anonymity
17375 improvements via the Torbirdy add-on, and complete persistence
17376 support (which will be enabled automatically if you already have
17377 Claws Mail persistence enabled). Icedove will replace Claws Mail
17378 as the supported email client in Tails in a future
17379 release. (Closes: #6151, #9498, #10285)
17380 - Upgrade Tor to 0.2.7.4-rc-1~d70.wheezy+1+tails1. Among the many
17381 improvement of this new Tor major release, the new
17382 KeepAliveIsolateSOCKSAuth option allows us to drop the
17383 bug15482.patch patch (taken from the Tor Browse bundle) that
17384 enabled similar (but inferior) functionality for *all*
17385 SocksPort:s -- now the same circuit is only kept alive for
17386 extended periods for the SocksPort used by the Tor
17387 Browser. (Closes: #10194, #10308)
17388 - Add an option to Tails Greeter which disables networking
17389 completely. This is useful when intending to use Tails for
17390 offline work only. (Closes: #6811)
17393 - Fix CVE-2015-7665, which could lead to a network interface's IP
17394 address being exposed through wget. (Closes: #10364)
17395 - Prevent a symlink attack on ~/.xsession-errors via
17396 tails-debugging-info which could be used by the amnesia user to
17397 read the contents of any file, no matter the
17398 permissions. (Closes: #10333)
17399 - Upgrade libfreetype6 to 2.4.9-1.1+deb7u2.
17400 - Upgrade gdk-pixbuf packages to 2.26.1-1+deb7u2.
17401 - Upgrade Linux to 3.16.7-ckt11-1+deb8u5.
17402 - Upgrade openjdk-7 packages to 7u85-2.6.1-6~deb7u1.
17403 - Upgrade unzip to 6.0-8+deb7u4.
17406 - Add a temporary workaround for an issue in our code which checks
17407 whether i2p has bootstrapped, which (due to some recent change
17408 in either I2P or Java) could make it appear it had finished
17409 prematurely. (Closes: #10185)
17410 - Fix a logical bug in the persistence preset migration code while
17411 real-only persistence is enabled. (Closes: #10431)
17413 * Minor improvements
17414 - Rework the wordings of the various installation and upgrade
17415 options available in Tails installer in Wheezy. (Closes: #9672)
17416 - Restart Tor if bootstrapping stalls for too long when not using
17417 pluggable transports. (Closes: #9516)
17418 - Install firmware-amd-graphics, and firmware-misc-nonfree instead
17419 of firmware-ralink-nonfree, both from Debian Sid.
17420 - Update the Tails signing key. (Closes: #10012)
17421 - Update the Tails APT repo signing key. (Closes: #10419)
17422 - Install the nmh package. (Closes: #10457)
17423 - Explicitly run "sync" at the end of the Tails Upgrader's upgrade
17424 process, and pass the "sync" option when remounting the system
17425 partition as read-write. This might help with some issues we've
17426 seen, such as #10239, and possibly for #8449 as well.
17429 - Add initial automated tests for Icedove. (Closes: #10332)
17430 - Add automated tests of the MAC spoofing feature. (Closes: #6302)
17431 - Drop the concept of "background snapshots" and introduce a general
17432 system for generating snapshots that can be shared between
17433 features. This removes all silly hacks we previously used to
17434 "skip" steps, and greatly improves performance and reliability
17435 of the whole test suite. (Closes: #6094, #8008)
17436 - Flush to the log file in debug_log() so the debugging info can
17437 be viewed in real time when monitoring the debug log
17438 file. (Closes: #10323)
17439 - Force UTF-8 locale in automated test suite. Ruby will default to
17440 the system locale, and if it is non-UTF-8, some String-methods
17441 will fail when operating on non-ASCII strings. (Closes: #10359)
17442 - Escape regexp used to match nick in CTCP replies. Our Pidgin
17443 nick's have a 10% chance to include a ^, which will break that
17444 regexp. We need to escape all characters in the nick. (Closes:
17446 - Extract TBB languages from the Tails source code. This will
17447 ensure that valid locales are tested. As an added bonus, the
17448 code is greatly simplified. (Closes: #9897)
17449 - Automatically test that tails-debugging-info is not susceptible
17450 to the type of symlink attacks fixed by #10333.
17451 - Save all test suite artifacts in a dedicated directory with more
17452 useful infromation encoded in the path. This makes it easier to
17453 see which artifacts belongs to which failed scenario and which
17454 run. (Closes: #10151)
17455 - Log all useful information via Cucumber's formatters instead of
17456 printing to stderr, which is not included when logging to file
17457 via `--out`. (Closes: #10342)
17458 - Continue running the automated test suite's vnc server even if
17459 the client disconnects. (Closes: #10345)
17460 - Add more automatic tests for I2P. (Closes: #6406)
17461 - Bump the Tor circuit retry count to 10. (Closes: #10375)
17462 - Clean up dependencies: (Closes: #10208)
17467 -- Tails developers <tails@boum.org> Tue, 03 Nov 2015 01:09:41 +0100
17469 tails (1.6) unstable; urgency=medium
17472 - Upgrade Tor Browser to 5.0.3. (Closes: #10223)
17473 - Upgrade bind9-based packages to 1:9.8.4.dfsg.P1-6+nmu2+deb7u7.
17474 - Upgrade liblcms1 to 1.19.dfsg2-1.2+deb7u1.
17475 - Upgrade libldap-2.4-2 to 2.4.31-2+deb7u1.
17476 - Upgrade libslp1 to 1.2.1-9+deb7u1.
17477 - Upgrade ssl-cert to 1.0.32+deb7u1.
17480 - Fix a corner case for the MAC spoofing panic mode. If panic mode
17481 failed to disable the specific device that couldn't be spoofed
17482 (by unloading the module) we disable networking. Previously we
17483 only stopped NetworkManager. The problem is that NM isn't even
17484 started at this time, but will specifically be started when
17485 we're done with MAC spoofing. Therefore, let's completely
17486 disable NetworkManager so it cannot possibly be
17487 started. (Closes: #10160)
17488 - Avoid use of uninitialized value in restricted-network-detector.
17489 If NetworkManager decides that a wireless connection has timed
17490 out before "supplicant connection state" has occued, our idea of
17491 the state is `undef`, so it cannot be used in a string
17492 comparison. Hence, let's initialize the state to the empty
17493 string instead of `undef`. Also fix the state
17494 recording. Apparently NetworkManager can say a few different
17495 things when it logs the device state transitions. (Closes:
17498 * Minor improvements
17499 - Remove workaround for localizing search engine plugins. The
17500 workaround has recently become unnecessary, possibly due to the
17501 changes made for the seach bar after the Tor Browser was rebased
17502 on Firefox 38esr. (Closes: #9146)
17503 - Refer to the I2P Browser in the I2P notifications. Instead of
17504 some obscure links that won't work in the Tor Browser, where
17505 users likely will try them, and which I believe will open them
17506 by default. (Closes: #10182)
17507 - Upgrade I2P to 0.9.22. Also set the I2P apparmor profile to
17508 enforce mode. (Closes: #9830)
17511 - Test that udev-watchdog is monitoring the correct device when
17512 booted from USB. (Closes: #9890)
17513 - Remove unused 'gksu' step. This causes a false-positive to be
17514 found for #5330. (Closes: #9877)
17515 - Make --capture capture individual videos for failed scenarios
17516 only, and --capture-all to capture videos for all scenarios.
17518 - Use the more efficient x264 encoding when capturing videos using
17519 the --capture* options. (Closes: #10001)
17520 - Make --old-iso default to --iso if omitted. Using the same ISO
17521 for the USB upgrade tests most often still does what we want,
17522 e.g. test that the current version of Tails being tested has a
17523 working Tails installer. Hence this seems like a reasonable
17524 default. (Closes: #10147)
17525 - Avoid nested FindFailed exceptions in waitAny()/findAny(), and
17526 throw a new dedicated FindAnyFailed exception if these fail
17527 instead. Rjb::throw doesn't block Ruby's execution until the
17528 Java exception has been received by Ruby, so strange things can
17529 happen and we must avoid it. (Closes: #9633)
17530 - Fix the Download Management page in our browsers. Without the
17531 browser.download.panel.shown pref set, the progress being made
17532 will not update until after the browser has been restarted.
17534 - Add a 'pretty_debug' (with an alias: 'debug') Cucumber formatter
17535 that deals with debugging instead of printing it to STDERR via
17536 the `--debug` option (which now has been removed). This gives us
17537 the full flexibility of Cucumber's formatter system, e.g. one
17538 easy-to-read formatter can print to the terminal, while we get
17539 the full debug log printed to a file. (Closes: #9491)
17540 - Import logging module in otr-bot.py. Our otr-bot.py does not use
17541 logging but the jabberbot library makes logging calls, causing a
17542 one-off message “No handlers could be found for logger
17543 "jabberbot"” to be printed to the console. This commit
17544 effectively prevents logging/outputting anything to the terminal
17545 which is at a level lower than CRITICAL. (Closes: 9375)
17546 - Force new Tor circuit and reload web site on browser
17547 timeouts. (Closes: #10116)
17548 - Focus Pidgin's buddy list before trying to access the tools
17549 menu. (Closes: #10217)
17550 - Optimize IRC test using waitAny. If connecting to IRC fails,
17551 such as when OFTC is blocking Tor, waiting 60 seconds to connect
17552 while a a Reconnect button is visible is sub-optimal. It would
17553 be better to try forcing a new Tor circuit and clicking the
17554 reconnect button. (Closes: #9653)
17555 - Wait for (and focus if necessary) Pidgin's Certificate windows.
17558 -- Tails developers <tails@boum.org> Sun, 20 Sep 2015 17:47:26 +0000
17560 tails (1.5.1) unstable; urgency=medium
17563 - Upgrade Tor Browser to 5.0.2. (Closes: #10112)
17564 - Upgrade gdk-pixbuf packages to 2.26.1-1+deb7u1.
17565 - Upgrade libnss3 to 2:3.14.5-1+deb7u5.
17568 - Refresh Tor Browser AppArmor profile patch. The old one doesn't
17569 apply on top of testing's torbrowser-launcher anymore.
17572 - Make sure Jenkins creates new jobs to build the testing branch
17573 after freezes. (Closes: #9925)
17575 -- Tails developers <tails@boum.org> Fri, 28 Aug 2015 01:52:14 +0200
17577 tails (1.5) unstable; urgency=medium
17579 * Major new features and changes
17580 - Move LAN web browsing from Tor Browser to the Unsafe Browser,
17581 and forbid access to the LAN from the former. (Closes: #7976)
17582 - Install a 32-bit GRUB EFI boot loader. This at least works
17583 on some Intel Baytrail systems. (Closes: #8471)
17586 - Upgrade Tor Browser to 5.0, and integrate it:
17587 · Disable Tiles in all browsers' new tab page.
17588 · Don't use geo-specific search engine prefs in our browsers.
17589 · Hide Tools -> Set Up Sync, Tools -> Apps (that links to the Firefox
17590 Marketplace), and the "Share this page" button in the Tool bar.
17591 · Generate localized Wikipedia search engine plugin icons so the
17592 English and localized versions can be distinguished in the new
17593 search bar. (Closes: #9955)
17594 - Fix panic mode on MAC spoofing failure. (Closes: #9531)
17595 - Deny Tor Browser access to global tmp directories with AppArmor,
17596 and give it its own $TMPDIR. (Closes: #9558)
17597 - Tails Installer: don't use a predictable file name for the subprocess
17598 error log. (Closes: #9349)
17599 - Pidgin AppArmor profile: disable the launchpad-integration abstraction,
17600 which is too wide-open.
17601 - Use aliases so that our AppArmor policy applies to
17602 /lib/live/mount/overlay/ and /lib/live/mount/rootfs/*.squashfs/ as well as
17603 it applies to /. And accordingly:
17604 · Upgrade AppArmor packages to 2.9.0-3~bpo70+1.
17605 · Install rsyslog from wheezy-backports, since the version from Wheezy
17606 conflicts with AppArmor 2.9.
17607 · Stop installing systemd for now: the migration work is being done in
17608 the feature/jessie branch, and it conflicts with rsyslog from
17610 · Drop apparmor-adjust-user-tmp-abstraction.diff: obsoleted.
17611 · apparmor-adjust-tor-profile.diff: simplify and de-duplicate rules.
17612 · Take into account aufs whiteouts in the system_tor profile.
17613 · Adjust the Vidalia profile to take into account Live-specific paths.
17614 - Upgrade Linux to 3.16.7-ckt11-1+deb8u3.
17615 - Upgrade bind9-host, dnsutils and friends to 1:9.8.4.dfsg.P1-6+nmu2+deb7u6.
17616 - Upgrade cups-filters to 1.0.18-2.1+deb7u2.
17617 - Upgrade ghostscript to 9.05~dfsg-6.3+deb7u2.
17618 - Upgrade libexpat1 to 2.1.0-1+deb7u2.
17619 - Upgrade libicu48 to 4.8.1.1-12+deb7u3.
17620 - Upgrade libwmf0.2-7 to 0.2.8.4-10.3+deb7u1.
17621 - Upgrade openjdk-7 to 7u79-2.5.6-1~deb7u1.
17624 - Upgrade Tor to 0.2.6.10-1~d70.wheezy+1+tails1.
17626 * Minor improvements
17627 - Tails Installer: let the user know when it has rejected a candidate
17628 destination device because it is too small. (Closes: #9130)
17629 - Tails Installer: prevent users from trying to "upgrade" a device
17630 that contains no Tails, or that was not installed with Tails Installer.
17632 - Install libotr5 and pidgin-otr 4.x from wheezy-backports. This adds
17633 support for the OTRv3 protocol and for multiple concurrent connections
17634 to the same account. (Closes: #9513)
17635 - Skip warning dialog when starting Tor Browser while being offline,
17636 in case it is already running. Thanks to Austin English for the patch!
17638 - Install the apparmor-profiles package (Closes: #9539), but don't ship
17639 a bunch of AppArmor profiles we don't use, to avoid increasing
17640 boot time. (Closes: #9757)
17641 - Ship a /etc/apparmor.d/tunables/home.d/tails snippet, instead
17642 of patching /etc/apparmor.d/tunables/home.
17643 - live-boot: don't mount tmpfs twice on /live/overlay, so that the one which
17644 is actually used as the read-write branch of the root filesystem's union
17645 mount, is visible. As a consequence:
17646 · One can now inspect how much space is used, at a given time, in the
17647 read-write branch of the root filesystem's union mount.
17648 · We can make sure our AppArmor policy works fine when that filesystem
17649 is visible, which is safer in case e.g. live-boot's behavior changes
17650 under our feet in the future... or in case these "hidden" files are
17651 actually accessible somehow already.
17654 - Add our jenkins-tools repository as a Git submodule, and replace
17655 check_po.sh with a symlink pointing to the same script in that submodule.
17656 Adjust the automated test suite accordingly. (Closes: #9567)
17657 - Bump amount of RAM needed for Vagrant RAM builds to 7.5 GiB. In
17658 particular the inclusion of the Tor Browser 5.0 series has recently
17659 increased the amount of space needed to build Tails. (Closes: #9901)
17662 - Test that the Tor Browser cannot access LAN resources.
17663 - Test that the Unsafe Browser can access the LAN.
17664 - Installer: test new behavior when trying to upgrade an empty device, and
17665 when attempting to upgrade a non-Tails FAT partition on GPT; also, take
17666 into account that all unsupported upgrade scenarios now trigger
17668 - Request a new Tor circuit and re-run the Seahorse and GnuPG CLI tests
17669 on failure. (Closes: #9518, #9709)
17670 - run_test_suite: remove control chars from log file even when cucumber
17671 exits with non-zero. (Closes: #9376)
17672 - Add compatibility with cucumber 2.0 and Debian Stretch. (Closes: #9667)
17673 - Use custom exception when 'execute_successfully' fails.
17674 - Retry looking up whois info on transient failure. (Closes: #9668)
17675 - Retry wget on transient failure. (Closes: #9715)
17676 - Test that Tor Browser cannot access files in /tmp.
17677 - Allow running the test suite without ntp installed. There are other means
17678 to have an accurate host system clock, e.g. systemd-timesyncd and tlsdate.
17680 - Bump timeout in the Totem feature.
17681 - Grep memory dump using the --text option. This is necessary with recent
17682 versions of grep, such as the one in current Debian sid, otherwise it
17683 will count only one occurrence of the pattern we're looking for.
17685 - Include execute_successfully's error in the exception, instead
17686 of writing it to stdout via puts. (Closes: #9795)
17687 - Test that udev-watchdog is actually monitoring the correct device.
17689 - IUK: workaround weird Archive::Tar behaviour on current sid.
17690 - Test the SocksPort:s given in torrc in the Unsafe Browser.
17691 This way we don't get any sneaky errors in case we change them and
17692 forget to update this test.
17693 - Directly verify AppArmor blocking of the Tor Browser by looking in
17694 the audit log: Firefox 38 does no longer provide any graphical feedback
17695 when the kernel blocks its access to files the user wants to access.
17696 - Update browser-related automated test suite images, and workaround
17697 weirdness introduced by the new Tor Browser fonts.
17698 - Test that Pidgin, Tor Browser, Totem and Evince cannot access ~/.gnupg
17699 via alternate, live-boot generated paths.
17700 - Adjust tests to cope with our new AppArmor aliases.
17701 - Bump memory allocated to the system under test to 2 GB. (Closes: #9883)
17703 -- Tails developers <tails@boum.org> Mon, 10 Aug 2015 19:12:58 +0200
17705 tails (1.4.1) unstable; urgency=medium
17708 - Upgrade Tor Browser to 4.5.3, based on Firefox 31.8.0 ESR. (Closes: #9649)
17709 - Upgrade Tor to 0.2.6.9-1~d70.wheezy+1+tails2, which includes a circuit
17710 isolation bugfix. (Closes: #9560)
17711 - AppArmor: deny Tor Browser access to the list of recently used files.
17713 - Upgrade OpenSSL to 1.0.1e-2+deb7u17.
17714 - Upgrade Linux to 3.16.7-ckt11-1.
17715 - Upgrade CUPS to 1.5.3-5+deb7u6.
17716 - Upgrade FUSE to 2.9.0-2+deb7u2.
17717 - Upgrade libsqlite3-0 to 3.7.13-1+deb7u2.
17718 - Upgrade ntfs-3g and ntfsprogs to 1:2012.1.15AR.5-2.1+deb7u2.
17719 - Upgrade p7zip-full to 9.20.1~dfsg.1-4+deb7u1.
17722 - Fix automatic upgrades in Windows Camouflage mode. (Closes: #9413)
17723 - Don't ship the snakeoil SSL key pair generated by ssl-cert in the ISO.
17725 - Partially fix the truncated notifications issue. (#7249)
17727 * Minor improvements
17728 - Disable the hwclock.sh initscript at reboot/shutdown time.
17729 This is an additional safety measure to ensure that the hardware clock
17730 is not modified. (Closes: #9364)
17731 - Stop shipping /var/cache/man/*, to make ISOs and IUKs smaller.
17733 - Update torbrowser-AppArmor-profile.patch to apply cleanly on top of the
17734 profile shipped with torbrowser-launcher 0.2.0-1.
17735 - Add the jessie/updates APT repo and set appropriate pinning.
17736 - Upgrade Electrum to 1.9.8-4~bpo70+1.
17737 - Upgrade kernel firmware packages to 0.44.
17740 - Install the Linux kernel from Debian Jessie. (Closes: #9341)
17741 - Remove files that are not under version control when building in Jenkins.
17743 - Don't modify files in the source tree before having possibly merged
17744 the base branch into it. (Closes: #9406)
17745 - Make it so eatmydata is actually used during a greater part of the build
17746 process. This includes using eatmydata from wheezy-backports.
17747 (Closes: #9419, #9523)
17748 - release script: adjust to support current Debian sid.
17751 - Test the system clock sanity check we do at boot. (Closes: #9377)
17752 - Remove the impossible "Clock way in the past" scenarios.
17753 Thanks to config/chroot_local-includes/lib/live/config/0001-sane-clock,
17754 these scenarios cannot happen, and since we test that it works they
17755 can be safely removed.
17756 - Test that the hardware clock is not modified at shutdown. (Closes: #9557)
17757 - Pidgin: retry looking for the roadmap URL in the topic.
17758 - Avoid showing Pidgin's tooltips during test, potentially confusing Sikuli.
17760 - Test all OpenPGP keys shipped with Tails. (Closes: #9402)
17761 - Check that notification-daemon is running when looking for notifications
17762 fails. (Closes: #9332)
17763 - Allow using the cucumber formatters however we want. (Closes: #9424)
17764 - Enable Spice in the guest, and blacklist the psmouse kernel module,
17765 to help with lost mouse events. (Closes: #9425)
17766 - Automate testing Torbutton's 'New Identity' feature. (Closes: #9286)
17767 - Test that Seahorse is configured to use the correct keyserver.
17769 - Always export TMPDIR back to the test suite's shell environment.
17771 - Make OpenPGP tests more reliable:
17772 · Retry accessing the OpenPGP applet menus on failure. (Closes: #9355)
17773 · Retry accessing menus in Seahorse on failure. (Closes: #9344)
17774 - Focus the Pidgin conversation window before any attempt to interact
17775 with it. (Closes: #9317)
17776 - Use convertkey from the (backported to Jessie) Debian package,
17777 instead of our own copy of that script. (Closes: #9066)
17778 - Make the memory erasure tests more robust (Closes: #9329):
17779 · Bump /proc/sys/vm/min_free_kbytes when running fillram.
17780 · Actually set oom_adj for the remote shell when running fillram.
17781 · Try to be more sure that we OOM kill fillram.
17782 · Run fillram as non-root.
17783 - Only try to build the storage pool if TailsToasterStorage isn't found.
17786 -- Tails developers <tails@boum.org> Sun, 28 Jun 2015 19:46:25 +0200
17788 tails (1.4) unstable; urgency=medium
17790 * Major new features
17791 - Upgrade Tor Browser to 4.5.1, based on Firefox 31.7.0 ESR, which
17792 introduces many major new features for usability, security and
17793 privacy. Unfortunately its per-tab circuit view did not make it
17794 into Tails yet since it requires exposing more Tor state to the
17795 user running the Tor Browser than we are currently comfortable
17796 with. (Closes: #9031, #9369)
17797 - Upgrade Tor to 0.2.6.7-1~d70.wheezy+1+tails2. Like in the Tor
17798 bundled with the Tor Browser, we patch it so that circuits used
17799 for SOCKSAuth streams have their lifetime increased indefinitely
17800 while in active use. This currently only affects the Tor Browser
17801 in Tails, and should improve the experience on certain web sites
17802 that otherwise would switch language or log you out every ten
17803 minutes or so when Tor switches circuit. (Closes: #7934)
17806 - tor-browser wrapper script: avoid offering avenues to arbitrary
17807 code execution to e.g. an exploited Pidgin. AppArmor Ux rules
17808 don't sanitize $PATH, which can lead to an exploited application
17809 (that's allowed to run this script unconfined, e.g. Pidgin)
17810 having this script run arbitrary code, violating that
17811 application's confinement. Let's prevent that by setting PATH to
17812 a list of directories where only root can write. (Closes: #9370)
17813 - Upgrade Linux to 3.16.7-ckt9-3.
17814 - Upgrade curl to 7.26.0-1+wheezy13.
17815 - Upgrade dpkg to 1.16.16.
17816 - Upgrade gstreamer0.10-plugins-bad to 0.10.23-7.1+deb7u2.
17817 - Upgrade libgd2-xpm to 2.0.36~rc1~dfsg-6.1+deb7u1.
17818 - Upgrade openldap to 2.4.31-2.
17819 - Upgrade LibreOffice to 1:3.5.4+dfsg2-0+deb7u4.
17820 - Upgrade libruby1.9.1 to 1.9.3.194-8.1+deb7u5.
17821 - Upgrade libtasn1-3 to 2.13-2+deb7u2.
17822 - Upgrade libx11 to 2:1.5.0-1+deb7u2.
17823 - Upgrade libxml-libxml-perl to 2.0001+dfsg-1+deb7u1.
17824 - Upgrade libxml2 to 2.8.0+dfsg1-7+wheezy4.
17825 - Upgrade OpenJDK to 7u79-2.5.5-1~deb7u1.
17826 - Upgrade ppp to 2.4.5-5.1+deb7u2.
17829 - Disable security warnings when connecting to POP3 and IMAP ports.
17831 - Make the Windows 8 browser theme compatible with the Unsafe and I2P
17832 browsers. (Closes: #9138)
17833 - Hide Torbutton's "Tor Network Settings..." context menu entry.
17835 - Upgrade the syslinux packages to support booting Tails on
17836 Chromebook C720-2800. (Closes: #9044)
17837 - Enable localization in Tails Upgrader. (Closes: #9190)
17838 - Make sure the system clock isn't before the build date during
17839 early boot. Our live-config hook that imports our signing keys
17840 depend on that the system clock isn't before the date when the
17841 keys where created. (Closes: #9149)
17842 - Set GNOME's OpenPGP keys via desktop.gnome.crypto.pgp to prevent
17843 us from getting GNOME's default keyserver in addition to our
17844 own. (Closes: #9233)
17845 - Prevent Firefox from crashing when Orca is enabled: grant
17846 it access to assistive technologies in its Apparmor
17847 profile. (Closes: #9261)
17848 - Add Jessie APT source. (Closes: #9278)
17849 - Fix set_simple_config_key(). If the key already existed in the
17850 config file before the call, all other lines would be removed
17851 due to the sed option -n and p combo. (Closes: #9122)
17852 - Remove illegal instance of local outside of function definition.
17853 Together with `set -e` that error has prevented this script from
17854 restarting Vidalia, like it should. (Closes: #9328)
17856 * Minor improvements
17857 - Upgrade I2P to 0.9.19-3~deb7u+1.
17858 - Install Tor Browser's bundled Torbutton instead of custom .deb.
17859 As of Torbutton 1.9.1.0 everything we need has been upstreamed.
17860 - Install Tor Browser's bundled Tor Launcher instead of our
17861 in-tree version. With Tor 0.2.6.x our custom patches for the
17862 ClientTransportPlugin hacks are not needed any more. (Closes:
17864 - Don't install msmtp and mutt. (Closes: #8727)
17865 - Install fonts-linuxlibertine for improved Vietnamese support in
17866 LibreOffice. (Closes: #8996)
17867 - Remove obsoletete #i2p-help IRC channel from the Pidgin
17868 configuration (Closes: #9137)
17869 - Add Gedit shortcut to gpgApplet's context menu. Thanks to Ivan
17870 Bliminse for the patch. (Closes: #9069).
17871 - Install printer-driver-gutenprint to support more printer
17872 models. (Closes: #8994).
17873 - Install paperkey for off-line OpenPGP key backup. (Closes: #8957)
17874 - Hide the Tor logo in Tor Launcher. (Closes: #8696)
17875 - Remove useless log() instance in tails-unblock-network. (Closes:
17877 - Install cdrdao: this enables Brasero to burn combined data/audio
17878 CDs and to do byte-to-byte disc copy.
17879 - Hide access to the Add-ons manager in the Unsafe Browser. It's
17880 currently broken (#9307) but we any way do not want users to
17881 install add-ons in the Unsafe Browser. (Closes: #9305)
17882 - Disable warnings on StartTLS for POP3 and IMAP (Will-fix: #9327)
17883 The default value of this option activates warnings on ports
17884 23,109,110,143. This commit disables the warnings for POP3 and
17885 IMAP as these could be equally used in encrypted StartTLS
17886 connections. (Closes: #9327)
17887 - Completely rework how we localize our browser by generating our
17888 branding add-on, and search plugins programatically. This
17889 improves the localization for the ar, es, fa, ko, nl, pl, ru,
17890 tr, vi and zh_CN locales by localizing the Startpage and
17891 Disconnect.me search plugins. Following Tor Browser 4.5's recent
17892 switch, we now use Disconnect.me as the default search
17893 engine. (Closes: #9309)
17894 * Actively set Google as the Unsafe Browser's default search
17898 - Encode in Git which APT suites to include when building Tails.
17900 - Clean up the list of packages we install. (Closes: #6073)
17901 - Run auto/{build,clean,config} under `set -x' for improved
17903 - Zero-pad our ISO images so their size is divisible by 2048.
17904 The data part of an ISO image's sectors is 2048 bytes, which
17905 implies that ISO images should always have a size divisible
17906 by 2048. Some applications, e.g. VirtualBox, use this as a sanity
17907 check, treating ISO images for which this isn't true as garbage.
17908 Our isohybrid post-processing does not ensure this,
17909 however. Also Output ISO size before/after isohybrid'ing and
17910 truncate'ing it. This will help detect if/when truncate is
17911 needed at all, so that we can report back to syslinux
17912 maintainers more useful information. (Closes: #8891)
17913 - Vagrant: raise apt-cacher-ng's ExTreshold preference to 50. The
17914 goal here is to avoid Tor Browser tarballs being deleted by
17915 apt-cacher-ng's daily expiration cronjob: they're not listed in
17916 any APT repo's index file, so acng will be quite eager to clean
17920 - Bring dependency checks up-to-date (Closes: #8988).
17921 - Adapt test suite to be run on Debian Jessie, which includes
17922 removing various Wheezy-specific workarounds, adding a few
17923 specific to Jessie, migrating from ffmpeg to libav, and
17924 more. (Closes: #8165)
17925 - Test that MAT can see that a PDF is dirty (Closes: #9136).
17926 - Allow throwing Timeout::Error in try_for() blocks, as well as
17927 nested try_for() (Closes: #9189, #9290).
17928 - Read test suite configuration files from the features/config/local.d
17929 directory. (Closes: #9220)
17930 - Kill virt-viewer with SIGTERM, not SIGINT, to prevent hordes of
17931 zombie processes from appearing. (Closes: #9139)
17932 - Kill Xvfb with SIGTERM, not SIGKILL, on test suite exit to allow
17933 it to properly clean up. (Closes: #8707)
17934 - Split SSH & SFTP configs in the test suite. (Closes: #9257)
17935 - Improve how we start subprocesses in the test suite, mostly by
17936 bypassing the shell for greater security and robustness (Closes:
17938 - Add Electrum test feature. (Closes #8963)
17939 - Test that Tails Installer detects when USB devices are
17940 removed. (Closes: #9131)
17941 - Test Tails Installer with devices which are too small. (Closes:
17943 - Test that the Report an Error launcher works in German. (Closes:
17945 - Verify that no extensions are installed in the Unsafe Browser
17946 using about:support instead of about:addons, which is broken
17947 (#9307). (Closes: #9306)
17948 - Retry GNOME application menu actions when they glitch. The
17949 GNOME application menus seem to have issues with clicks or
17950 hovering actions not registering, and hence sometimes submenus
17951 are not opened when they should, and sometimes clicks on the
17952 final application shortcut are lost. There seems to be a
17953 correlation between this and CPU load on the host running the
17954 test suite. We workaround this by simply re-trying the last
17955 action when it seems to fail. (Closes: #8928)
17956 - Work around Seahorse GUI glitchiness (Closes: #9343):
17957 * When Seahorse appears to be frozen--apparently due to network
17958 issues--it can often be worked around by refreshing the screen
17959 or activating a new window.
17960 * Open Seahorse's preferences dialog using the mouse.
17961 * Access menu entries with the mouse.
17962 - Wait for systray icons to finish loading before interacting with
17963 the systray. (Closes: #9258)
17964 - Test suite configuration: generalize local.d support to *.d. We
17965 now load features/config/*.d/*.yml.
17966 - Use code blocks in "After Scenario" hooks. This is much simpler
17967 to use (and more readable!) compared to hooking functions and
17968 arguments like we used to do.
17969 - Create filesystem share sources in the temporary directory and
17970 make them world-readable. (Closes: #8950)
17972 -- Tails developers <tails@boum.org> Mon, 11 May 2015 16:45:04 +0200
17974 tails (1.3.2) unstable; urgency=medium
17977 - Upgrade Tor Browser to 4.0.6, based on Firefox 31.6.0 ESR.
17978 - Upgrade OpenSSL to 1.0.1e-2+deb7u16.
17981 - Make Florence usable with touchpads by forcing syndaemon to
17982 always use the `-t` option, which only disables tapping and
17983 scrolling and not mouse movements (Closes: #9011).
17984 - Make tails-spoof-mac log the correct macchanger exit code on
17985 failure (Closes: #8687).
17987 · Ignore devices with less than 3.5 GB of storage since they
17988 do not fit a Tails installation (Closes: #6538).
17989 · Remove devices from the device list as they are unplugged
17992 * Minor improvements
17993 - Install obfs4proxy 0.0.4-1~tpo1, which adds support for
17994 client-mode ScrambleSuit.
17995 - Don't start Vidalia if Windows Camouflage is enabled. (Closes:
17998 · Remove "Add-ons" from the Tools menu, and hide "Keyboard
17999 Shortcuts" and "Take a Tour" since they point to resources on
18000 the open Internet (Closes: #7970).
18001 · Hide TorButton button from the customize toolbar options, and
18002 remove configs whose only purpose was to make Torbutton "green"
18007 · Test non-LAN SSH, and SFTP via GNOME's "Connect to Server"
18009 · Verify that Tails' Tor binary has the expected Tor authorities
18010 hard coded (Closes: #8960).
18012 · Programmatically determine the supported languages when testing
18013 the Unsafe Browser (Closes: #8918).
18014 · Rename --temp-dir to --tmpdir and make it behave more like
18015 mktemp, and honour TMPDIR if set in the environment. (Closes:
18018 · Make --temp-dir (now --tmpdir) actually work.
18020 -- Tails developers <tails@boum.org> Mon, 30 Mar 2015 16:54:20 +0200
18022 tails (1.3.1) unstable; urgency=medium
18025 - Upgrade Tor Browser to 4.0.5, based on Firefox 31.5.3 ESR. This addresses:
18026 · https://www.mozilla.org/en-US/security/advisories/mfsa2015-28/
18027 · https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/
18028 - Upgrade Linux to 3.16.7-ckt7-1.
18029 - Upgrade libxfont to 1:1.4.5-5.
18030 - Upgrade OpenSSL to 1.0.1e-2+deb7u15.
18031 - Upgrade tcpdump to 4.3.0-1+deb7u2.
18032 - Upgrade bsdtar to 3.0.4-3+wheezy1.
18033 - Upgrade CUPS to 1.5.3-5+deb7u5.
18034 - Upgrade file and libmagic to 5.11-2+deb7u8.
18035 - Upgrade GnuPG to 1.4.12-7+deb7u7.
18036 - Upgrade libarchive to 3.0.4-3+wheezy1.
18037 - Upgrade libav to 6:0.8.17-1.
18038 - Upgrade FreeType 2 to 2.4.9-1.1+deb7u1.
18039 - Upgrade libgcrypt11 1.5.0-5+deb7u3.
18040 - Upgrade libgnutls26 to 2.12.20-8+deb7u3.
18041 - Upgrade libgtk2-perl to 2:1.244-1+deb7u1.
18042 - Upgrade ICU to 4.8.1.1-12+deb7u2.
18043 - Upgrade NSS to 2:3.14.5-1+deb7u4.
18044 - Upgrade libssh2 to 1.4.2-1.1+deb7u1.
18047 - Upgrade Tor to 0.2.5.11-1~d70.wheezy+1+tails1. Changes include:
18048 · Directory authority changes.
18049 · Fix assertion errors that may trigger under high DNS load.
18050 · No longer break on HUP with seccomp2 enabled.
18051 · and more - please consult the upstream changelog.
18052 - Upgrade Tor Launcher to 0.2.7.2, and update the test suite accordingly
18053 (Closes: #8964, #6985). Changes include:
18054 · Ask about bridges before proxy in wizard.
18055 · Hide logo if TOR_HIDE_BROWSER_LOGO set.
18056 · Remove firewall prompt from wizard.
18057 · Feedback when “Copy Tor Log” is clicked.
18058 · Improve behavior if tor exits.
18059 · Add option to hide TBB's logo
18060 · Change "Tor Browser Bundle" to "Tor Browser"
18061 · Update translations from Transifex.
18062 - Fix the Tor Launcher killer. (Closes: #9067)
18063 - Allow Seahorse to communicate with keyservers when run from Tails
18064 OpenPGP Applet. (Closes: #6394)
18065 - SSH client: don't proxy connections to 172.17.* to 172.31.*.
18067 - Repair config/chroot_local-packages feature, that was broken in Tails 1.3
18068 by 19-install-tor-browser-AppArmor-profile. (Closes: #8910)
18069 - language_statistics.sh: count original words instead of translated words.
18070 Otherwise we get >100% translation if translated strings are longer than
18071 original strings. (Closes: #9016)
18073 * Minor improvements
18074 - Only ship the new Tails signing key, and have Tails Upgrader stop trusting
18075 the old one. Update the documentation and test suite accordingly.
18076 (Closes: #8735, #8736, #8882, #8769, #8951)
18077 - Polish and harden a bit the WhisperBack configuration (Closes: #8991):
18078 · Only allow the `amnesia' user to run tails-debugging info as root
18080 · Fix spelling and grammar mistakes, improve phrasing a bit.
18081 · Quote variables consistently.
18085 · Chatting over XMPP in Pidgin, both peer-to-peer and in a multi-user
18086 chatroom. (Closes: #8002)
18087 · Chatting with OTR enabled over XMPP in Pidgin. (Closes: #8001)
18088 · Check that Pidgin only responds to the expected CTCP requests.
18090 · Fetching keys using Seahorse started via the OpenPGP Applet.
18091 · Sync'ing keys using Seahorse.
18093 · Fix a race condition between the remote shell's and Tails Greeter's
18094 startup, by making sure the remote shell is ready before we start
18095 GDM. (Closes: #8941)
18096 · Kill virt-viewer properly. (Closes: #9070)
18097 · Make sure the display is stopped on destroy_and_undefine().
18098 Where we had it earlier, it could be skipped if anything else in the
18099 block threw an exception.
18100 · Fix wrong use of "$@". (Closes: #9071)
18101 · Enable the pipefail option in run_test_suite.
18102 · Improve the GNOME screenshot test's robustness. (Closes: #8952)
18104 · turn the focus_pidgin_window() helper into a more generic
18105 VM.focus_xorg_window() one.
18106 · Reorganize the Display class.
18107 · Use clearer method to check process status in the Display class.
18108 - New developer-oriented features:
18109 · Add a --log-to-file option to run_test_suite. (Closes: #8894)
18110 · Add helpers for generating random strings.
18111 · Make it possible to hook arbitrary calls on scenario end. This is useful
18112 for dynamically adding cleanup functions, instead of having
18113 to explicitly deal with them in some After hook.
18115 -- Tails developers <tails@boum.org> Mon, 23 Mar 2015 12:34:56 +0000
18117 tails (1.3) unstable; urgency=medium
18119 * Major new features
18120 - Produce the Tails image in hybrid mode (again) so that the same
18121 image can be installed both on DVD *and* "hard disks" like USB
18122 storage and similar. (Closes: #8510)
18123 - Confine the Tor Browser using AppArmor. (Closes: #5525)
18124 - Install the Electrum bitcoin client from wheezy-backports, and
18125 add a persistence preset for the Live user's bitcoin wallet. If
18126 electrum is started without the persistence preset enabled, a
18127 warning is shown. (Closes: #6739)
18130 - Upgrade Tor Browser to 4.0.4 (based on Firefox 31.5.0esr)
18134 - Have tor_bootstrap_progress echo 0 if no matching log line is
18135 found. (Closes: #8257)
18136 - Always pass arguments through wrappers (connect-socks, totem,
18137 wget, whois) with "$@". $* doesn't handle arguments with
18138 e.g. embedded spaces correctly. (Closes: #8603, #8830)
18139 - Upgrade Linux to 3.16.7-ckt4-3.
18141 * Minor improvements
18142 - Install a custom-built Tor package with Seccomp enabled;
18143 enable the Seccomp sandbox when no pluggable transport is used.
18145 - Install obfs4proxy instead of obfsproxy, which adds support for
18146 the obfs4 Tor pluggable transport. (Closes: #7980)
18147 - Install GnuPG v2 and associated tools from wheezy-backports,
18148 primarily for its improved support for OpenPGP smartcards. It
18149 lives side-by-side with GnuPG v1, which still is the
18150 default. (Closes: #6241)
18151 - Install ibus-unikey, a Vietnamese input method for IBus. (Closes:
18153 - Install torsocks (2.x) from wheezy-backports. (Closes: #8220)
18154 - Install keyringer from Debian Jessie. (Closes: #7752)
18155 - Install pulseaudio-utils.
18156 - Remove all traces of Polipo: we don't use it anymore. This
18157 closes #5379 and #6115 because:
18158 * Have APT directly use the Tor SOCKS proxy. (Closes: #8194)
18159 * Wrap wget with torsocks. (Closes: #6623)
18160 * Wrap Totem to torify it with torsocks. (Closes: #8219)
18161 * Torify Git with tsocks, instead of setting GIT_PROXY_COMMAND.
18163 - Use torsocks for whois and Gobby, instead of torify.
18164 - Upgrade I2P to 0.9.18-1~deb7u+1.
18165 - Refactor the Unsafe and I2P browser code into a common shell
18166 library. A lot of duplicated code is now shared, and the code
18167 has been cleaned up and made more reliable. Several
18168 optimizations of memory usage and startup time were also
18169 implemented. (Closes: #7951)
18170 - Invert Exit and About in gpgApplet context menu. This is a
18171 short-term workaround for making it harder to exit the
18172 application by mistake (e.g. a double right-click). (Closes:
18174 - Implement new touchpad settings. This enables tap-to-click,
18175 2-fingers scrolling, and disable while typing. We don't enable
18176 reverse scrolling nor horizontal scrolling. (Closes: #7779)
18177 - Include the mount(8) output and live-additional-software.conf in
18178 WhisperBack bug reports (Closes: #8719, #8491).
18179 - Reduce brightness and saturation of background color. (Closes:
18181 - Have ALSA output sound via PulseAudio by default. This gives us
18182 centralized sound volume controls, and... allows to easily, and
18183 automatically, test that audio output works from Tor Browser,
18184 thanks to the PulseAudio integration into the GNOME sound
18186 - Import the new Tails signing key, which we will use for Tails
18187 1.3.1, and have Tails Upgrader trust both it and the "old"
18188 (current) Tails signing key. (Closes: #8732)
18189 - tails-security-check: error out when passed an invalid CA file.
18190 Unfortunately, the underlying HTTPS stack we use here fails open
18191 in those case, so we have to check it ourselves. Currently, we
18192 check that the file exists, is readable, is a plain file and is
18193 not empty. Also support specifying the CA file via an
18194 environment variable. This will ease development and bug-fixing
18196 - Fix racy code in Tails Installer that sometimes made the
18197 automated test suite stall for scenarios installing Tails
18198 to USB disks. (Closes: #6092)
18199 - Make it possible to use Tails Upgrader to upgrade a Tails
18200 installation that has cruft files on the system partition.
18204 - Install syslinux-utils from our builder-wheezy APT repository in
18205 Vagrant. We need version 6.03~pre20 to make the Tails ISO image
18207 - Update deb.tails.boum.org apt repo signing key. (Closes: #8747)
18208 - Revert "Workaround build failure in lb_source, after creating
18209 the ISO." This is not needed anymore given the move to the Tor
18210 SOCKS proxy. (Closes: #5307)
18211 - Remove the bootstrap stage usage option and disable all
18212 live-build caching in Vagrant. It introduces complexity and
18213 potential for strange build inconsistencies for a meager
18214 reduction in build time. (Closes: #8725)
18215 - Hardcode the mirrors used at build and boot time in auto/config.
18216 Our stuff will be more consistent, easier to reproduce, and our
18217 QA process will be more reliable if we all use the same mirrors
18218 at build time as the ones we configure in the ISO. E.g. we won't
18219 have issues such as #8715 again. (Closes: #8726)
18220 - Don't attempt to retrieve source packages from local-packages so
18221 local packages can be installed via
18222 config/chroot_local-packages. (Closes: #8756)
18223 - Use our own Tor Browser archive when building an ISO. (Closes:
18227 - Use libguestfs instead of parted when creating partitions and
18228 filsystems, and to check that only the expected files
18229 persist. We also switch to qcow2 as the default disk image
18230 format everywhere to reduce disk usage, enable us to use
18231 snapshots that includes the disks (in the future), and to use
18232 the same steps for creating disks in all tests. (Closes: #8673)
18233 - Automatically test that Tails ignores persistence volumes stored
18234 on non-removable media, and doesn't enable swaps. (Closes:
18236 - Actually make sure that Tails can boot from live systems stored
18237 on a hard drive. Running the 'I start Tails from DVD ...' step
18238 will override the earlier 'the computer is set to boot from ide
18239 drive "live_hd"' step, so let's make the "from DVD" part
18240 optional; it will be the default any way.
18241 - Make it possible to use an old iso with different persistence
18242 presets. (Closes: #8091)
18243 - Hide the cursor between steps when navigating the GNOME
18244 applications menu. This makes it a bit more robust, again:
18245 sometimes the cursor is partially hiding the menu entry we're
18246 looking for, hence preventing Sikuli from finding it (in
18247 particular when it's "Accessories", since we've just clicked on
18248 "Applications" which is nearby). (Closes: #8875)
18249 - Ensure that the test will fail if "apt-get X" commands fail.
18250 - Test 'Tor is ready' notification in a separate scenario. (Closes:
18252 - Add automated tests for torified wget and whois. This should
18253 help us identify future regressions such as #8603 in their
18254 torifying wrappers.
18255 - Add automated test for opening an URL from Pidgin.
18256 - And add automated tests for the Tor Browser's AppArmor
18258 - Test that "Report an Error Launcher" opens the support
18260 - Test that the Unsafe Browser:
18261 * starts in various locales.
18262 * complains when DNS isn't configured.
18263 * tears down its chroot on shutdown.
18264 * runs as the correct user.
18265 * has no plugins or add-ons installed.
18266 * has no unexpected bookmarks.
18267 * has no proxy configured.
18268 - Bump the "I2P router console is ready" timeout in its test to
18269 deal with slow Internet connections.
18270 - Make the automatic tests of gpgApplet more robust by relying
18271 more on graphical elements instead of keyboard shortcuts and
18272 static sleep():s. (Closes: #5632)
18273 - Make sure that enough disk space is available when creating
18274 virtual storage media. (Closes: #8907)
18275 - Test that the Unsafe Browser doesn't generate any non-user
18276 initiated traffic, and in particular that it doesn't check for
18277 upgrades, which is a regression test for #8694. (Closes: #8702)
18278 - Various robustness improvements to the Synaptic tests. (Closes:
18280 - Automatically test Git. (Closes: #6307)
18281 - Automatically test GNOME Screenshot, which is a regression test
18282 for #8087. (Closes: #8688)
18283 - Fix a quoting issue with `tails_persistence_enabled?`. (Closes:
18285 - Introduce an improved configuration system that also can store
18286 local secrets, like user credentials needed for some
18287 tests. (Closes: #6301, #8188)
18288 - Actually verify that we successfully set the time in our time
18289 syncing tests. (Closes: #5836)
18290 - Automatically test Tor. This includes normal functionality and
18291 the use pluggable transports, that our Tor enforcement is
18292 effective (e.g. only the Tor network or configured bridges are
18293 contacted) and that our stream isolation configuration is
18294 working. (Closes: #5644, #6305, #7821)
18296 -- Tails developers <tails@boum.org> Mon, 23 Feb 2015 17:14:00 +0100
18298 tails (1.2.3) unstable; urgency=medium
18301 - Upgrade Linux to 3.16.7-ckt2-1.
18302 - Upgrade Tor Browser to 4.0.3 (based on Firefox 31.4.0esr)
18304 - Fail safe by entering panic mode if macchanger exits with an
18305 error, since in this situation we have to treat the
18306 driver/device state as undefined. Also, we previously just
18307 exited the script in this case, not triggering the panic mode
18308 and potentially leaking the real MAC address (Closes: #8571).
18309 - Disable upgrade checking in the Unsafe Browser. Until now the
18310 Unsafe Browser has checked for upgrades of the Tor Browser in
18311 the clear (Closes: #8694).
18314 - Fix startup of the Unsafe Browser in some locales (Closes: #8693).
18315 - Wait for notification-daemon to run before showing the MAC
18316 spoofing panic mode notifications. Without this, the "Network
18317 card disabled" notification is sometimes lost when MAC spoofing
18318 fails. Unfortunately this only improves the situation, but
18319 doesn't fix it completely (see #8685).
18320 - Log that we're going to stop NetworkManager before trying to do
18321 it in the MAC spoofing scripts. Without this we wouldn't get the
18322 log message in case stopping NetworkManager fails (thanks to
18324 - Set GNOME Screenshot preferences to save the screenshots in
18325 /home/amnesia (Closes: #8087).
18326 - Do not suspend to RAM when closing the lid on battery power
18328 - Properly update the Tails Installer's status when plugging in a
18329 USB drive after it has started (Closes: #8353).
18330 - Make rsync compare file contents by using --checksum for more
18331 reliable generation of the squashfs filesystem in
18332 IUKs. Previously it used the default, which is checking
18333 timestamps and file size, but that doesn't play well with the
18334 Tor browser files, that have a fixed mtime, which could result
18335 in updated files not ending up in the IUK.
18337 * Minor improvements
18338 - Finish migrating tails-security-check's and tails-iuk's pinning
18339 to our website's new X.509 certificate authority (Closes: #8404).
18342 - Update to Vagrant build box tails-builder-20141201. The only
18343 change is the removal of a reference to an ISO image which
18344 doesn't exist (except on the system that generated the build
18345 box) which causes an error for some users (Closes: #7644).
18346 - Generate the list of packages used during build, after building
18347 with Jenkins (Closes: #8518). This allows tracking their status
18348 on the Debian reproducible build front:
18349 https://reproducible.debian.net/index_pkg_sets.html#tails
18351 * Automated test suite
18352 - Check PO files with i18nspector (Closes: #8359).
18353 - Fix the expected image of a check.tp.o failure. Previously we
18354 looked for the "Sorry. You are not using Tor." text, but it
18355 seems it recently changed enough for Sikuli to not find it. To
18356 prevent future errors of the same kind we'll look for the
18357 crossed-over onion icon instead (Closes: #8533).
18358 - Bump timeout when waiting for Tor to re-bootstrap. We have a
18359 dreaded issue with timeouts that are multiple of 2 minutes, and
18360 then Tor succeeds soon after, so in order to allow for this
18361 timeout to be reached twice, and then possibly succeed, let's
18362 use N*2 minutes + 30 seconds, with N=2.
18364 -- Tails developers <tails@boum.org> Wed, 14 Jan 2015 16:12:26 +0100
18366 tails (1.2.2) unstable; urgency=medium
18369 - Create a CA bundle for Tails Upgrader at ISO build time, and
18370 patch Tails Upgrader to use it. Specifically this will make it
18371 possible to check for Tails upgrades after our website changes
18372 certificate around the 2014 to 2015 transition (Partially fixes
18375 -- Tails developers <tails@boum.org> Mon, 15 Dec 2014 10:05:17 +0100
18377 tails (1.2.1) unstable; urgency=low
18380 - Upgrade Linux to 3.16.0-4, i.e. 3.16.7-1.
18381 - Install Tor Browser 4.0.2 (based on Firefox 31.3.0esr).
18384 - Install syslinux-utils, to get isohybrid back (Closes: #8155).
18385 - Update xserver-xorg-input-evdev to 1:2.7.0-1+tails1 which
18386 includes a patch that restores mouse scrolling in KVM/Spice
18388 - Set Torbutton logging preferences to the defaults (Closes:
18389 #8160). With the default settings, no site-specific information is
18391 - Use the correct stack of rootfs:s for the chroot browsers (Closes:
18392 #8152, #8158). After installing incremental upgrades Tails' root
18393 filesystem consists of a stack squashfs:s, not only
18394 filesystem.squashfs. When not stacking them correct we may end up
18395 using the Tor Browser (Firefox) from an older version of Tails, or
18396 with no Tor Browser at all, as in the upgrade from Tails 1.1.2 to
18397 1.2, when we migrated from Iceweasel to the Tor Browser. Based on
18398 a patch contributed by sanic.
18399 - Use the Tor Browser for MIME type that GNOME associates with
18400 Iceweasel (Closes: #8153). Open URLs from Claws Mail, KeePassX
18401 etc. should be possible again.
18402 - Update patch to include all Intel CPU microcodes (Closes: #8189).
18403 - AppArmor: allow Pidgin to run Tor Browser unconfined, with
18404 scrubbed environment (Closes: #8186). Links opened in Pidgin are
18405 now handled by the Tor Browser.
18406 - Install all localized Iceweasel search plugins (Closes: #8139).
18407 - When generating the boot profile, ignore directories in
18408 process_IN_ACCESS as well (Closes: #7925). This allows ut to
18409 update the squashfs-ordering again in Tails 1.2.1.
18410 - gpgApplet: Don't pass already encoded data to GTK2 (Closes:
18411 #7968). It's now possible to clearsign text including non-ASCII
18413 - Do not run the PulseAudio initscript, neither at startup nor
18414 shutdown (Closes: #8082).
18416 * Minor improvements
18417 - Upgrade I2P to 0.9.17-1~deb7u+1.
18418 - Make GnuPG configuration closer to the best practices one
18420 - Have GnuPG directly use the Tor SOCKS port (Closes: #7416).
18421 - Remove TrueCrypt support and documentat how to open TrueCrypt
18422 volumes using cryptsetup (Closes: #5373).
18423 - Install hopenpgp-tools from Debian Jessie.
18426 - Add gettext >= 0.18.3 as a Tails build dependency. We need it for
18427 xgettext JavaScript support in feature/jessie.
18429 * Automated test suite
18430 - Don't click to open a sub-menu in the GNOME applications menu
18432 - When testing the Windows camouflage, look for individual systray
18433 applets, to avoid relying on their ordering (Closes: #8059).
18434 - Focus the Pidgin Buddy List before looking for something
18435 happening in it (Closes: #8161).
18436 - Remove workaround for showing the TBB's menu bar (Closes #8028).
18438 -- Tails developers <tails@boum.org> Tue, 02 Dec 2014 11:34:03 +0100
18440 tails (1.2) unstable; urgency=medium
18442 * Major new features
18443 - Migrate from Iceweasel to the Tor Browser from the Tor Browser
18444 Bundle 4.0 (based on Firefox 31.2.0esr). This fixes the POODLE
18446 The installation in Tails is made global (multi-profile), uses
18447 the system-wide Tor instance, disables the Tor Browser updater,
18448 and keeps the desired deviations previously present in Iceweasel,
18449 e.g. we install the AdBlock Plus add-on, but not Tor Launcher (since
18450 we run it as a standalone XUL application), among other things.
18451 - Install AppArmor's userspace tools and apparmor-profiles-extra
18452 from Wheezy Backports, and enable the AppArmor Linux Security
18453 Module. This adds Mandatory Access Control for several critical
18454 applications in Tails, including Tor, Vidalia, Pidgin, Evince
18456 - Isolate I2P traffic from the Tor Browser by adding a dedicated
18457 I2P Browser. It is set up similarly to the Unsafe Browser,
18458 but further disables features that are irrelevant for I2P, like
18459 search plugins and the AdBlock Plus addon, while keeping Tor Browser
18460 security features like the NoScript and Torbutton addons.
18461 - Upgrade Tor to 0.2.5.8-rc-1~d70.wheezy+1.
18464 - Disable TCP timestamps (Closes: #6579).
18467 - Remove expired Pidgin certificates (Closes: #7730).
18468 - Use sudo instead of gksudo for running tails-upgrade-frontend to
18469 make stderr more easily accessible (Closes: #7431).
18470 - Run tails-persistence-setup with sudo instead of gksudo to make
18471 stderr more easily accessible, and allow the desktop user to
18472 pass the --verbose parameter (Closes: #7623).
18473 - Disable CUPS in the Unsafe Browser. This will prevent the
18474 browser from hanging for several minutes when accidentally
18475 pressing CTRL+P or trying to go to File -> Print (Closes: #7771).
18477 * Minor improvements
18478 - Install Linux 3.16-3 (version 3.16.5-1) from Debian
18479 unstable (Closes: #7886, #8100).
18480 - Transition away from TrueCrypt: install cryptsetup and friends
18481 from wheezy-backports (Closes: #5932), and make it clear that
18482 TrueCrypt will be removed in Tails 1.2.1 (Closes: #7739).
18483 - Install Monkeysign dependencies for qrcodes scanning.
18484 - Upgrade syslinux to 3:6.03~pre20+dfsg-2~bpo70+1, and install
18485 the new syslinux-efi package.
18486 - Upgrade I2P to 0.9.15-1~deb7u+1
18487 - Enable Wheezy proposed-updates APT repository and setup APT
18488 pinnings to install packages from it.
18489 - Enable Tor's syscall sandbox. This feature (new in 0.2.5.x)
18490 should make Tor a bit harder to exploit. It is only be enabled
18491 when when no special Tor configuration is requested in Tails
18492 Greeter due to incompatibility with pluggable transports.
18493 - Start I2P automatically when the network connects via a
18494 NetworkManager hook, and "i2p" is present on the kernel command
18495 line. The router console is no longer opened automatically, but
18496 can be accessed through the I2P Browser (Closes: #7732).
18497 - Simplify the IPv6 ferm rules (Closes: #7668).
18498 - Include persistence.conf in WhisperBack reports (Closes: #7461)
18499 - Pin packages from testing to 500, so that they can be upgraded.
18500 - Don't set Torbutton environment vars globally (Closes: #5648).
18501 - Enable VirtualBox guest additions by default (Closes: #5730). In
18502 particular this enables VirtualBox's display management service.
18503 - In the Unsafe Browser, hide option for "Tor Browser Health
18504 report", and the "Get Addons" section in the Addon manager
18506 - Show Pidgin's formatting toolbar (Closes: #7356). Having the
18507 formatting toolbar displayed in Pidgin makes the OTR status more
18508 explicit by displaying it with words.
18510 * Automated test suite
18511 - Add --pause-on-fail to ease VM state debugging when tests
18513 - Add execute_successfully() and assert_vmcommand_success() for
18514 added robustness when executing some command in the testing VM.
18515 - Use Test::Unit::Assertions instead of our home-made assert().
18516 - Add test for persistent browser bookmarks.
18517 - Add basic tests for Pidgin, Totem and Evince, including their
18518 AppArmor enforcement.
18519 - Factorize some common step pattern into single steps.
18520 - Factorize running a command in GNOME Terminal.
18521 - Add common steps to copy a file and test for its existence.
18522 - Add a wait_and_double_click Sikuli helper method.
18523 - Add a VM.file_content method, to avoid repeating ourselves, and
18524 use it whenever easily doable.
18525 - Drop test that diffs syslinux' exithelp.cfg: we don't ship this
18527 - In the Unsafe Browser tests, rely on subtle timing less (Closes:
18529 - Use the same logic to determine when Tor is working in the test
18530 suite as in Tails itself. The idea is to avoid spamming the Tor
18531 control port during bootstrap, since we've seen problems with
18534 -- Tails developers <tails@boum.org> Wed, 15 Oct 2014 18:34:50 +0200
18536 tails (1.1.2) unstable; urgency=medium
18539 - Upgrade the web browser to 24.8.0esr-0+tails3~bpo70+1
18540 (fixes Mozilla#1064636).
18541 - Install Linux 3.16-1 from sid (Closes: #7886).
18542 - Upgrade file to 5.11-2+deb7u5 (fixes CVE-2014-0207,
18543 CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479,
18544 CVE-2014-3480, CVE-2014-3487, CVE-2014-3538 and CVE-2014-3587).
18545 - Upgrade curl to 7.26.0-1+wheezy10 (fixes CVE-2014-3613 and
18547 - Upgrade bind9-based packages to 1:9.8.4.dfsg.P1-6+nmu2+deb7u2
18548 (fixes CVE-2014-0591).
18549 - Upgrade gnupg to 1.4.12-7+deb7u6 (fixes CVE-2014-5270).
18550 - Upgrade apt to 0.9.7.9+deb7u5 (fixes CVE-2014-0487,
18551 CVE-2014-0488, CVE-2014-0489, CVE-2014-0490, and
18553 - Upgrade dbus to 1.6.8-1+deb7u4 (fixes CVE-2014-3635,
18554 CVE-2014-3636, CVE-2014-3637, CVE-2014-3638 and CVE-2014-3639).
18555 - Upgrade libav-based pacakges to 6:0.8.16-1 (fixes
18557 - Upgrade bash to 4.2+dfsg-0.1+deb7u1 (fixes CVE-2014-6271).
18559 -- Tails developers <tails@boum.org> Tue, 23 Sep 2014 23:01:40 -0700
18561 tails (1.1.1) unstable; urgency=medium
18564 - Upgrade the web browser to 24.8.0esr-0+tails1~bpo70+1
18565 (Firefox 24.8.0esr + Iceweasel patches + Torbrowser patches).
18566 Also import the Tor Browser profile at commit
18567 271b64b889e5c549196c3ee91c888de88148560f from
18568 ttp/tor-browser-24.8.0esr-3.x-1.
18569 - Upgrade Tor to 0.2.4.23-2~d70.wheezy+1 (fixes CVE-2014-5117).
18570 - Upgrade I2P to 0.9.14.1-1~deb7u+1.
18571 - Upgrade Linux to 3.14.15-2 (fixes CVE-2014-3534, CVE-2014-4667
18572 and CVE-2014-4943).
18573 - Upgrade CUPS-based packages to 1.5.3-5+deb7u4 (fixes
18574 CVE-2014-3537, CVE-2014-5029, CVE-2014-5030 and CVE-2014-5031).
18575 - Upgrade libnss3 to 2:3.14.5-1+deb7u1 (fixes CVE-2013-1741,
18576 CVE-2013-5606, CVE-2014-1491 and CVE-2014-1492).
18577 - Upgrade openssl to 1.0.1e-2+deb7u12 (fixes CVE-2014-3505,
18578 CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509,
18579 CVE-2014-3510, CVE-2014-3511, CVE-2014-3512 and CVE-2014-5139).
18580 - Upgrade krb5-based packages to 1.10.1+dfsg-5+deb7u2 (fixes
18581 CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344 and
18583 - Upgrade libav-based packages to 6:0.8.15-1 (fixes CVE-2011-3934,
18584 CVE-2011-3935, CVE-2011-3946, CVE-2013-0848, CVE-2013-0851,
18585 CVE-2013-0852, CVE-2013-0860, CVE-2013-0868, CVE-2013-3672,
18586 CVE-2013-3674 and CVE-2014-2263.
18587 - Upgrade libgpgme11 to 1.2.0-1.4+deb7u1 (fixes CVE-2014-5117).
18588 - Upgrade python-imaging to 1.1.7-4+deb7u1 (fixes CVE-2014-3589).
18589 - Prevent dhclient from sending the hostname over the network
18591 - Override the hostname provided by the DHCP server (Closes: #7769).
18592 - Add an I2P boot parameter. Without adding "i2p" to the kernel
18593 command line, I2P will not be accessible for the Live user.
18594 - Stricter I2P firewall rules:
18595 * deny I2P from accessing the LAN
18596 * deny I2P from accessing the loopback device, except for select
18597 whitelisted services
18598 * allow I2P access to the Internet
18599 The ACCEPT rules will only be enabled when the string 'i2p' is
18600 passed at the boot prompt. The rules which DENY or REJECT
18601 access for the 'i2psvc' user will always be applied.
18602 - Disable I2P plugins, since it doesn't make much sense without
18603 persistence, and should eliminate some attack vectors.
18604 - Disable I2P's BOB port. No maintained I2P application uses it.
18607 - Fix condition clause in tails-security-check (Closes: #7657).
18608 - Don't ship OpenJDK 6: I2P prefers v7, and we don't need both.
18609 - Prevent Tails Installer from updating the system partition
18610 properties on MBR partitions (Closes: #7716).
18612 * Minor improvements
18613 - Upgrade to Torbutton 1.6.12.1.
18614 - Install gnome-user-guide (Closes: #7618).
18615 - Install cups-pk-helper (Closes: #7636).
18616 - Update the SquashFS sort file.
18617 - Compress the SquashFS more aggressively (Closes: #7706).
18618 - I2P: Keep POP3 email on server. The default in the I2P webmail
18619 app was to keep mail on the server, but that setting was changed
18620 recently. This configuration setting (susimail.config) will only
18621 be copied over in I2P 0.9.14 and newer.
18622 - Add a Close button to the Tails Installer launcher window.
18625 - Migrate Vagrant basebox to Debian Wheezy (Closes #7133, #6736).
18626 - Consistently use the same Debian mirror.
18627 - Disable runtime APT proxy configuration when using APT in
18628 binary_local-hooks (Closes: #7691).
18630 * Automated test suite
18631 - Automatically test hostname leaks (Closes: #7712).
18632 - Move autotest live-config hook to be run last. This way we'll
18633 notice if some earlier live-config hook cancels all hooks by
18634 running the automated test suite since the remote shell won't be
18635 running in that case.
18636 - Test that the I2P boot parameter does what it's supposed to do
18638 - Start applications by using the GNOME Applications menu instead
18639 of the GNOME Run Dialog (Closes: #5550, #7060).
18641 -- Tails developers <tails@boum.org> Sun, 31 Aug 2014 20:49:28 +0000
18643 tails (1.1) unstable; urgency=medium
18645 * Rebase on Debian Wheezy
18646 - Upgrade literally thousands of packages.
18647 - Migrate to GNOME3 fallback mode.
18648 - Install LibreOffice instead of OpenOffice.
18649 - Remove custom LSB logging: Wheezy has fancy colored init
18652 * Major new features
18653 - UEFI boot support.
18654 - Replace the Windows XP camouflage with an experimental Windows 8
18656 - Install Linux 3.14.12-1 from Debian unstable.
18657 - Bring back VirtualBox guest modules, installed from Wheezy
18658 backports. Full functionality is only available when using the
18662 - Fix write access to boot medium via udisks (#6172).
18663 - Don't allow the desktop user to pass arguments to
18664 tails-upgrade-frontend (Closes: #7410).
18665 - Make persistent file permissions safer (Closes #7443):
18666 * Make the content of /etc/skel non-world-readable. Otherwise,
18667 such files may be copied to /home/amnesia, and in turn to the
18668 persistent volume, with unsafe permissions. That's no big deal
18669 in /home/amnesia (that is itself not world-readable), *but*
18670 the root of the persistent volume has to be world-readable.
18671 * Have activate_custom_mounts create new directories with safe
18673 * Set strict permissions on /home/amnesia (Closes: #7463).
18674 * Fix permissions on persistent directories that were created
18675 with unsafe permissions (Closes: #7458).
18676 * Fix files ownership while copying persistence (Closes: #7216).
18677 The previous instructions to copy the persistent data were
18678 creating personal files that belong to root. I don't think
18679 there is a way of preserving the original ownership using
18680 Nautilus (unless doing a "move" instead of a "copy" but that's
18681 not what we are trying to do here).
18682 - Disable FoxyProxy's proxy:// protocol handler (Closes: #7479).
18683 FoxyProxy adds the proxy:// protocol handler, which can be used
18684 to configure the proxy via an URI. A malicious web page can
18685 include (or a malicious exit node can inject) some JavaScript
18686 code to visit such an URI and disable or otherwise change
18687 Iceweasel's proxy settings. While using this to disable
18688 proxying will be dealt with safely by our firewall, this could
18689 be used to defeat stream isolation, although the user must be
18690 tricked into accepting the new proxy settings.
18691 - Upgrade the web browser to 24.7.0esr-0+tails1~bpo70+1
18692 (Firefox 24.7.0esr + Iceweasel patches + Torbrowser patches).
18693 - Upgrade to Linux 3.14.12-1 (fixes CVE-2014-4699).
18694 - Upgrade libav-based packages to 0.8.13-1 (fixes CVE-2014-4609).
18695 - Upgrade to libxml2 2.8.0+dfsg1-7+wheezy1 (fixes CVE-2014-0191).
18696 - Upgrade to dbus 1.6.8-1+deb7u3 (fixes CVE-2014-3477,
18697 CVE-2014-3532 and CVE-2014-3533).
18700 - Disable GNOME keyring's GnuPG functionality. (Closes: #7330) In
18701 feature/regular-gnupg-agent, we installed the regular GnuPG
18702 agent so that it is used instead of GNOME keyring's one. This is
18703 not enough on Wheezy, so let's disable the starting of the "gpg"
18704 component of GNOME keyring.
18705 - Make sure /etc/default/locale exists, with a sensible default
18706 value (Closes: #7333). Before Tails Greeter's PostLogin script
18707 are run, /etc/default/locale does not exist on Wheezy. Our
18708 tails-kexec initscript (and quite a few other scripts we run)
18709 depends on this file to exist. So, let's make sure it exists,
18710 with a sensible default value.
18711 - Create the tails-persistence-setup user with the same UID/GID it
18712 had on Tails/Squeeze. (Closes: #7343) Else, our various checks
18713 for safe access rights on persistence.conf fail.
18714 - Revert back to browsing the offline documentation using Iceweasel
18715 instead of Yelp (Closes: #7390, #7285).
18716 - Make the new NetworkManager configuration directory persistent,
18717 when the old one was, but disable the old one (Closes: #7338).
18718 - Before running tails-upgrade-frontend, chdir to a world-readable
18719 place (Closes: #7641). In particular, Archive::Tar::Wrapper,
18720 when called by tails-install-iuk, wants to chdir back to the
18721 original cwd after it has chdir'd elsewhere to do its job.
18723 * Minor improvements
18724 - Install seahorse-nautilus, replacing seahorse-plugins (Closes #5516).
18725 - Install hledger (custom backport, for now): our accountants need this.
18726 - Install stable Scribus instead of scribus-ng.
18727 - Install the printer driver for Epson Inkjet that use ESC/P-R.
18728 - Install the BookletImposer PDF imposition toolkit. It's tiny,
18729 and really helpful e.g. when producing booklets.
18730 - Install gtkhash and nautilus-gtkhash (Closes #6763).
18731 - Import new version of Tor Launcher:
18732 · Now based on upstream Tor Launcher 0.2.5.4.
18733 · Tor bug #11772: Proxy Type menu not set correctly
18734 · Tor bug #11699: Change &#160 to   in network-settings.dtd
18735 · Correctly handle startup paths that contain dot.
18736 - Upgrade to Torbutton 1.6.9.0.
18737 - Avoid shipping python2.6 in addition to python2.7.
18738 - Don't install Gobby 0.4 anymore. Gobby 0.5 has been available in
18739 Debian since Squeeze, now is a good time to drop the obsolete
18740 0.4 implementation.
18741 - Require a bit less free memory before checking for upgrades with
18742 Tails Upgrader. The general goal is to avoid displaying "Not
18743 enough memory available to check for upgrades" too often due to
18744 over-cautious memory requirements checked in the wrapper.
18745 - Make Tails Greeter's help window resolution-aware. Previously it
18746 used a static 800x600 which was problematic on lower resolutions,
18747 and sub-optimal on higher resolutions. Now it adapts itself
18748 according to the screen resolution.
18749 - Whisperback now sanitizes attached logs better with respect to
18750 DMI data, IPv6 addresses, and serial numbers (Closes #6797,
18752 - Integrate the new logo in Tails Installer (Closes #7095)
18753 - Also install linux-base and linux-compiler-gcc-4.8-x86 from
18754 sid. This way, we can get rid of our linux-compiler-gcc-4.8-x86
18755 3.12, and it makes things a bit more consistent.
18756 - Include the syslinux binary, and its MBR, in the ISO filesystem.
18757 This in turn allows Tails Installer to use this binary and MBR,
18758 which is critical for avoiding problems (such as #7345) on
18759 "Upgrade from ISO".
18760 - Include syslinux.exe for win32 in utils/win32/ on the ISO
18761 filesystem (Closes: #7425).
18763 * Add consistent margins in GUI.
18764 * Always reset the target drive's MBR, without asking for
18765 confirmation, after installing or upgrading.
18766 * Install the bootloader using the syslinux binary found on the
18767 target device, once the Live OS has been extracted/copied
18769 - Enable double-clicking to pick entries in the language or
18770 keyboard layout lists in Tails Greeter.
18771 - Install backport of shared-mime-info 1.3 (Closes: #7079).
18772 - Make sanity-check prompts closable in Tails Persistence Setup
18774 - Fix quick search in Tails Greeter's Other languages window
18776 - Install systemd. It is not enabled by default, but having it
18777 around will help doing the migration work.
18778 - Enable AppArmor on the kernel command-line. This is a no-op
18779 without the userspace tools and with no profile shipped, but it
18780 will make it easier to fix this part of the situation.
18783 - Bump Vagrant builder's memory for RAM builds. Wheezy requires
18784 more space to build, and the resulting image is larger.
18785 - Fix Vagrant compatibility issue. Some classes' methods/fields
18786 have been renamed between Vagrant versions, so we need a simple
18787 compatibility layer to support all versions. Without this, it's
18788 not possible to issue e.g. a `build` command to an already
18789 running (i.e. `vm:up`:ed) Vagrant instance.
18790 - Move cpu and mem checks to the `build` task. Previously, when
18791 they were checked in `vm:up` *only* when issued while the VM
18792 already is up, so these checks weren't run if one issues a
18793 `build` when the VM is off. Now we'll fail earlier with a more
18794 informative error message, and it looks like a more logical home
18796 - Fix buggy memory checks for RAM building. We have to take into
18797 account which state the Vagrant VM is in for determining *where*
18798 we check if enough memory is available for a RAM build. If it's
18799 off, we check the host; if it's on we check the VM. Previously
18800 we always checked the host, which doesn't make sense when the VM
18801 is already started.
18803 * Automated test suite
18804 - Bump the tester VM's RAM by 256 MiB. There is not enough free
18805 RAM to run Tails Upgrader with just 1 GiB of RAM after the
18806 migration to Wheezy.
18807 - Always adjust OOM and memory overcommit settings. The kernel
18808 freezes seem to also happen for the amd64 kernel when filling
18810 - Add option to make Sikuli rety on FindFailed. This makes it
18811 possible to update manu images for Sikuli in just *one* test
18812 suite run, by continuously updating outdated pictures as we go.
18813 - Actually run "Upgrade from ISO" from a USB drive running the old
18814 version. That's what users do, and is buggy.
18815 - Automatically test persistent directories permissions (Closes: #7560).
18816 - Use read-write persistence when testing upgraded USB
18817 installations. Otherwise e.g. the permission fixes won't get
18818 applied, and the subsequent steps testing the permissions will
18820 - Actually check that the ISO's Tails is installed. The step
18821 "Tails is installed on USB drive $TARGET" only checks that the
18822 *running* Tails is installed on $TARGET, which obviously fails
18823 when doing an upgrade from ISO running an old Tails. That it
18824 worked for the same scenario running the current Tails is just
18826 - Use OpenJDK 7 to run our test suite (Closes #7175).
18827 - Use qemu-system-x86_64 directly, instead of kvm, for running the
18828 automated test suite (Closes: #7605).
18830 -- Tails developers <tails@boum.org> Sun, 20 Jul 2014 23:16:13 +0200
18832 tails (1.0.1) unstable; urgency=medium
18835 - Upgrade the web browser to 24.6.0esr-0+tails1~bpo60+1
18836 (Firefox 24.6.0esr + Iceweasel patches + Torbrowser patches).
18837 Also import the Tor Browser profile at commit
18838 90ba8fbaf6f23494f1a0e38d63153b3b7e65d3d3 from
18839 ttp/tor-browser-24.6.0esr-3.x-1.
18840 - Install Linux 3.14 from Debian unstable (fixes CVE-2014-3153 and
18842 - Install openssl from Squeeze LTS (fixes CVE-2014-0076,
18843 CVE-2014-0195, CVE-2014-0221, CVE-2014-3470 and CVE-2014-0224).
18844 - Install GnuTLS from Squeeze LTS (fixes CVE-2014-3466.).
18846 * Minor improvements
18847 - Add Squeeze LTS APT sources. It has been given a low pinning
18848 priority so explicit pinning must be used to actually install
18850 - Upgrade Tor to 0.2.4.22-1~d60.squeeze+1.
18851 - Upgrade I2P to 0.9.13-1~deb6u+1.
18853 -- Tails developers <tails@boum.org> Sun, 08 Jun 2014 19:14:00 +0200
18855 tails (1.0) unstable; urgency=medium
18858 - Upgrade the web browser to 24.5.0esr-0+tails1~bpo60+1
18859 (Firefox 24.5.0esr + Iceweasel patches + Torbrowser patches).
18860 - Upgrade Tor to 0.2.4.21-1+tails1~d60.squeeze+1:
18861 * Based on 0.2.4.21-1~d60.squeeze+1.
18862 * Backport the fix for Tor bug #11464. It adds client-side blacklists for
18863 all Tor directory authority keys that was vulnerable to Heartbleed.
18864 This protects clients in case attackers were able to compromise a
18865 majority of the authority signing and identity keys.
18868 - Disable inbound I2P connections. Tails already restricts incoming
18869 connections, but this change tells I2P about it.
18870 - Fix link to the system requirements documentation page in the Tails
18871 Upgrader error shown when too little RAM is available.
18873 * Minor improvements
18874 - Upgrade I2P to 0.9.12-2~deb6u+1.
18875 - Import TorBrowser profile. This was forgotten in Tails 0.23 and even
18876 though we didn't explicitly set those preferences in that release
18877 they defaulted to the same values. This future-proofs us in case the
18878 defaults would ever change.
18879 - Import new custom version of tor-launcher:
18880 * Based on upstream Tor Launcher 0.2.5.3.
18881 * Improve how Tor Launcher handles incomplete translation.
18882 (Tor bug #11483; more future-proof fix for Tails bug #6885)
18883 * Remove the bridge settings prompt. (Tor bug #11482; closes Tails
18885 * Always show bridge help button. (Tor bug #11484)
18886 - Integrate the new Tails logo into various places:
18889 * The "About Tails" dialog
18892 - Use the stable APT suite when building from the stable Git branch
18896 - Add test for the #7022 fix.
18898 -- Tails developers <tails@boum.org> Sun, 27 Apr 2014 19:34:01 +0200
18900 tails (0.23) unstable; urgency=medium
18903 - Upgrade the web browser to 24.4.0esr-0+tails1~bpo60+1
18904 (Firefox 24.4.0esr + Iceweasel patches + Torbrowser patches).
18906 * Major new features
18907 - Spoof the network interfaces' MAC address by default (Closes: #5421),
18908 as designed on https://tails.boum.org/contribute/design/MAC_address/.
18909 - Rework the way to configure how Tor connects to the network
18910 (bridges, proxy, fascist firewall): add an option to Tails Greeter,
18911 start Tor Launcher when needed (Closes: #5920, #5343).
18914 - Additional software: do not crash when persistence is disabled
18916 - Upgrade Pidgin to 2.10.9, that fixes some regressions introduced
18917 in the 2.10.8 security update (Closes: #6661).
18918 - Wait for Tor to have fully bootstrapped, plus a bit more time,
18919 before checking for upgrades (Closes: #6728) and unfixed known
18921 - Disable the Intel Management Engine Interface driver (Closes: #6460).
18922 We don't need it in Tails, it might be dangerous, and it causes bugs
18923 on various hardware such as systems that reboot when asked to shut down
18924 - Add a launcher for the Tails documentation. This makes it available
18925 in Windows Camouflage mode (Closes: #5374, #6767).
18926 - Remove the obsolete wikileaks.de account from Pidgin (Closes: #6807).
18928 * Minor improvements
18929 - Upgrade Tor to 0.2.4.21-1~d60.squeeze+1.
18930 - Upgrade obfsproxy to 0.2.6-2~~squeeze+1.
18931 - Upgrade I2P to 0.9.11-1deb6u1.
18932 - Install 64-bit kernel instead of the 686-pae one (Closes: #5456).
18933 This is a necessary first step towards UEFI boot support.
18934 - Install Monkeysign (in a not-so-functional shape yet).
18935 - Disable the autologin text consoles (Closes: #5588). This was one of
18936 the blockers before a screen saver can be installed
18937 in a meaningful way (#5684).
18938 - Don't localize the text consoles anymore: it is broken on Wheezy,
18939 the intended users can as well use loadkeys, and we now do not have
18940 to trust setupcon to be safe for being run as root by the desktop user.
18941 - Make it possible to manually start IBus.
18942 - Reintroduce the possibility to switch identities in the Tor Browser,
18943 using a filtering proxy in front of the Tor ControlPort to avoid giving
18944 full control over Tor to the desktop user (Closes: #6383).
18945 - Incremental upgrades improvements:
18946 · Drop the Tails Upgrader launcher, to limit users' confusion
18948 · Lock down sudo credentials a bit.
18949 · Hide debugging information (Closes: #6505).
18950 · Include ~/.xsession-errors in WhisperBack bug reports.
18951 This captures the Tails Upgrader errors and debugging information.
18952 · Report more precisely why an incremental upgrade cannot be done
18954 · Various user interface and phrasing improvements.
18955 - Don't install the Cookie Monster browser extension (Closes: #6790).
18956 - Add a browser bookmark pointing to Tor's Stack Exchange (Closes: #6632).
18957 - Remove the preconfigured #tor channel from the Pidgin: apparently,
18958 too many Tails users go ask Tails questions there, without making
18959 it clear that they are running Tails, hence creating a user-support
18960 nightmare (Closes: #6679).
18961 - Use (most of) Tor Browser's mozconfig (Closes: #6474).
18962 - Rebase the browser on top of iceweasel 24.3.0esr-1, to get
18963 the certificate authorities added by Debian back (Closes: #6704).
18964 - Give access to the relevant documentation pages from Tails Greeter.
18965 - Hide Tails Greeter's password mismatch warning when entry is changed.
18966 - Persistent Volume Assistant:
18967 · Take into account our installer is now called Tails Installer.
18968 · Optimize window height (Closes: #5458).
18969 · Display device paths in a more user-friendly way (Closes: #5311).
18972 - Ease updating POT and PO files at release time, and importing translations
18973 from Transifex (Closes: #6288, #6207).
18974 - Drop custom poedit backport, install it from squeeze-backports-sloppy.
18975 - Make ISO and IUK smaller (Closes: #6390, #6425):
18976 · Exclude more files from being included in the ISO.
18977 · Remove *.pyc later so that they are not recreated.
18978 · Truncate log files later so that they are not filled again.
18979 · At ISO build time, set mtime to the epoch for large files whose content
18980 generally does not change between releases. This forces rsync
18981 to compare the actual content of these files, when preparing an IUK,
18982 instead of blindly adding it to the IUK merely because the mtime
18983 has changed, while the content is the same.
18984 - Make local hooks logging consistent.
18987 - Migrate from JRuby to native Ruby + rjb.
18988 - The test suite can now be run on Debian Wheezy + backports.
18989 - Fix buggy "persistence is not enabled" step (Closes: #5465).
18990 - Use IPv6 private address as of RFC 4193 for the test suite's virtual
18991 network. Otherwise dnsmasq from Wheezy complains, as it is not capable
18992 of handling public IPv6 addresses.
18993 - Delete volumes after each scenario unless tagged @keep_volumes.
18994 - Add an anti-test to make sure the memory erasure test works fine.
18995 - A *lot* of bugfixes, simplifications and robustness improvements.
18997 -- Tails developers <tails@boum.org> Tue, 18 Mar 2014 00:58:50 +0100
18999 tails (0.22.1) unstable; urgency=medium
19002 - Upgrade the web browser to 24.3.0esr-0+tails1~bpo60+2
19003 (Firefox 24.3.0esr + Iceweasel patches + Torbrowser patches).
19004 - Upgrade NSS to 3.14.5-1~bpo60+1.
19005 - Upgrade Pidgin to 2.10.8.
19006 - Workaround browser size fingerprinting issue by using small icons
19007 in the web browser's navigation toolbar (Closes: #6377).
19008 We're actually hit by Tor#9268, and this is the best workaround gk
19009 and I were able to find when discussing this on Tor#10095.
19011 * Major new features
19012 - Check for upgrades availability using Tails Upgrader, and propose
19013 to apply an incremental upgrade whenever possible (Closes: #6014).
19014 · Run tails-update-frontend at session login time.
19015 · Have tails-security-check only report unfixed security issues.
19016 · Greatly improve the Tails Upgrader UI and strings phrasing.
19017 · Enable startup notification for Tails Upgrader.
19018 - Install Linux 3.12 (3.12.6-2) from Debian testing. Unfortunately,
19019 this breaks the memory wipe feature on some hardware (#6460), but
19020 it fixes quite a few security issues, and improves hardware support.
19021 - Update the build system to be compatible with Vagrant 1.2 and 1.3,
19022 in addition to the already supported versions (Closes: #6221).
19023 Thanks to David Isaac Wolinsky <isaac.wolinsky@gmail.com>.
19026 - Do not start IBus for languages that don't need it. This fixes
19027 the keybindings problems introduced in 0.22 (Closes: #6478).
19028 Thanks to WinterFairy.
19029 - Disable network.proxy.socks_remote_dns in the Unsafe Browser.
19030 Bugfix against 0.22 (Closes: #6479).
19031 - Fetch Tor Browser User-Agent from its own prefs, rather than from
19032 the obsolete Torbutton ones. Bugfix against 0.22 (Closes: #6477).
19033 - Upgrade Vagrant basebox to include up-to-date Debian archive keys
19034 (Closes: #6515, #6527).
19035 - Do not use a non-working proxy for downloading the Vagrant basebox
19037 - Use IE's icon in Windows camouflage mode.
19038 Bugfix against 0.22 (Closes: #6536).
19039 - Support "upgrading" a partial Tails installation (Closes: #6438)
19040 and fix missing confirmation dialog in Tails Installer (Closes: #6437).
19041 Thanks to Andres Gomez Ramirez <andres.gomez@cern.ch>.
19042 - Fix browser homepage in Spanish locales (Closes: #6612).
19044 * Minor improvements
19045 - Tor 0.2.4 is stable! Adapt APT sources accordingly.
19046 - Update Tor Browser to 24.2.0esr-1+tails1, that uses its own NSS
19047 library instead of the system one.
19048 - Update Torbutton to 1.6.5.3.
19049 - Do not start Tor Browser automatically, but notify when Tor is ready.
19050 Warn the user when they attempt to start Tor Browser before Tor is ready.
19051 - Import Tor Browser profile at
19052 3ed5d9511e783deb86835803a6f40e7d5a182a12 from ttp/tor-browser-24.2.0esr-1.
19053 - Use http.debian.net for Vagrant builds, instead of the mostly broken
19054 (and soon obsolete) cdn.debian.net.
19055 - Phrasing and UI improvements in tails-upgrade-frontend.
19056 - Style and robustness improvements in tails-security-check.
19057 - Make room for upcoming UEFI support in Tails Installer.
19059 -- Tails developers <tails@boum.org> Wed, 29 Jan 2014 15:08:13 +0100
19061 tails (0.22) unstable; urgency=medium
19065 - Upgrade to Iceweasel 24.2.0esr that fixes a few serious security issues.
19066 - Stop migrating persistence configuration and access rights. Instead,
19067 disable all persistence configuration files if the mountpoint has wrong
19068 access rights (Closes: #6413).
19069 - Upgrade to NSS 3.15.3 that fixes a few serious security issues affecting
19070 the browser, such as CVE-2013-1741, CVE-2013-5605 and CVE-2013-5606.
19072 * Major improvements
19073 - Switch to Iceweasel 24 (Closes: #6370).
19074 · Resync' (most) Iceweasel prefs with TBB 3.0-beta-1 and get rid
19075 of many obsolete or default settings.
19076 · Disable WebRTC (Closes: #6468).
19077 · Import TorBrowser profile at commit
19078 51bf06502c46ee6c1f587459e8370aef11a3422d from the tor-browser-24.2.0esr-1
19079 branch at https://git.torproject.org/tor-browser.git.
19080 - Switch to Torbutton 1.6.5 (Closes: #6371).
19081 · Prevent Torbutton from asking users to "upgrade TBB".
19082 · Use the same Tor SOCKS port as the TBB (9151) for our web browser.
19083 This should be enough to avoid being affected by Tor#8511.
19084 · Disable Torbutton 1.6's check for Tor.
19085 Unfortunately, the new check.torproject.org breaks the remote Tor
19086 check. We cannot use the local Tor check with the control port. So,
19087 the shortest and sanest path to fixing the check issue, because the
19088 remote Tor check is broken" seems to simply disable this check.
19089 Patch submitted upstream as Tor#10216.
19090 - Prepare incremental upgrades to be the next default way to upgrade Tails,
19091 on point-releases at least.
19094 - Deny X authentication only after Vidalia exits (Closes: #6389).
19095 - Disable DPMS screen blanking (Closes: #5617).
19096 - Fix checking of the persistent volume's ACL.
19097 - Sanitize more IP and MAC addresses in bug reports (Closes: #6391).
19098 - Do not fail USB upgrade when the "tmp" directory exists on the
19099 destination device.
19100 - Tails Installer: list devices with isohybrid Tails installed
19103 * Minor improvements
19104 - Create a configuration file for additional software if needed
19106 - Translations all over the place.
19107 - Enable favicons in Iceweasel.
19108 - Do not propose to make permanent NoScript exceptions.
19109 In Tails, every such thing is temporary, so better only display the menu
19110 entry that's about temporarily allowing something.
19111 - Clearer warning when deleting persistent volume (thanks to Andres Gomez
19112 Ramirez <andres.gomez@cern.ch> for the patch).
19113 - Make wording in Tails Installer more consistent.
19116 * Use IBus instead of SCIM (Closes: #5624, #6206).
19117 It makes it possible to input passwords in pinentry for at least Japanese,
19118 Chinese and Korean languages.
19119 * Add an import-translation script.
19120 This automates the importation process of completed translations
19122 * Always list optimal keyboard layout in the greeter (Closes: #5741).
19123 * Fix on-the-fly translation of the greeter in various languages
19127 * Update I2P to 0.9.8.1 (Closes: #6080, #5889).
19128 * Improve I2P configuration:
19129 - Disable IPv6 support in a nicer way.
19130 - Disable i2cp (allows java clients to communicate from outside the JVM). If
19131 this is unset an exception for port 7654 would need to be added to ferm.
19132 - Disable "in-network" updates (this is also done in the regular I2P
19134 - Disable the outproxies. Access to the Internet is already routed through
19135 Tor so these are unnecessary. If end-users have a good reason to go
19136 through one of the I2P outproxies they can turn them back on.
19137 * Add a couple of default I2P IRC channels to Pidgin.
19138 * Allow access to the local 'eepsite' through FoxyProxy.
19139 * Add firewall exceptions for the standard I2P ports.
19141 -- Tails developers <tails@boum.org> Sat, 30 Nov 2013 16:47:18 +0100
19143 tails (0.21) unstable; urgency=low
19146 - Don't grant access to the Tor control port for the desktop user
19147 (amnesia). Else, an attacker able to run arbitrary code as this user
19148 could obtain the public IP with a get_info command.
19149 · Vidalia is now run as a dedicated user.
19150 · Remove the amnesia user from the debian-tor group.
19151 · Remove the Vidalia launcher in the Applications menu.
19152 The Vidalia instance it starts is useless, since it can't connect
19153 to the Tor control port.
19154 - Don't allow the desktop user to directly change persistence settings.
19155 Else, an attacker able to run arbitrary code as this user could
19156 leverage this feature to gain persistent root access, as long as
19157 persistence is enabled.
19158 · Fully rework the persistent filesystem and files ownership
19160 · Run the Persistent Volume Assistant as a dedicated user, that is
19161 granted the relevant udisks and filesystem -level credentials.
19162 · At persistence activation time, don't trust existing persistence
19163 configuration files, migrate to the new ownership and permissions,
19164 migrate every known-safe existing settings and backup what's left.
19165 Warn the user when not all persistence settings could be migrated.
19166 · Persistent Volume Assistant uses the new ownership and permissions
19167 scheme when initializing a new persistent volume, and refuses to
19168 read persistence.conf if it, or the parent directory, hasn't the
19169 expected permissions.
19170 · Make boot medium 'system internal' for udisks with bilibop.
19171 Once Tails is based on Wheezy, this will further complete the
19172 protection (see #6172 for details).
19173 - Update Iceweasel to 17.0.10esr-0+tails2~bpo60+1.
19174 - Update Torbutton to 1.5.2-2, including a patch cherry-picked from
19175 upstream to make window resizing closer to what the design says.
19177 * Major new features
19178 - Add a persistence preset for printing settings (Closes: #5686).
19179 Reload CUPS configuration after persistence activation.
19180 - Support SD card connected through a SDIO host adapter (Closes: #6324).
19181 · Rebrand Tails USB installer to Tails installer.
19182 · Display devices brand, model and size in the Installer
19184 · Ask for confirmation before installing Tails onto a device
19186 · Add support for SDIO and MMC block devices to the Tails Installer
19187 (Closes: #5744) and the Persistent Volume Assistant (Closes: #6325).
19188 · Arm the udev watchdog when booted from SD (plugged in SDIO) too
19191 * Minor improvements
19192 - Provide a consistent path to the persistent volume mountpoint
19194 - Add a KeePassX launcher to the top GNOME panel (Closes: #6290).
19195 - Rework bug reporting workflow: point the desktop launcher to
19196 the troubleshooting page.
19197 - Make /home world-readable at build time, regardless of the Git
19198 working copy permissions. This makes the build process more robust
19199 against strict umasks.
19200 - Add signing capabilities to the tails-build script (Closes: #6267).
19201 This is in turn used to sign ISO images built by our Jenkins setup
19203 - Simplify the ikiwiki setup and make more pages translatable.
19204 - Exclude the version string in GnuPG's ASCII armored output.
19205 - Prefer stronger ciphers (AES256,AES192,AES,CAST5) when encrypting
19207 - Use the same custom Startpage search URL than the TBB.
19208 This apparently disables the new broken "family" filter.
19209 - Update AdBlock Plus patterns.
19210 - Install Linux from Debian testing.
19211 (That is, the same version that was shipped in 0.20.1.)
19214 - Look for "/tmp/.X11-unix/X${1#:}" too when detecting displays in use.
19215 - Adapt tests to match the Control Port access security fix:
19216 · Take into account that the amnesia user isn't part of the debian-tor
19218 · Run as root the checks to see if a process is running: this
19219 is required to see other users' processes.
19221 -- Tails developers <tails@boum.org> Sat, 26 Oct 2013 23:42:46 +0200
19223 tails (0.20.1) unstable; urgency=low
19225 * Major new features
19226 - Install Tor 0.2.4.17-rc-1~d60.squeeze+1 from the Tor project's repository.
19227 - Install Iceweasel 17.0.9esr with Torbrowser patches.
19228 - Install Linux kernel 3.10-3 (version 3.10.11-1) from sid.
19231 - Remount persistence devices read-only at shutdown/reboot time
19233 - Greeter: display a warning icon on admin password mismatch and on
19234 persistence unlocking failure. Thanks to Andres Gomez Ramirez
19235 <andres.gomez@cern.ch> for the fix!
19236 - Don't torsocksify Pidgin.
19237 Instead we disable Pidgin's GNOME integration to get the "Global proxy
19238 configuration", which we set to use Tor. This fixes the I2P IRC account.
19239 - Additional software: fix typo in notification.
19240 - Allow installing "Priority: standard" packages that we do not install
19241 by default: remove them late in the build process instead of assigning
19242 them a -1 APT pinning level.
19244 * Minor improvements
19245 - Update AdBlock Plus patterns.
19246 - Use more unique ISO file name when building from Jenkins.
19247 - Additional software: point to the system log on upgrade failure.
19248 - Set SOCKS5_USER and SOCKS5_PASSWORD in the connect-socks wrapper (used
19249 by Git). Else, Tor 0.2.4's IsolateSOCKSAuth and connect-proxy
19250 sometimes play together in some way that makes connect-proxy ask for
19251 a password to connect to the SocksPort. SOCKS5_USER and
19252 SOCKS5_PASSWORD are passed through unchanged if they were manually set
19253 by the user already.
19254 - Use our custom connect-socks wrapper for SSH. Else, Tor 0.2.4's
19255 IsolateSOCKSAuth and connect-proxy sometimes play together in some way
19256 that makes connect-proxy ask for a password to connect to the
19257 SocksPort. Note that connect-socks uses the default SocksPort too, so
19258 no change here wrt. our connection isolation design.
19261 - Import new translations from Transifex.
19264 - Fix old ISO checking for consistent error reporting.
19265 - Remove custom persistence test from manual test suite.
19266 It was removed for the GUI in t-p-s 0.33.
19268 -- Tails developers <tails@boum.org> Sun, 15 Sep 2013 15:49:36 +0200
19270 tails (0.20) unstable; urgency=low
19272 * Major new features
19273 - Install Linux kernel 3.10.3-1 from Debian unstable.
19274 - Iceweasel 17.0.8esr + Torbrowser patches.
19277 - Prevent Iceweasel from displaying a warning when leaving HTTPS web sites.
19278 - Make Iceweasel use the correct, localized search engine.
19279 - Fix Git access to https:// repositories.
19281 * Minor improvements
19282 - Install Dasher, a predictive text entry tool.
19283 - Add a wrapper around TrueCrypt which displays a warning about it soon
19284 being deprecated in Tails.
19285 - Remove Pidgin libraries for all protocols but IRC and Jabber/XMPP.
19286 Many of the other protocols Pidgin support are broken in Tails and
19287 haven't got any security auditting.
19288 - Disable the pre-defined Pidgin accounts so they do not auto-connect
19290 - Include information about Alsa in WhisperBack reports.
19291 - Explicitly restrict access to ptrace. While this setting was enabled
19292 by default in Debian's Linux 3.9.6-1, it will later disabled in 3.9.7-1.
19293 It's unclear what will happen next, so let's explicitly enable it ourselves.
19294 - Do not display dialog when a message is sent in Claws Mail.
19295 - Sync iceweasel preferences with the Torbrowser's.
19298 - Many translation updates all over the place.
19299 - Merge all Tails-related POT files into one, and make use of intltoolize
19300 for better integration with Transifex.
19302 -- Tails developers <tails@boum.org> Tue, 30 Jul 2013 14:19:57 +0200
19304 tails (0.19) unstable; urgency=low
19306 * Major new features
19307 - Install Linux kernel 3.9.5-1 from Debian unstable.
19308 Features of particular interest for Tails are the Yama LSM
19309 (ptrace scope restrictions) and improved hardware support.
19310 As a corollary, install initramfs-tools from there too.
19311 - Iceweasel 17.0.7esr + Torbrowser patches.
19312 - Unblock Bluetooth, Wi-Fi, WWAN and WiMAX; block every other type of
19313 wireless device. Next steps are described on the
19314 todo/protect_against_external_bus_memory_forensics ticket.
19317 - Fix write access to boot medium at the block device level,
19318 by installing bilibop-udev. Thanks to quidame for his support.
19319 - tails-greeter l10n-related fixes, thanks to winterfairy:
19320 · Fix so translations is applied on password mismatch messages.
19321 · Separate forward and login buttons and make them translatable.
19322 - Fix link to documentation when no sudo password is set.
19323 - gpgApplet: partial fix for clipboard emptying after a wrong passphrase
19325 - Workaround aufs bug in Unsafe Browser script.
19327 * Minor improvements
19328 - Drop GNOME proxy settings: we did not find any use of it we were keen
19329 to support, other than two programs (Seahorse, Pidgin) that are now run
19331 - Format newly created persistent volumes as ext4.
19332 - GnuPG: don't connect to the keyserver specified by the key owner.
19333 This feature opens the door to a variety of subtle attacks.
19334 - GnuPG: locate keys only from local keyrings.
19335 This is probably the default, but better safe than sorry.
19336 - Install virt-what from Wheezy.
19337 The version from Squeeze does not detect at least Parallels for Mac v.8.
19338 - Upgrade live-boot and live-config to the 3.0.x final version from Wheezy.
19339 · Remove /live and /lib/live/image compatibility symlinks.
19340 · Add /live/overlay -> /lib/live/mount/overlay symlink.
19341 The live-boot changes (commit d2b2a461) brought to fix Debian bug
19342 #696495 revert some of our previous changes (commit 77dab1cb), and as
19343 a result, at the time live-persist runs, no tmpfs is mounted on
19344 /live/overlay, which breaks the aufs mount. So, let's just ensure
19345 /live/overlay points to a tmpfs.
19346 · Really disable policykit and sudo live-config hooks.
19347 ... by making it believe they've already been run.
19348 This workarounds new live-config's default behavior.
19351 - Many translation updates all over the place.
19354 - Re-enable previously disabled boot device permissions test.
19356 -- Tails developers <tails@boum.org> Wed, 26 Jun 2013 12:36:20 +0200
19358 tails (0.18) unstable; urgency=low
19361 - Support obfs3 bridges.
19362 - Automatically install a custom list of additional packages chosen by
19363 the user at the beginning of every working session, and upgrade them
19364 once a network connection is established (technology preview).
19367 - Upgrade to Iceweasel 17.0.6esr-0+tails1~bpo60+1.
19368 - Update Torbrowser patches to current maint-2.4 branch (567682b).
19369 - Isolate DOM storage to first party URI, and enable DOM storage:
19370 don't set dom.storage.enabled anymore, and set Torbutton's
19371 disable_domstorage to false.
19372 - Isolate the image cache per url bar domain.
19373 - Torbutton 1.5.2, and various prefs hacks to fix breakage:
19374 · Add .saved version of the Torbutton preferences the TBB also sets.
19375 · Set TOR_SOCKS_HOST and TOR_SOCKS_PORT.
19376 · Move some prefs (network.proxy.*, extensions.autoDisableScopes,
19377 extensions.foxyproxy.last-version) to user.js.
19378 Else, with Torbutton 1.5.x, these ones are not taken into account.
19379 · Set network.proxy.socks_version.
19380 Else we get the meaningless user_pref("network.proxy.socks_version", 9063);
19381 in prefs.js after the initial startup.
19382 · Set extensions.foxyproxy.socks_remote_dns to true.
19383 Else, it overrides the various ways we set network.proxy.socks_remote_dns,
19384 which in turn makes Torbutton think it should start in non-Tor mode.
19385 · Also pass the TOR_SOCKS_* environment variables to iceweasel when
19386 generating the profile: Torbutton behaves differently depending on
19387 these variables, so we don't want the initial profile generation to be
19388 done without them. In practice, this has no implication that we could
19389 see right now, but better safe than sorry.
19390 · Import all version overrides from the TBB prefs.
19391 Else, the User-Agent sent in the HTTP headers is fine, but real
19392 values leak with JavaScript, as demonstrated by ip-check's "Browser
19394 · Move a bunch of settings to user_pref(), that are not applied otherwise.
19395 For some, this fixes a regression in 0.18~rc1.
19396 For other, the bug was already present in Tails 0.17.2.
19397 - HTTPS Everywhere 3.2.
19398 - Update prefs to match the TBB's, fix bugs, and take advantage of the latest
19399 Torbrowser patches:
19400 · Increase pipeline randomization.
19401 · Fix @font-face handling of local() fonts.
19402 Also disable fallback font rendering.
19403 · Explicitly disable SPDY v2 and v3.
19404 · Update http pipelining prefs.
19405 - Make prefs organization closer to the TBB's:
19406 · Remove Torbutton prefs that we set at their default value.
19407 · Import Torbutton preferences from the TBB.
19408 · Organize iceweasel config files in sections the same way as the TBB.
19410 · Don't set extensions.torbutton.clear_cookies nor
19411 extensions.torbutton.saved.share_proxy_settings:
19412 we don't care about toggling anymore.
19413 · Don't set extensions.torbutton.saved.download_retention nor
19414 extensions.torbutton.saved.search_suggest:
19415 these settings are not used in Torbutton anymore.
19416 - Update unsafe browser prefs mangling accordingly.
19417 - Move network.protocol-handler.warn-external.* to user_pref().
19418 Else they're not applied.
19419 These prefs are actually ignored by Firefox these days -- the TBB
19420 design doc reads "They are set still anyway out of respect for the
19421 dead". Let's go on doing the same.
19422 - Update extensions.adblockplus.currentVersion.
19423 - Fetch xul-ext-https-everywhere (3.2-2) and xul-ext-noscript (2.6.6.1-1)
19424 from Debian unstable. They were uploaded there, and accordingly removed
19428 - Linux 3.2.41-2+deb7u2.
19429 - Fixed swapped filenames of tails-{reboot,shutdown}.desktop.
19430 Thanks to Mikko Harhanen for the patch.
19431 - Only add ClientTransportPlugin to torrc when bridge mode is enabled.
19432 This should bring back support for proxies of type other than obfsproxy.
19434 * Minor improvements
19435 - Set kernel.dmesg_restrict=1, and make /proc/<pid>/ invisible
19436 and restricted for other users. It makes it slightly harder for an attacker
19437 to gather information that may allow them to escalate privileges.
19438 - Install gnome-screenshot.
19439 - Don't disable IPv6 on all network interfaces anymore.
19440 It turns out the IPv6 leaks we wanted to fix actually don't exist.
19441 - Add a "About Tails" launcher in the System menu.
19442 - Install GNOME accessibility themes.
19443 - Use 'Getting started...' as the homepage for Tails documentation button.
19444 - Stop relying on the obsolete /live/image compatibility symlink.
19445 - Disable audio preview in Nautilus.
19446 - Wheezy was released => Squeeze is now oldstable.
19447 - Pick Tor from deb.torproject.org regardless of the release name they
19448 advertise. At some point we needed it, their APT repository still thought
19449 that stable == Squeeze.
19450 - Add Wheezy APT sources.
19451 - Install Linux and related packages from Wheezy.
19452 Debian sid just got Linux 3.8, and we don't want to switch to a new kernel
19454 - Fetch laptop-mode-tools from Wheezy.
19455 Wheezy has the version we've been installing in 0.18~rc1,
19456 while a newer one was uploaded to sid in the meantime.
19457 - Fetch a few packages from Wheezy instead of unstable.
19458 Namely: spice-vdagent, libregexp-common-perl, macchanger, service-wrapper,
19459 libservice-wrapper-java and libservice-wrapper-jni.
19460 Wheezy has the versions we've been installing for a while, so let's
19461 avoid having unstable push a newer one to us uselessly at some point.
19462 Note that at the time of this writing, the versions in sid and in Wheezy
19463 are the same, so this commit is effectively a no-op as of today: it is
19464 merely a safeguard for the future.
19467 - Many translation updates all over the place.
19470 - Make Vagrant's build-tails script support Jenkins too.
19473 - Fix Unsafe Browser test broken by hidepid.
19475 -- Tails developers <tails@boum.org> Mon, 13 May 2013 22:17:38 +0200
19477 tails (0.17.2) unstable; urgency=low
19480 - Upgrade to Iceweasel 17.0.5esr-0+tails2~bpo60+1.
19481 - Stop displaying obsolete context menu entries ("Open Tor URL" and friends).
19484 - Update Linux to 3.2.41-2
19487 - Use more reliable OpenPGP keyservers:
19488 · use the hkps pool in GnuPG (and import their SSL CA)
19489 · use hkp://pool.sks-keyservers.net in Seahorse (as it does not support
19491 - Keep udisks users (GNOME Disk Utility, tails-persistence-setup, etc.)
19492 from resetting the system partition's attributes when manipulating the
19493 partition table. To this end, backport the relevant bugfix from Wheezy
19494 into parted 2.3-5+tails1. This allowed to remove the sgdisk-based
19495 workaround in tais-persistence-setup, and to stop installing
19496 python-parted. All this is a first needed step to fix
19497 todo/make_system_disk_read-only in a future release.
19499 * Minor improvements
19500 - Disable NoScript's HTML5 media click-to-play for better user experience.
19503 - Tails USB installer: update translations for French, German, Spanish,
19504 Finnish, Greek, Italian, Latvian, Dutch, Polish and Chinese.
19505 - Tails Greeter: update translations for Farsi, Chinese, French;
19506 new translations: Finnish, Norwegian Bokmål, Galician.
19507 - tails-persistence-setup: update Farsi and Chinese translations;
19508 import new translations for Finnish and Swedish.
19509 - WhisperBack: update translations for Arabic, French, German, Greek,
19510 Spanish, Korean, Polish, Russian. New translations: Finnish, Chinese.
19513 - Add automated testing framework (Sikuli, Cucumber, libvirt -based)
19514 with a bunch of tests.
19516 -- Tails developers <amnesia@boum.org> Sun, 07 Apr 2013 12:17:26 +0200
19518 tails (0.17.1) unstable; urgency=low
19521 - Upgrade to Iceweasel 17.0.4esr-0+tails1~bpo60+1.
19524 - Update Linux to 3.2.39-2.
19525 It includes the drm and agp subsystems from Linux 3.4.29.
19526 - Don't install xserver-xorg-video-rendition backport.
19527 xserver-xorg-video-rendition has been removed from squeeze-backports
19528 due to an upstream tarball mismatch discover when merging backports
19529 into the main Debian archive, and xserver-xorg-video-all still depends
19530 on it, so we explicitly install all drivers from -all but -rendition
19531 as a (hopefully temporary) workaround.
19533 * Minor improvements
19534 - Remove Indymedia IRC account, until we ship a version of Pidgin
19535 with SASL support, that is when Tails is based on Wheezy.
19538 - Don't ship the wiki's todo and bugs on ISO images.
19540 -- Tails developers <amnesia@boum.org> Thu, 21 Mar 2013 18:54:11 +0100
19542 tails (0.17) unstable; urgency=low
19545 - Install the KeePassX password manager, with a configuration and
19546 documentation that makes it easy to persist the password database.
19549 - Upgrade to Iceweasel 17.0.3esr-1+tails1~bpo60+1.
19550 - Install xul-ext-adblock-plus from squeeze-backports.
19551 - Do not allow listing all available fonts.
19552 Set browser.display.max_font_attempts and browser.display.max_font_count
19553 to enable the Torbrowser Limit-the-number-of-fonts-per-document patch.
19554 - Set default spellchecker dictionary to English (USA),
19555 and localize it according to locale with our custom branding extension.
19556 - Disable the add-ons automatic update feature.
19557 - Make the generated profile world-readable.
19558 - Remove NoScript click-to-play confirmation.
19559 - Sync some prefs set by Torbutton, to be ready when it stops setting these.
19560 - Disable navigation timing.
19561 - Disable SPDY. It stores state and may have keepalive issues.
19562 - More aggressive iceweasel HTTP pipelining settings.
19563 - Enable WebGL (as click-to-play only).
19564 - Disable network.http.connection-retry-timeout.
19565 - Disable full path information for plugins.
19566 - Remove NoScript blocks of WebFonts.
19567 - Disable DOM storage in Torbutton.
19568 Since we don't apply the 0026-Isolate-DOM-storage-to-first-party-URI.patch
19569 Torbrowser patch yet, and still disable DOM storage, we need to tell
19570 Torbutton not to use it.
19571 - Synchronize iceweasel's general.useragent.override with TBB based on FF17.
19572 The User-Agent settings are not kept up-to-date anymore in Torbutton, so
19573 we have to keep in sync manually with TBB's settings.
19574 - Remove obsolete APT pining for Torbutton.
19575 It's not maintained in Debian anymore, so we now fetch it from our own
19577 - Fetch FoxyProxy from Debian experimental and libnspr4-0d from
19578 squeeze-backports, for compatibility with Iceweasel 17.
19579 - Rebase bookmarks file on top of the default iceweasel 17 one.
19580 - Explicitly disable AdBlock Plus "correct typos" feature.
19581 This feature connects to http://urlfixer.org/.
19582 It is disabled by default in 2.2-1, but let's be careful.
19584 * Minor improvements
19585 - Upgrade to live-boot 3.0~b11-1 and live-config 3.0.12-1.
19586 Accordingly update the 9980-permissions hook, live-persist,
19587 unsafe-browser and boot-profile.
19588 Add compatibility symlinks from /live to /lib/live, and from /live/image
19589 to /lib/live/mount/medium, to ease the transition.
19590 - Check for errors when sourcing live-boot files, e.g. to detect when
19591 they have been renamed upstream.
19592 - Don't add "quiet" to the kernel command-line ourselves.
19593 Else, it appears twice as live-build's lb_binary_syslinux adds it too.
19594 Historically, we've been adding it ourselves on top of that because
19595 lb_binary_yaboot does not add it, but since we gave up the PowerPC support
19596 attempt, we're now only interested in syslinux, so let's make it easier
19597 for the general case, e.g. when one wants to remove the "quiet" parameter
19598 as suggested by our "Tails does not start" debugging documentation.
19599 - Upgrade I2P to 0.9.4.
19602 - Many bugfixes brought by the Debian Squeeze 6.0.7 point-release.
19603 - Use the regular GnuPG agent + pinentry-gtk2 instead of Seahorse
19604 as a GnuPG agent. This fixes usage of OpenPGP in Claws Mail,
19605 and brings support for OpenPGP smartcards.
19606 - Enable I2P hidden mode.
19607 Else, killing I2P ungracefully is bad for the I2P network.
19608 - live-persist: move error() function before the first potential usecase.
19609 - Add missing executable bit on restart-tor and restart-vidalia.
19610 - Add shutdown and reboot launchers to the menu.
19611 This workarounds the lack of a shutdown helper applet in camouflage mode.
19612 - Remove Pidgin's MXit and Sametime support.
19613 ... at least until CVE-2013-0273, CVE-2013-0272 and CVE-2013-0271 are
19614 fixed in Debian stable. While we're at it, don't force file removal in
19615 these "set -e" build scripts: fail hard, instead of silently ignoring
19616 the fact that files may have moved or disappeared.
19619 - Install recent Intel and AMD microcode from squeeze-backports,
19620 explicitly excluding the iucode-tool package that's not a good idea
19622 - Install firmware loader for Qualcomm Gobi USB chipsets.
19623 This is needed to have various mobile broadband chipsets work.
19624 - Upgrade barry to 0.18.3-5~bpo60+1.
19625 This much improved new version supports more hardware & ISP,
19626 and does not display dozens of spurious error messages at boot time.
19629 - Remove APT local cache (/Var/cache/apt/{,src}pkgcache.bin).
19631 -- Tails developers <amnesia@boum.org> Sat, 23 Feb 2013 10:37:57 +0100
19633 tails (0.16) unstable; urgency=low
19635 * Minor improvements
19636 - Replace the too-easy-to-misclick shutdown button with a better
19637 "Shutdown Helper" Gnome applet.
19638 - Display ~/Persistent in GNOME Places and GtkFileChooser if it is mounted.
19639 - Set Unsafe Browser's window title to "Unsafe Browser".
19640 - Install ekeyd to support the EntropyKey.
19641 - Install font for Sinhala.
19642 - Update Poedit to 1.5.4.
19643 - Kill Vidalia when restarting Tor.
19644 Doing this as early as possible exposes Vidalia's "broken onion" icon
19646 - Hide the persistence setup launchers in kiosk mode.
19647 - Add a shell library for Tor functions.
19648 These are shared among multiple of our scripts.
19649 - Install dictionaries for supported languages.
19650 Install hunspell dictionaries when possible,
19651 fall back on myspell ones else.
19654 - Disable IPv6 on all network interfaces.
19655 This is a workaround for the IPv6 link-local multicast leak that was recently
19656 discovered. Tails has no local service that listens on IPv6, so there should be
19657 no regression, hopefully, unless one wants to play with OnionCat and VoIP,
19658 but those of us should know how to workaround this anyway.
19659 - live-persist: Fix variable mismatch, fixing probe white-list.
19660 Tails may previously have been able to list GPT partitions labelled
19661 "TailsData" on hard drives (!) as valid persistence volumes...
19662 - live-persist: Fix --media option when no devices are attached.
19663 Earlier, if it was set to e.g. 'removable-usb' and no USB storage was
19664 connected, $whitelistdev would be empty, which is interpreted like
19665 all devices are ok by the rest of the code.
19666 - Fix SCIM in the autostarted web browser: save IM environment variables
19667 to a file during Desktop session startup, and export them into the
19668 autostarted browser's environment.
19669 - Talk of DVD, not of CD, in the shutdown messages.
19670 - Make tordate work in bridge mode with an incorrect clock.
19671 When using a bridge Tor reports TLS cert lifetime errors (e.g. when
19672 the system clock is way off) with severity "info", but when no bridge
19673 is used the severity is "warn". tordate/20-time.sh depends on grepping
19674 these error messages, so we termporarily increase Tor's logging
19675 severity when using bridge mode. If we don't do this tordate will
19676 sleep forever, leaving Tor in a non-working state.
19677 · White-list root to use Tor's ControlPort.
19678 · Add logging for is_clock_way_off().
19679 · Remove Tor's log before time syncing.
19680 We depend on grepping stuff from the Tor log (especially for
19681 tordate/20-time.sh), so deleting it seems like a Good Thing(TM).
19682 · Stop Tor before messing with its log or data dir.
19683 - live-persist: limit searched devices the same way as live-boot.
19684 If no --media argument is specified, use live-boot's
19685 "(live-media|bootfrom)=removable(|-usb)" argument to limit devices
19686 searched for a persistent volume.
19687 - tails-greeter: do not pass media=removable to live-persist.
19688 Now that we have autodetection with kernel command-line,
19689 it should not be needed anymore.
19690 - Start memlockd after configuring it,
19691 instead of starting it before and restarting it after.
19692 This avoids running memlockd twice, and prevents other possibly
19693 surprising race-conditions.
19694 As a consequence, also have tails-sdmem-on-media-removal start after the
19695 memlockd service *and* tails-reconfigure-memlockd: to start the watchdog,
19696 we need memlockd to be properly configured *and* running.
19699 - Set iceweasel homepage to the news section on the Tails website.
19700 ... using the localized one when possible.
19701 - Hide the iceweasel add-on bar by default.
19702 Now that we don't want to ship the Monkeysphere addon anymore,
19703 that was the only one displayed in there, we can as well hide the whole bar.
19704 - Don't hide the AdBlock-Plus button in the add-on bar anymore. Now that
19705 we hide the whole addon bar, we can get rid of this old
19707 - Do not install a placeholder (fake) FireGPG iceweasel extension anymore.
19708 It was shipped from 0.10 (early 2012) to 0.15 (late November),
19709 so the migration period should be over now.
19710 - Don't install xul-ext-monkeysphere anymore.
19711 The implication of the current keyserver policy are not well
19712 understood, Monkeysphere is little used in Tails, and we're not sure
19713 anymore it would be our first bet for the web browser profile with no
19714 CA. Let's keep the various configuration bits (e.g. FoxyProxy,
19715 patching MSVA), though, so that advanced users who are used to have
19716 Monkeysphere in Tails just have to install the package.
19719 - Install the "standard" task with tasksel for better consistency in the
19720 Tails ISO images built in various environments.
19721 - Install p7zip-full. It's a dep by file-roller, but we explicily use it
19722 elsewhere, and it's better to be safe than sorry.
19723 - Remove pinning of libvpx0 to sid.
19724 This package is part of Squeeze, and not from testing/sid.
19725 We have been shipping the version from Squeeze for a while.
19726 - Remove config/chroot_local-packages/ from .gitignore.
19727 The documented way for "external" contributors to add custom packages
19728 is to put them in chroot_local-packages, and once we pull we import
19729 any such package into our APT repo and rewrite the
19730 history appropriately.
19731 Also, the ability to add packages in there and not see them in "git
19732 status" makes it very easy to build tainted ISO images with
19733 non-standard packages, which makes some of us fear can lead to hard to
19735 - Make it clearer what can and cannot be done in terms of local packages.
19737 -- Tails developers <amnesia@boum.org> Thu, 10 Jan 2013 12:47:42 +0100
19739 tails (0.15) unstable; urgency=low
19741 * Major new features
19742 - Persistence for browser bookmarks.
19743 - Support for obfsproxy bridges.
19745 * Minor improvements
19746 - Add the Hangul (Korean) Input Method Engine for SCIM.
19747 - Add vendor-specific dpkg origin information. This makes dpkg-vendor
19748 return correct information.
19749 - Install pcscd and libccid from squeeze-backports. This is needed to
19750 support, to some extent, some OpenPGP SmartCard readers.
19751 - Install HPIJS PPD files and the IJS driver (hpijs).
19752 This adds support for some printers, such as Xerox DocumentCenter400.
19753 - Optimize fonts display for LCD.
19754 - Update TrueCrypt to version 7.1a.
19757 - Do not use pdnsd anymore. It has been orphaned in Debian, has quite
19758 some bugs in there, and apparently Tor's DNSPort's own caching is
19760 - Remove useless iceweasel cookies exceptions. They are useless as
19761 per-session cookies are allowed.
19762 - Do not run setupcon on X. This call is only needed on the Linux
19763 console, no need to annoy the user with a weird "Press enter to
19764 activate this console" when the open a root shell in a GNOME
19766 - Allow the tails-iuk-get-target-file user to connect to the SOCKSPort
19767 dedicated for Tails-specific software.
19768 - Fix gpgApplet menu display in Windows camouflage mode.
19769 - Fix Tor reaching an inactive state if it's restarted in "bridge mode",
19770 e.g. during the time sync' process.
19773 - Update iceweasel to 10.0.11esr-1+tails1.
19774 - User profile is now generated at build time in order to support persistent
19776 - Update HTTPS Everywhere to version 3.0.4.
19777 - Update NoScript to version 2.6.
19778 - Fix bookmark to I2P router console.
19779 - Re-enable Monkeysphere extension to connect to the validation agent.
19782 - The Tails USB installer, tails-persistence-setup and tails-greeter
19783 are now translated into Bulgarian.
19784 - Update Chinese translation for tails-greeter.
19785 - Update Euskadi translation for WhisperBack.
19788 - Custom packages are now retrieved from Tails APT repository instead
19789 of bloating the Git repository.
19790 - Allow '~' in wiki filenames. This makes it possible to ship
19791 update-description files for release candidates.
19792 - Document how to create incremental update kit.
19793 - Handle release candidates when generating custom APT sources.
19794 - Remove pinning for xul-ext-adblock-plus.
19795 It is obsolete since we've added this package to our APT repository.
19797 -- Tails developers <amnesia@boum.org> Sun, 25 Nov 2012 12:59:17 +0100
19799 tails (0.14) unstable; urgency=low
19801 * Major new features
19802 - Enable Tor stream isolation; several new SocksPorts with
19803 appropriate Isolate* options have been added for different use
19804 cases (i.e. applications). All application's have been
19805 reconfigured to use these new SocksPorts, which should increase
19806 anonymity by making it more difficulte to correlate traffic from
19807 different applications or "online identities".
19808 - The web browser now has the anonymity enhancing patches from the
19809 TorBrowser applied.
19810 - gpgApplet can now handle public-key cryptography.
19811 - Install an additional, PAE-enabled kernel with NX-bit
19812 support. This kernel is auto-selected when the hardware supports
19814 * provide executable space protection, preventing certain types of
19815 buffer overflows from being exploitable.
19816 * enable more than 4 GiB of system memory.
19817 * make all processors/cores available, including their
19818 power-saving functionality.
19819 - Add a persistence preset for NetworkManager connections.
19821 * Minor improvements
19822 - On kexec reboot, make the boot quiet only if debug=wipemem was not
19824 - Update torproject.org's APT repo key.
19825 - Update the embedded Tails signing key.
19826 - Use symlinks instead of duplicating localized searchplugins.
19827 - Rewrite Tails firewall using ferm. Tails firewall was written in
19828 very unsophisticated iptables-save/restore format. As more feature
19829 creeped in, it started to be quite unreadable.
19830 - Optimize VirtualBox modules build at runtime to avoid installing the
19831 userspace utils N times.
19832 - Drop most of Vidalia's configuration. Our custom lines just caused
19833 trouble (with multiple SocksPorts) and the default works well.
19834 - Blacklist PC speaker module. On some computers, having the pcspkr
19835 module loaded means loud beeps at bootup, shutdown and when using
19836 the console. As it draws useless attention to Tails users, it is
19837 better to prevent Linux from loading it by default.
19838 - Remove all addons from the Unsafe Browser. No addons are essential
19839 for the Unsafe Browser's intent. If anything they will modify the
19840 network fingerprint compared to a normal Iceweasel install, which
19842 - Prevent some unwanted packages to be installed at all, rather than
19843 uninstalling them later. This should speed up the build a bit.
19844 - Add a symlink from /etc/live/config to /etc/live/config.d. This
19845 makes the system compatible with live-config 3.0.4-1, without
19846 breaking backward compatibility with various parts of the system
19847 that use the old path.
19848 - Do not run unecessary scripts during shutdown sequence, to make
19850 - Make live-persist deal with persistent ~/.gconf subdirs so that
19851 any options saved therein actually get persistent.
19852 - Prevent memlockd unload on shutdown, to make sure that all
19853 necessary tools for memory wiping are available when the new
19854 kernel has kexec'd.
19855 - Patch initscripts headers instead of fiddling with update-rc.d. We
19856 now let insserv figure out the correct ordering for the services
19857 during startup and shutdown, i.e. use dependency-based boot
19859 - Remove the last absolute path in our isolinux config, which makes
19860 it easier to migrate from isolinux to syslinux (just rename the
19861 directory), and hence might make it easier for 3rd party USB
19862 installers (like the Universal USB Installer) to support Tails.
19865 - Include `seq` in the ramdisk environment: it is used to wipe more
19866 memory. This fixes the long-standing bug about Tails not cleaning
19867 all memory on shutdown.
19868 - Fix Yelp crashing on internal links
19869 - Allow amnesia user to use Tor's TransPort. This firewall exception
19870 is necessary for applications that doesn't have in-built SOCKS
19871 support and cannot use torsocks. One such example is Claws Mail,
19872 which uses tsocks since torsocks makes it leak the hostname. This
19873 exception, together with Tor's automatic .onion mapping makes
19874 Claws Mail able to use hidden service mail providers again.
19875 - Force threads locking support in Python DBus binding. Without this
19876 liveusb-creator doesn't work with a PAE-enabled kernel.
19877 - Fix localized search plugins for 'es' and 'pt'
19878 - Fix live-boot's readahead, which caused an unnecessary pause
19880 - Factorize GCC wanted / available version numbers in VirtualBox
19881 modules building hook. This, incidentally, fixes a bug caused by
19882 duplication and not updating all instances.
19883 - Fix tordate vs. Tor 0.2.3.x. Since 0.2.3.x Tor doesn't download a
19884 consensus for clocks that are more than 30 days in the past or 2
19885 days in the future (see commits f4c1fa2 and 87622e4 in Tor's git
19886 repo). For such clock skews we set the time to the Tor authority's
19887 cert's valid-after date to ensure that a consensus can be
19891 - Update to version 0.2.3.24-rc-1~~squeeze+1, a new major
19892 version. It's not a stable release, but we have been assured by
19893 the Tor developers that this is the right move.
19894 - Stop setting custom value for the Tor LongLivedPorts
19895 setting. Gobby's port was upstreamed in Tor 0.2.3.x.
19898 - Update to 10.0.10esr-1+tails1, which has all the anonymity enhancing
19899 patches from the TorBrowser applied.
19900 - Install iceweasel from our own repo, http://deb.tails.boum.org.
19901 - Fix Iceweasel's file associations. No more should you be suggested
19902 to open a PDF in the GIMP.
19905 - Use curl instead of wget, and add a --proxy option passed through
19907 - Remove the --fullrequest option, we don't need it anymore.
19908 - Remove --dns-timeout option, we don't need it anymore.
19909 - Change --proxy handling to support Debian Squeeze's curl.
19910 - Clarify what happens if --proxy is not used.
19911 - Compute the median of the diffs more correctly.
19914 - Update Linux to 3.2.32-1.
19917 - Update vidalia to 0.2.20-1+tails1.
19918 - Update bundled WhisperBack package to 1.6.2:
19919 * Raise the socket library timeout to 120 seconds
19920 * Use smtplib's timeout parameter
19921 * Fix error output when calling send a 2nd time
19922 - Update liveusb-creator to 3.11.6-3.
19923 - Update i2p to 0.9.2.
19924 - Update tails-persistence-setup to 0.20-1, which should make it
19925 possible to install Tails on large (>= 32 GiB) USB drives.
19926 - Install console-setup and keyboard-configuration from unstable
19927 (required by new initramfs-tools).
19928 - Update tails-greeter to 0.7.3:
19929 * Import pt_BR translation.
19930 * Let langpanel usable during option selection stage
19931 * Print less debugging messages by default
19932 (below are changes in tails-greeter 0.7.2:)
19933 * Use correct test operators.
19934 * Generate language codes of available locales at package build
19936 * Read list of language codes from where we have saved it at
19937 package build time.
19938 * Drop tails-lang-helper, not used anymore.
19939 * Do not compile locales at login time anymore. Tails now ships
19941 - Import live-config{,-sysvinit} 3.0.8-1. live-config >= 3.0.9-1
19942 has basically nothing useful for us, and it migrates to new paths
19943 brought by live-boot 3.0~b7, which we're not ready for yet (see:
19944 todo/newer_live-boot).
19947 - Fix Tails specific Iceweasel localization for pt-BR
19948 - Add Japanese input system: scim-anthy.
19949 - whisperback is now also translated into German, Hebrew, Hungarian,
19950 Italian and Korean.
19951 - tails-persistence-setup is now also translated into Arabic.
19952 - tails-greeter is now also translated into Arabic, Hebrew, Basque,
19953 Hungarian, Italian and Chinese.
19956 - Catch more errors in during build time:
19957 - Ensure that all local hooks start with 'set -e'.
19958 - Fail hard if adduser fails in local hooks.
19959 - Fail hard if 'rm' fails in local hooks.
19960 - vagrant: Ensure we have the set of Perl packages needed by our
19962 - vagrant: Configure live-build to ship with ftp.us.debian.org.
19963 Using cdn.debian.net leads to bad interactions with Tor.
19964 - vagrant: Don't use gzip compression when building from a tag, i.e.
19966 - vagrant: Optionally use bootstrap stage cache for faster builds
19967 via the 'cache' build option.
19968 - vagrant: Make sure release builds are clean, i.e. they don't use
19969 any potentially dangerous build options.
19970 - vagrant: Disable live-build package caching. This build system is
19971 meant to use an external caching proxy, so live-build's cache just
19972 wastes RAM (for in-memory builds) or disk space.
19973 - vagrant: use aufs magic instead of copying source into tmpfs.
19974 This reduces the amount of RAM required for building Tails in.
19975 - vagrant: Allow in-memory builds when a VM with enough memory is
19978 -- Tails developers <amnesia@boum.org> Sat, 10 Nov 2012 12:34:56 +0000
19980 tails (0.13) unstable; urgency=low
19982 * Major new features
19983 - Use white-list/principle of least privelege approach for local services.
19984 Only users that need a certain local (i.e. hosted on loopback) service
19985 (according to our use cases) are granted access to it by our firewall;
19986 all other users are denied access.
19987 - Ship a first version of the incremental update system. Updates are not
19988 currently triggered automatically, but this will allow tests to be done
19991 * Minor improvements
19992 - Enable four workspaces in the Windows XP camouflage. This allows
19993 users to quickly switch to a more innocent looking workspace in case
19994 they are working on sensitive data and attract unwanted attention.
19995 The workspace switcher applet isn't there, though, since there's no
19996 such thing in Windows XP, so switching is only possible via keyboard
19998 - Ship with precompiled locales instead of generating them upon login.
19999 - Add support for wireless regulation.
20000 - Use color for Git output, not intended for machine consumption,
20001 written to the terminal.
20002 - Have ttdnsd use OpenDNS. Using Google's DNS servers was very
20003 glitchy, and rarely succeeded when it should. It can probably be
20004 attributed to Google's DNS, which is known to take issue with Tor
20006 - Upgrade WhisperBack to 1.6, with many UI improvements and new translations.
20007 - Include GDM logs and dmidecode informations in the reports.
20008 - Allow to modify language and layout in the "Advanced options" screen
20010 - GnuPG: bump cert-digest-algo to SHA512.
20011 - Update torproject.org's APT repo key.
20014 - Make Claws Mail save local/POP emails in its dot-directory. The
20015 default is to save them at ~/Mail, which isn't included in our
20016 current Claws Mail persistence preset.
20017 - Fix the System Monitor applet.
20018 - Remove broken ttdnsd from the default DNS resolution loop.
20019 - Hide the 'TailsData' partition in desktop applications.
20020 - Ship unrar-free again, so that the GNOME archive manager knows about
20022 - Ship with an empty whitelist for Noscript.
20023 - Disable FoxyProxy's advertisement on proxy error page.
20024 - Fix slow browsing experience for offline documentation.
20025 - Raise the socket timeout to 120 seconds in WhisperBack.
20026 - Enable the ikiwiki trail plugin for the locally built wiki too.
20029 - Upgrade iceweasel to 10.0.6esr-1 (Extended Support Release) and install it
20030 and its dependencies from squeeze-backports.
20033 - Upgrade Linux to 3.2.23-1.
20036 - Update tor to version 0.2.2.39.
20037 - Update Iceweasel to version 10.0.7esr-2.
20038 - Update i2p to version 0.9.1.
20041 - vagrant: Install Ikiwiki from Debian unstable. The 'mirrorlist'
20042 patches have finally been merged in upstream Ikiwiki. So instead of
20043 building Ikiwiki by hand, we can now install the package directly
20044 from Debian unstable.
20045 - Do not build the ikiwiki forum on the bundled static website copy.
20047 -- Tails developers <amnesia@boum.org> Mon, 17 Sep 2012 15:19:25 +0200
20049 tails (0.12.1) unstable; urgency=low
20051 This is a brown paper bag release to fix two major problems introduced in
20055 - Upgrade Torbutton to 1.4.6.
20056 - Upgrade AdBlock Plus to 2.1.
20057 - Update AdBlock Plus patterns.
20060 - Upgrade Linux to 3.2.21-3 (linux-image-3.2.0-3-486).
20063 - Install MAT from Debian backports, drop custom package.
20064 - Install python-pdfrw to re-add PDF support to the MAT.
20065 - Upgrade tails-greeter to 0.7.1, which fixes the race condition that
20066 broke administration password and locale settings on some systems.
20069 - Remove the Tails specific plymouth theme. The theme interfers heavily with
20070 the boot process on some hardware.
20072 -- Tails developers <amnesia@boum.org> Mon, 17 Sep 2012 13:06:03 +0200
20074 tails (0.12) unstable; urgency=low
20076 * Major new features
20077 - Add the Unsafe Web Browser, which has direct access to the Internet and
20078 can be used to login to captive portals.
20079 - The (previously experimental, now deemed stable) Windows camouflage can now
20080 be enabled via a check box in Tails greeter.
20083 - Upgrade to 0.2.2.37-1~~squeeze+1.
20086 - Upgrade iceweasel to 10.0.5esr-1 (Extended Support Release) and install it
20087 and its dependencies from squeeze-backports.
20088 - Add a bookmark for the offline Tails documentation.
20089 - Update AdBlock patterns.
20092 - Allow using larger USB drives by increasing the mkfs timeout to 10 minutes.
20093 - Tell the user what's going on when the Tails boot device cannot be found.
20096 - Upgrade Linux to 3.2.20-1 (linux-image-3.2.0-2-amd64).
20100 - Install torsocks. Note that this makes `torify' use `torsocks' instead of
20101 `tsocks'. The `tsocks' binary is dropped to avoid problems, but remaining
20102 files (the library) are kept since ttdnsd depends on them.
20103 - Fetch live-config-sysvinit from sid so that it matches live-config version.
20104 - Update virtualbox backports to 4.1.10-dfsg-1~bpo60+1.
20105 - Install pciutils (needed by virtualbox-guest-utils).
20106 - Install mousetweaks. This is needed to use the mouse accessibility settings
20107 in System -> Preferences -> Mouse -> Accessibility.
20108 - Install the "hardlink" files deduplicator.
20109 - Do not install cryptkeeper anymore. See todo/remove_cryptkeeper for reason.
20110 Users of cryptkeeper are encouraged to install cryptkeeper via `apt-get
20111 update; apt-get install --yes cryptkeeper`, open their volume and move
20112 their to Tails' built-in persistence instead, as a one-time migration.
20113 - Upgrade I2P to version 0.9.
20114 - Don't install GParted. GNOME Disk Utility has been on par with GParted
20115 since Squeeze was released.
20116 - Upgrade live-boot to 3.0~a27-1+tails2~1.gbp319fe6.
20117 - Upgrade live-config to 3.0~a39-1 and install it from Debian experimental.
20118 - Upgrade tails-greeter to 0.7.
20119 - Upgrade tails-persistence-setup to 0.17-1.
20120 - Install libyaml-libyaml-perl.
20121 - Upgrade MAT, the metadata anonymisation toolkit, 0.3.2-1~bpo60+1.
20122 - Fetch python-pdfrw from backports, drop custom package.
20124 * Internationalization
20125 - The Tails website and documentation now has a (partial) Portuguese
20129 - Tails can now be built without using a HTTP proxy.
20130 - Tails can now easily be built by using Vagrant. See the updated
20131 contribute/build page for instructions.
20134 - Remove obsolete noswap boot parameter. live-boot now handles swap on an
20136 - The squashfs.sort files generated with boot-profile should now be ok which
20137 makes the generate images boot noticeably faster on optical media. See
20138 bugs/weird_squashfs.sort_entries for more information.
20139 - Set Tails specific syslinux and plymouth themes.
20140 - Add NVidia KMS video drivers to the initrd in order to show our shiny new
20141 plymouth theme on more systems.
20143 -- Tails developers <amnesia@boum.org> Mon, 11 Jun 2012 13:37:00 +0200
20145 tails (0.11) unstable; urgency=low
20147 * Major new features
20148 - Do not grant the desktop user root credentials by default.
20149 - A graphical boot menu (tails-greeter 0.6.3) allows choosing among
20150 many languages, and setting an optional sudoer password.
20151 - Support opt-in targeted persistence
20152 · tails-persistence-setup 0.14-1
20153 · live-boot 3.0~a25-1+tails1~5.gbp48d06c
20154 · live-config 3.0~a35-1
20155 - USB installer: liveusb-creator 3.11.6-1
20158 - Install iceweasel 10.0.4esr-1 (Extended Support Release).
20159 Let's stop tracking a too fast moving target.
20160 Debian Wheezy will ship ESR versions.
20161 - Install needed dependencies from squeeze-backports.
20164 bing appeared due to our upgrading iceweasel.
20165 Removing it makes things consistent with the way they have been
20166 until now, that is: let's keep only the general search engines
20167 we've been asked to add, plus Google, and a few specialized ones.
20168 · Replace Debian-provided DuckDuckGo search plugin with the "HTML SSL"
20169 one, version 20110219. This is the non-JavaScript, SSL, POST flavour.
20171 · Install localized search engines in the correct place.
20172 No need to copy them around at boot time anymore.
20173 · Remove Scroogle. RIP.
20174 - Enable TLS false start, like the TBB does since December.
20175 - Adblock Plus: don't count and save filter hits, supress first run dialog.
20176 - Install neither the GreaseMonkey add-on, nor any GreaseMonkey script.
20177 YouTube's HTML5 opt-in program is over.
20178 HTML5 video support is now autodetected and used.
20181 - Upgrade to 0.2.17-1+tails1: drop Do-not-warn-about-Tor-version.patch,
20183 - Set SkipVersionCheck=true.
20184 Thanks to chiiph for implementing this upstream (needs Vidalia 0.2.16+).
20186 * Internationalization
20187 - Install all available iceweasel l10n packages.
20188 - Remove syslinux language choosing menu.
20189 tails-greeter allows choosing a non-English language.
20190 - Add fonts for Hebrew, Thai, Khmer, Lao and Korean languages.
20191 - Add bidi support.
20192 - Setup text console at profile time.
20193 Context: Tails runs with text console autologin on.
20194 These consoles now wait, using a "Press enter to activate this console"
20195 message, for the user. When they press enter in there, they should have chosen
20196 their preferred keyboard layout in tails-greeter by now. Then, we run setupcon.
20197 As a result, the resulting shell is properly localized, and setupcon
20198 sets the correct keyboard layout, both according to the preferences expressed by
20199 the user in tails-greeter.
20200 - Don't use localepurge, don't remove any Scribus translations anymore,
20201 don't localize environment at live-config time:
20202 tails-greeter allows us to support many, many more languages.
20205 - Linux 3.2.15-1 (linux-image-3.2.0-2-amd64).
20206 - Fix low sound level on MacBook5,2.
20207 - Disable laptop-mode-tools automatic modules. This modules set often
20208 needs some amount of hardware-specific tweaking to work properly.
20209 This makes them rather not well suited for a Live system.
20212 - Install GNOME keyring.
20213 This is needed so that NetworkManager remembers the WEP/WPA secrets
20214 for the time of a Tails session. Initialize GNOME keyring at user
20216 - Install usbutils to have the lsusb command.
20217 - Install the Traverso multitrack audio recorder and editor.
20220 - GNOME Terminal: keep 8192 scrollback lines instead of the smallish
20222 - Replaced tails-wifi initscript with laptop-mode-tools matching feature.
20223 - Disable gdomap service.
20224 - Fetch klibc-utils and libklibc from sid.
20225 The last initramfs-tools depends on these.
20226 - Set root password to "root" if debug=root is passed on the
20227 kernel cmdline. Allow setting root password on kernel cmdline via
20228 rootpw=. Looks like we implemented this feature twice.
20229 - Append a space on the kernel command line. This eases manually adding
20231 - Rename sudoers.d snippets to match naming scheme.
20232 Sudo credentials that shall be unconditionally granted to the Tails
20233 default user are named zzz_*, to make sure they are applied.
20234 - WhisperBack: also include /var/log/live-persist and
20235 /var/lib/gdm3/tails.persistence.
20236 - Add a wrapper to torify whois.
20237 - Rework the VirtualBox guest modules building hook to support
20239 - Consistently wait for nm-applet when waiting for user session to come up.
20240 Waiting for gnome-panel or notification-daemon worked worse.
20241 - Don't start the NetworkManager system service via init.
20242 Some Tails NM hooks need the user to be logged in to run properly.
20243 That's why tails-greeter starts NetworkManager at PostLogin time.
20244 - Also lock /bin/echo into memory. For some reason, kexec-load needs it.
20245 - Pidgin: don't use the OFTC hidden service anymore.
20246 It proved to be quite unreliable, being sometimes down for days.
20247 - Do not display storage volumes on Desktop, by disabling
20248 /apps/nautilus/desktop/volumes_visible GConf entry. Enabling that
20249 GConf setting avoids displaying the bind-mounted persistent
20250 directories on the Desktop, and reduces user confusion. It also is
20251 a first step towards a bigger UI change: GNOME3 does not manage the
20252 Desktop anymore, so volume icons and other Desktop icons are meant to
20253 disappear anyway. It implies we'll have to move all Desktop icons
20254 elsewhere. Let's start this move now: this will smooth the UI change
20255 Wheezy will carry for our users, by applying some of it progressively.
20258 - Don't build hybrid ISO images anymore. They boot less reliably on
20259 a variety of hardware, and are made less useful by us shipping
20260 a USB installer from now on.
20261 - Append .conf to live-config configuration filenames:
20262 live-config >3.0~a36-1 only takes into account files named *.conf
20263 in there. Accordingly update scripts that source these files.
20264 - Remove long-obsolete home-refresh script and its configuration.
20266 * Virtualization support
20267 - Support Spice and QXL: install the Spice agent from Debian sid,
20268 install xserver-xorg-video-qxl from squeeze-backports.
20270 -- Tails developers <amnesia@boum.org> Tue, 17 Apr 2012 14:54:00 +0200
20272 tails (0.10.2) unstable; urgency=low
20275 - Update to 10.0.2-1.
20276 - Disable HTTPS-Everywhere's SSL Observatory (plus first-run pop-up).
20277 - Revert "FoxyProxy: don't enclose regexps between ^ and $."
20278 Currently "http://www.i2p2.de" (and everything similar) is captured by
20279 the I2P filter, which is incorrect. It seems isMultiLine="false" does
20280 *not* make RE into ^RE$ any longer.
20281 - Remove file:// from NoScript's exception lists.
20282 This will fix the JavaScript toggles in the local copy of the documentation.
20283 - Update AdBlock patterns.
20286 - Upgrade I2P to 0.8.13.
20287 - Install libvpx0 from sid.
20288 - Fetch klibc-utils and libklibc from sid.
20289 The last initramfs-tools depends on these.
20292 - Upgrade Linux kernel to 3.2.7-1.
20293 - Install firmware-libertas.
20294 This adds support for wireless network cards with Marvell Libertas
20295 8xxx chips supported by the libertas_cs, libertas_sdio, libertas_spi,
20296 libertas_tf_usb, mwl8k and usb8xxx drivers.
20299 - Revert "Set time to middle of [valid-after, fresh-until] from consensus."
20300 This reverts commit 18d23a500b9412b4b0fbe4e38a9398eb1a3eadef.
20301 With this vmid clocks that are E minutes back in time may cause issues
20302 (temporary Tor outages) after consensus updates that happen at the
20303 (60-E):th minute or later during any hour. Full analysis:
20304 https://mailman.boum.org/pipermail/tails-dev/2012-January/000873.html
20305 - Add the default user to the vboxsf group.
20306 This will allow the user to get full access to automounted VirtualBox
20307 shared folders as they are mounted with guid vboxsf and rwx group
20310 -- Tails developers <amnesia@boum.org> Thu, 01 Mar 2012 20:26:21 +0100
20312 tails (0.10.1) unstable; urgency=low
20315 - Make Startpage the default web search engine. Scroogle does not look
20316 reliable enough these days.
20319 - Upgrade WhisperBack to 1.5.1 (update link to bug reporting documentation).
20320 - Update MAT to 0.2.2-2~bpo60+1 (fixes a critical bug in the GUI).
20323 - Upgrade Linux kernel to 3.2.1-2
20325 * Time synchronization
20326 Serious rework that should fix most, if not all, of the infamous
20327 time-sync' related bugs some Tails users have experienced recently.
20328 - Make htpdate more resilient by using three server pools, and
20329 allowing some failure ratio.
20330 - Set time from Tor's unverified-consensus if needed.
20331 - Set time to middle of [valid-after, fresh-until] from consensus.
20332 - Many robustness, performance and fingerprinting-resistance improvements.
20333 - Display time-sync' notification much earlier.
20336 - Fix access to "dumb" git:// protocol by using a connect-socks wrapper
20337 as GIT_PROXY_COMMAND.
20338 - SSH client: fix access to SSH servers on the Internet by correcting
20339 Host / ProxyCommand usage.
20340 - Pidgin: use OFTC hidden service to workaround Tor blocking.
20341 - Claws Mail: disable draft autosaving.
20342 When composing PGP encrypted email, drafts are saved back to
20343 the server in plaintext. This includes both autosaved and manually
20345 - tails-security-check-wrapper: avoid eating all memory when offline.
20347 -- Tails developers <amnesia@boum.org> Sat, 28 Jan 2012 10:00:31 +0100
20349 tails (0.10) unstable; urgency=low
20351 * Tor: upgrade to 0.2.2.35-1.
20354 - Install Iceweasel 9.0 from the Debian Mozilla team's APT repository.
20355 - Update Torbutton to 1.4.5.1-1.
20356 - Support viewing any YouTube video that is available in HTML5 format:
20357 install xul-ext-greasemonkey and the "Permanently Enable HTML5 on
20358 YouTube" GreaseMonkey script.
20359 - Stop using Polipo in Iceweasel. Its SOCKS support was fixed.
20360 - Install from Debian sid the iceweasel extensions we ship,
20361 for compatibility with FF9.
20362 - Use Scroogle (any languages) instead of Scroogle (English only) when
20363 booted in English. Many users choose English because their own
20364 language is not supported yet; let's not hide them search results in
20365 their own language.
20366 - Install Iceweasel language packs from Debian unstable:
20367 unfortunately they are not shipped on the mozilla.debian.net repository.
20368 - Install the NoScript Firefox extension; configure it the same way as
20370 - Disable third-party cookies.
20371 They can be used to track users, which is bad. Besides, this is what
20372 TBB has been doing for years.
20373 - FoxyProxy: allow direct connections to RFC1918 IPs.
20375 * Do not transparent proxy outgoing Internet connections through Tor.
20376 - Torify the SSH client using connect-proxy to all IPs but RFC1918 ones.
20377 - Torify APT using Polipo HTTP.
20378 - Torify wget in wgetrc.
20379 - Torify gobby clients using torsocks. It does not support proxies yet.
20380 - Torify tails-security-check using LWP::UserAgent's SOCKS proxy support.
20381 - Fix enabling of GNOME's HTTP proxy.
20384 - Upgrade Vidalia to 0.2.15-1+tails1.
20385 · New upstream release.
20386 · Do not warn about Tor version.
20387 - Upgrade MAT to 0.2.2-1~bpo60+1.
20388 - Upgrade VirtualBox guest software to 4.1.6-dfsg-2~bpo60+1,
20389 built against the ABI of X.Org backports.
20390 - Upgrade I2P to 0.8.11 using KillYourTV's Squeeze packages;
20391 additionally, fix its start script that was broken by the tordate merge.
20392 - Install unar (The Unarchiver) instead of the non-free unrar.
20393 - Install Nautilus Wipe instead of custom Nautilus scripts.
20396 - Upgrade Linux kernel to 3.1.6-1.
20397 - Upgrade to X.Org from squeeze-backports.
20398 - Install more, and more recent b43 firmwares.
20399 - Upgrade barry to 0.15-1.2~bpo60+1.
20401 * Internationalization
20402 - Add basic language support for Russian, Farsi and Vietnamese.
20403 - Install some Indic fonts.
20404 - Install some Russian fonts.
20405 - Add Alt+Shift shortcut to switch keyboard layout.
20408 - Support booting in "Windows XP -like camouflage mode":
20409 · Install homebrewn local .debs for a Windows XP look-alike Gnome theme.
20410 · Add the "Windows XP Bliss" desktop wallpaper.
20411 · Added a script that's sets up Gnome to look like Microsoft Windows XP.
20412 · Add Windows XP "camouflage" icons for some programs.
20413 · Make Iceweasel use the IE icon when Windows XP camouflage is enabled.
20414 · Add special launcher icons for the Windows XP theme so that they're
20416 - Decrease Florence focus zoom to 1.2.
20417 - Do not fetch APT translation files. Running apt-get update is heavy enough.
20418 - Add MSN support thanks to msn-pecan.
20419 - Add custom SSH client configuration:
20420 · Prefer strong ciphers and MACs.
20421 · Enable maximum compression level.
20422 · Explicitly disable X11 forwarding.
20423 · Connect as root by default, to prevent fingerprinting when username
20425 - Replace flawed FireGPG with a home-made GnuPG encryption applet;
20426 install a feature-stripped FireGPG that redirects users to
20427 the documentation, and don't run Seahorse applet anymore.
20428 - Enable Seahorse's GnuPG agent.
20429 - Blank screen when lid is closed, rather than shutting down the system.
20430 The shutdown "feature" has caused data losses for too many people, it seems.
20431 There are many other ways a Tails system can be shut down in a hurry
20433 - Import Tails signing key into the keyring.
20434 - Fix bug in the Pidgin nick generation that resulted in the nick
20435 "XXX_NICK_XXX" once out of twenty.
20436 - Pre-configure the #tor IRC discussion channel in Pidgin.
20437 - Fix "technology preview" of bridge support: it was broken by tordate merge.
20438 - Install dependencies of our USB installer to ease its development.
20439 - Make vidalia NM hook sleep only if Vidalia is already running.
20440 - Reintroduce the htpdate notification, telling users when it's safe
20441 to use Tor Hidden Services.
20442 - htpdate: omit -f argument to not download full pages.
20443 - htpdate: write success file even when not within {min,max}adjust.
20444 Otherwise htpdate will not "succeed" when the time diff is 0 (i.e.
20445 the clock was already correct) so the success file cannot be used
20446 as an indicator that the system time now is correct, which arguably
20447 is its most important purpose.
20450 - Name built images according to git tag.
20452 -- Tails developers <tails@boum.org> Wed, 04 Jan 2012 09:56:38 +0100
20454 tails (0.9) unstable; urgency=low
20457 - Upgrade to 0.2.2.34 (fixes CVE-2011-2768, CVE-2011-2769).
20460 - Upgrade to 3.5.16-11 (fixes CVE-2011-3647, CVE-2011-3648, CVE-2011-3650).
20461 - Upgrade FireGPG to 0.8-1+tails2: notify users that the FireGPG Text
20462 Editor is the only safe place for performing cryptographic operations,
20463 and make it impossible to do otherwise. Other ways open up several
20464 severe attacks through JavaScript (e.g. leaking plaintext when
20465 decrypting, signing messages written by the attacker).
20466 - Install Cookie Monster extension instead of CS Lite.
20467 - Always ask where to save files.
20468 - Upgrade Torbutton to 1.4.4.1-1, which includes support for the in-browser
20469 "New identity" feature.
20472 - Install MAT, the metadata anonymisation toolkit.
20473 - Upgrade TrueCrypt to 7.1.
20474 - Upgrade WhisperBack to 1.5~rc1 (leads the user by the hand if an error
20475 occurs while sending the bugreport, proposes to save it after 2 faild
20476 attempts, numerous bugfixes).
20477 - Linux: upgrade to linux-image-3.0.0-2-486 (version 3.0.0-6); fixes
20478 a great number of bugs and security issues.
20481 - Fully rework date and time setting system.
20482 - Remove the htp user firewall exception.
20483 - Saner keyboard layouts for Arabic and Russian.
20484 - Use Plymouth text-only splash screen at boot time.
20485 - Color the init scripts output.
20486 - Suppress Tor's warning about applications doing their own DNS lookups.
20487 This is totally safe due to our Tor enforcement.
20488 - Disable hdparm boot-time service.
20489 We only want hdparm so that laptop-mode-tools can use it.
20490 - Run Claws Mail using torify.
20491 It's not as good as if Claws Mail supported SOCKS proxies itself,
20492 but still better than relying on the transparent netfilter torification.
20493 - Install HPLIP and hpcups for better printing support.
20495 * Erase memory at shutdown
20496 - Run many sdmem instances at once.
20497 In hope of erasing more memory until we come up with a proper fix for
20498 [[bugs/sdmem_does_not_clear_all_memory]].
20499 - Kill gdm3 instead of using its initscript on brutal shutdown.
20500 - Use absolute path to eject for more robust memory wipe on boot medium removal.
20503 - Exclude kernel and initramfs from being put into the SquashFS.
20504 Those files are already shipped where they are needed, that is in the ISO
20505 filesystem. Adapt kexec and memlockd bits.
20506 - Do not ship the GNOME icon theme cache.
20507 - Do not ship .pyc files.
20508 - Do not ship NEWS.Debian.gz files.
20511 - Re-implement hook that modifies syslinux config to make future
20512 development easier.
20514 -- Tails developers <amnesia@boum.org> Tue, 01 Nov 2011 13:26:38 +0100
20516 tails (0.8.1) unstable; urgency=low
20519 - Update to 3.5.16-10 (fixes DSA-2313-1).
20520 - FireGPG: force crypto action results to appear in a new window, otherwise
20521 JavaScript can steal decrypted plaintext. Advice: always use FireGPG's
20522 text editor when writing text you want to encrypt. If you write it in a
20523 textbox the plaintext can be stolen through JavaScript before it is
20524 encrypted in the same way.
20525 - Update HTTPS Everywhere extension to 1.0.3-1.
20526 - Stop using the small version of the Tor check page. The small version
20527 incorrectly tells Tails users to upgrade their Torbrowser, which has
20528 confused some users.
20531 - Update Linux to 3.0.0-2 (fixes DSA-2310-1, CVE-2011-2905, CVE-2011-2909,
20532 CVE-2011-2723, CVE-2011-2699, CVE-2011-1162, CVE-2011-1161).
20533 - Update usb-modeswitch to 1.1.9-2~bpo60+1 and usb-modeswitch-data to
20534 20110805-1~bpo60+1 from Debian backports. This adds support for a few
20535 devices such as Pantech UMW190 CDMA modem.
20536 - Install libregexp-common-perl 2011041701-3 from Debian unstable. This
20537 fixes the bug: [[bugs/msva_does_not_use_configured_keyserver]].
20538 - Install hdparm so the hard drives can be spinned down in order to save
20540 - Install barry-util for better BlackBerry integration.
20541 - Debian security upgrades: OpenOffice.org (DSA-2315-1), openjdk-6
20542 (DSA-2311-1), policykit-1 (DSA-2319-1)
20544 * Protecting against memory recovery
20545 - Set more appropriate Linux VM config before wiping memory. These
20546 parameters should make the wipe process more robust and efficient.
20548 -- Tails developers <amnesia@boum.org> Sun, 16 Oct 2011 11:31:18 +0200
20550 tails (0.8) unstable; urgency=low
20552 * Rebase on the Debian Squeeze 6.0.2.1 point-release.
20555 - Update to 0.2.2.33-1.
20556 - Disabled ControlPort in favour of ControlSocket.
20557 - Add port 6523 (Gobby) to Tor's LongLivedPorts list.
20561 - Start script now depends on HTP since I2P breaks if the clock jumps or is
20562 too skewed during bootstrap.
20565 - Update to 3.5.16-9 (fixes CVE-2011-2374, CVE-2011-2376, CVE-2011-2365,
20566 CVE-2011-2373, CVE-2011-2371, CVE-2011-0083, CVE-2011-2363, CVE-2011-0085,
20567 CVE-2011-2362, CVE-2011-2982, CVE-2011-2981, CVE-2011-2378, CVE-2011-2984,
20569 - Enable HTTP pipelining (like TBB).
20570 - Update HTTPS Everywhere extension to 1.0.1-1 from Debian unstable.
20571 - Suppress FoxyProxy update prompts.
20572 - Prevent FoxyProxy from "phoning home" after a detected upgrade.
20573 - Fixed a bunch of buggy regular expressions in FoxyProxy's configuration.
20574 See [[bugs/exploitable_typo_in_url_regex?]] for details. Note that none of
20575 these issues are critical due to the transparent proxy.
20576 - Add DuckDuckGo SSL search engine.
20579 - Update to torbutton 1.4.3-1 from Debian unstable.
20580 - Don't show Torbutton status in the status bar as it's now displayed in the
20584 - More random looking nicks in pidgin.
20585 - Add IRC account on chat.wikileaks.de:9999.
20588 - Upgrade htpdate script (taken from Git 7797fe9) that allows setting wget's
20589 --dns-timeout option.
20592 - Update Linux to 3.0.0-1. -686 is now deprecated in favour of -486 and
20593 -686-pae; the world is not ready for -pae yet, so we now ship -486.
20594 - Update OpenSSL to 0.9.8o-4squeeze2 (fixes CVE-2011-1945 (revoke
20595 compromised DigiNotar certificates), CVE-2011-1945).
20596 - Update Vidalia to 0.2.14-1+tails1 custom package.
20597 - Install accessibility tools:
20598 - gnome-mag: screen magnifier
20599 - gnome-orca: text-to-speech
20600 - Replace the onBoard virtual keyboard with Florence.
20601 - Install the PiTIVi non-linear audio/video editor.
20606 * Arbitrary DNS queries
20607 - Tor can not handle all types of DNS queries, so if the Tor resolver fails
20608 we fallback to ttdnsd. This is now possible with Tor 0.2.2.x, since we
20609 fixed Tor bug #3369.
20612 - Install ipheth-utils for iPhone tethering.
20613 - Install xserver-xorg-input-vmmouse (for mouse integration with the host OS
20614 in VMWare and KVM).
20615 - Install virtualbox-ose 4.x guest packages from Debian backports.
20618 - Switch gpg to use keys.indymedia.org's hidden service, without SSL.
20619 The keys.indymedia.org SSL certificate is now self-signed. The hidden
20620 service gives a good enough way to authenticate the server and encrypts
20621 the connection, and just removes the certificates management issue.
20622 - The squashfs is now compressed using XZ which reduces the image size quite
20624 - Remove Windows autorun.bat and autorun.inf. These files did open a static
20625 copy of our website, which is not accessible any longer.
20628 - Use the Git branch instead of the Debian version into the built image's
20630 - Allow replacing efficient XZ compression with quicker gzip.
20631 - Build and install documentation into the chroot (-> filesystem.squashfs).
20632 Rationale: our static website cannot be copied to a FAT32 filesystem due
20633 to filenames being too long. This means the documentation cannot be
20634 browsed offline from outside Tails. However, our installer creates GPT
20635 hidden partitions, so the doc would not be browseable from outside Tails
20636 anyway. The only usecase we really break by doing so is browsing the
20637 documentation while running a non-Tails system, from a Tails CD.
20639 -- Tails developers <amnesia@boum.org> Thu, 09 Sep 2011 11:31:18 +0200
20641 tails (0.7.2) unstable; urgency=high
20644 - Disable Torbutton's external application launch warning.
20645 ... which advises using Tails. Tails *is* running Tails.
20646 - FoxyProxy: install from Debian instead of the older one we previously
20650 - haveged: install an official Debian backport instead of a custom backport.
20651 - unrar: install the version from Debian's non-free repository.
20652 Users report unrar-free does not work well enough.
20654 -- Tails developers <amnesia@boum.org> Sun, 12 Jun 2011 15:34:56 +0200
20656 tails (0.7.1) unstable; urgency=high
20658 * Vidalia: new 0.2.12-2+tails1 custom package.
20661 - Don't show Foxyproxy's status / icon in FF statusbar to prevent users
20662 from accidentaly / unconsciously put their anonymity at risk.
20663 - "amnesia branding" extension: bump Iceweasel compatibility to 4.0 to ease
20664 development of future releases.
20667 - Upgrade Linux kernel to Debian's 2.6.32-33: fixes tons of bugs,
20668 including the infamous missing mouse cursor one. Oh, and it closes
20669 a few security holes at well.
20670 - Install unrar-free.
20671 - Do not install pppoeconf (superseeded by NetworkManager).
20672 - Upgrade macchanger to Debian testing package to ease development of
20673 future Tails releases.
20674 - Debian security upgrades: x11-xserver-utils (DSA-2213-1), isc-dhcp
20675 (DSA-2216-1), libmodplug (DSA-2226-1), openjdk-6 (DSA-2224-1).
20677 * Protecting against memory recovery
20678 - Add Italian translation for tails-kexec. Thanks to Marco A. Calamari.
20679 - Make it clear what it may mean if the system does not power off
20681 - Use kexec's --reset-vga option that might fix display corruption issues
20684 * WhisperBack (encrypted bug reporting software)
20685 - Upgrade WhisperBack to 1.4.1:
20686 localizes the documentation wiki's URL,
20687 uses WebKit to display the bug reporting help page,
20688 now is usable on really small screens.
20689 - Extract wiki's supported languages at build time, save this
20690 information to /etc/amnesia/environment, source this file into the
20691 Live user's environment so that WhisperBack 1.4+ can make good use
20695 - Fix boot in Chinese.
20696 - Install mobile-broadband-provider-info for better 3G support.
20697 - Add back GNOME system icons to menus.
20698 - tails-security-check: avoid generating double-slashes in the Atom
20700 - Remove "vga=788" boot parameter which breaks the boot on some hardware.
20701 - Remove now useless "splash" boot parameter.
20702 - Fix a bunch of i386-isms.
20703 - Pass the noswap option to the kernel. This does not change actual Tails
20704 behaviour but prevents users from unnecessarily worrying because of
20705 the "Activating swap" boot message.
20706 - Make use of check.torproject.org's Arabic version.
20709 - Enable squeeze-backports. It is now ready and will be used soon.
20710 - Install eatmydata in the chroot.
20711 - Convert ikiwiki setup files to YAML.
20713 -- Tails developers <amnesia@boum.org> Fri, 29 Apr 2011 17:14:53 +0200
20715 tails (0.7) unstable; urgency=low
20718 - Install foomatic-filters-ppds to support more printers.
20719 - Give the default user the right to manage printers.
20722 - Deinstall unwanted packages newly pulled by recent live-build.
20724 -- Tails developers <amnesia@boum.org> Wed, 06 Apr 2011 22:58:51 +0200
20726 tails (0.7~rc2) unstable; urgency=low
20728 ** SNAPSHOT build @824f39248a08f9e190146980fb1eb0e55d483d71 **
20730 * Rebase on Debian Squeeze 6.0.1 point-release.
20732 * Vidalia: new 0.2.10-3+tails5 custom package..
20735 - Install usb-modeswitch and modemmanager to support mobile broadband
20736 devices such as 3G USB dongles. Thanks to Marco A. Calamari for the
20740 - Website relocated to https://tails.boum.org/ => adapt various places.
20741 - Configure keyboard layout accordingly to the chosen language for
20742 Italian and Portuguese.
20744 -- Tails developers <amnesia@boum.org> Fri, 25 Mar 2011 15:44:25 +0100
20746 tails (0.7~rc1) UNRELEASED; urgency=low
20748 ** SNAPSHOT build @98987f111fc097a699b526eeaef46bc75be5290a **
20750 * Rebase on Debian Squeeze.
20752 * T(A)ILS has been renamed to Tails.
20754 * Protecting against memory recovery
20755 New, safer way to wipe memory on shutdown which is now also used when
20756 the boot media is physically removed.
20759 - Update to 0.2.1.30-1.
20762 - Add HTTPS Everywhere 0.9.4 extension.
20763 - Better preserve Anonymity Set: spoof US English Browser and timezone
20764 the same way as the Tor Browser Bundle, disable favicons and picture
20766 - Install AdBlock Plus extension from Debian.
20767 - Add Tor-related bookmarks.
20768 - Support FTP, thanks to FoxyProxy.
20769 - Update AdBlock patterns.
20770 - Disable geolocation and the offline cache.
20773 - Update Vidalia to 0.2.10-3+tails4.
20774 - Install gnome-disk-utility (Palimpsest) and Seahorse plugins.
20775 - Add opt-in i2p support with Iceweasel integration through FoxyProxy.
20776 - onBoard: fix "really quits when clicking the close window icon" bug.
20777 - Optionally install TrueCrypt at boot time.
20778 - Install laptop-mode-tools for better use of battery-powered hardware.
20779 - Replace xsane with simple-scan which is part of GNOME and way easier
20781 - Upgrade WhisperBack to 1.3.1 (bugfixes, French translation).
20782 - Install scribus-ng instead of scribus. It is far less buggy in Squeeze.
20785 - Drop incoming packets by default.
20786 - Forbid queries to DNS resolvers on the LAN.
20787 - Set output policy to drop (defense-in-depth).
20790 - Install Atheros and Broadcom wireless firmwares.
20791 - Install libsane-hpaio and sane-utils, respectively needed for
20792 multi-function peripherals and some SCSI scanners.
20794 * live-boot 2.0.15-1+tails1.35f1a14
20795 - Cherry-pick our fromiso= bugfixes from upstream 3.x branch.
20798 - Many tiny user interface improvements.
20799 - More robust HTP time synchronization wrt. network failures.
20800 Also, display the logs when the clock synchronization fails.
20801 - Disable GNOME automatic media mounting and opening to protect against
20802 a class of attacks that was recently put under the spotlights.
20803 Also, this feature was breaking the "no trace is left on local
20804 storage devices unless explicitly asked" part of Tails specification.
20805 - Make configuration more similar to the Tor Browser Bundle's one.
20806 - GnuPG: default to stronger digest algorithms.
20807 - Many more or less proper hacks to get the built image size under 700MB.
20808 - Compress the initramfs using LZMA for faster boot.
20811 - Run lb build inside eatmydata fsync-less environment to greatly improve
20814 -- Tails developers <amnesia@boum.org> Fri, 11 Mar 2011 15:52:19 +0100
20816 tails (0.6.2) unstable; urgency=high
20818 * Tor: upgrade to 0.2.1.29 (fixes CVE-2011-0427).
20820 - Upgrade Linux kernel, dpkg, libc6, NSS, OpenSSL, libxml2 (fixes various
20822 - Upgrade Claws Mail to 3.7.6 (new backport).
20823 - Install Liferea, tcpdump and tcpflow.
20824 * Seahorse: use hkp:// transport as it does not support hkps://.
20825 * FireGPG: use hkps:// to connect to the configured keyserver.
20826 * Build system: take note of the Debian Live tools versions being used
20827 to make next point-release process faster.
20828 * APT: don't ship package indices.
20830 -- T(A)ILS developers <amnesia@boum.org> Wed, 19 Jan 2011 16:59:43 +0100
20832 tails (0.6.1) unstable; urgency=low
20834 * Tor: upgrade to 0.1.28 (fixes CVE-2010-1676)
20835 * Software: upgrade NSS, Xulrunner, glibc (fixes various security issues)
20836 * FireGPG: use the same keyserver as the one configured in gpg.conf.
20837 * Seahorse: use same keyserver as in gpg.conf.
20838 * HTP: display the logs when the clock synchronization fails.
20839 * Update HTP configuration: www.google.com now redirects to
20840 encrypted.google.com.
20841 * Use the light version of the "Are you using Tor?" webpage.
20842 * Update AdBlock patterns.
20844 -- T(A)ILS developers <amnesia@boum.org> Fri, 24 Dec 2010 13:28:29 +0100
20846 tails (0.6) unstable; urgency=low
20850 * New OpenPGP signing-only key. Details are on the website:
20851 https://amnesia.boum.org/GnuPG_key/
20854 - Fixed torbutton has migrated to testing, remove custom package.
20857 - Query ssl.scroogle.org instead of lists.debian.org.
20858 - Don't run when the interface that has gone up is the loopback one.
20861 - Add shortcut to securely erase free space in a partition.
20862 - The nautilus-wipe shortcut user interface is now translatable.
20865 - Really fix virtualization warning display.
20866 - More accurate APT pinning.
20867 - Disable Debian sid APT source again since a fixed live-config has
20868 migrated to Squeeze since then.
20870 * live-boot: upgrade to 2.0.8-1+tails1.13926a
20871 - Sometimes fixes the smem at shutdown bug.
20872 - Now possible to create a second partition on the USB stick T(A)ILS is
20876 - Support RT2860 wireless chipsets by installing firmware-ralink from
20878 - Install firmware-linux-nonfree from backports.
20879 - Fix b43 wireless chipsets by having b43-fwcutter extract firmwares at
20883 - Install live-build and live-helper from Squeeze.
20884 - Update SquashFS sort file.
20886 -- T(A)ILS developers <amnesia@boum.org> Wed, 20 Oct 2010 19:53:17 +0200
20888 tails (0.6~rc3) UNRELEASED; urgency=low
20890 ** SNAPSHOT build @a3ebb6c775d83d1a1448bc917a9f0995df93e44d **
20893 - Autostart Iceweasel with the GNOME session. This workarounds the
20894 "Iceweasel first page is not loaded" bug.
20897 - Upgrade htpdate script (taken from Git 7797fe9).
20900 - Disable ssh-agent auto-starting with X session: gnome-keyring is
20901 more user-friendly.
20902 - Fix virtualization warning display.
20903 - Boot profile hook: write desktop file to /etc/skel.
20906 - Convert build system to live-build 2.0.1.
20907 - APT: fetch live-build and live-helper from Debian Live snapshots.
20908 - Remove dependency on live-build functions in chroot_local-hooks.
20909 This makes the build environment more robust and less dependent on
20910 live-build internals.
20911 - Remove hand-made rcS.d/S41tails-wifi: a hook now does this.
20912 - Measure time used by the lh build command.
20913 - Fix boot profile hook.
20914 - Boot profiling: wait a bit more: the current list does not include
20917 -- T(A)ILS developers <amnesia@boum.org> Sat, 02 Oct 2010 23:06:46 +0200
20919 tails (0.6~rc2) UNRELEASED; urgency=low
20921 ** SNAPSHOT build @c0ca0760ff577a1e797cdddf0e95c5d62a986ec8 **
20924 - Refreshed AdBlock patterns (20100926).
20925 - Set network.dns.disableIPv6 to true (untested yet)
20926 - Torbutton: install patched 1.2.5-1+tails1 to fix the User-Agent bug,
20927 disable extensions.torbutton.spoof_english again.
20930 - WhisperBack: upgrade to 1.3~beta3 (main change: let the user provide
20931 optional email address and OpenPGP key).
20933 - Update haveged backport to 0.9-3~amnesia+lenny1.
20934 - Update live-boot custom packages (2.0.6-1+tails1.6797e8): fixes bugs
20935 in persistency and smem-on-shutdown.
20936 - Update custom htpdate script. Taken from commit d778a6094cb3 in our
20937 custom Git repository: fixes setting of date/time.
20940 - Bugfix: failed builds are now (hopefully) detected.
20941 - Fix permissions on files in /etc/apt/ that are preserved in the image.
20942 - Install version 2.0~a21-1 of live-build and live-helper in the image.
20943 We are too late in the release process to upgrade to current Squeeze
20944 version (2.0~a29-1).
20947 - Pidgin/OTR: disable the automatic OTR initiation and OTR requirement.
20949 -- T(A)ILS developers <amnesia@boum.org> Wed, 29 Sep 2010 19:23:17 +0200
20951 tails (0.6~1.gbpef2878) UNRELEASED; urgency=low
20953 ** SNAPSHOT build @ef28782a0bf58004397b5fd303f938cc7d11ddaa **
20956 - Use a 2.6.32 kernel: linux-image-2.6.32-bpo.5-686 (2.6.32-23~bpo50+1)
20957 from backports.org. This should support far more hardware and
20958 especially a lot of wireless adapters.
20959 - Add firmware for RTL8192 wireless adapters.
20960 - Enable power management on all wireless interfaces on boot.
20963 - Install inkscape.
20965 - Install gfshare and ssss: two complementary implementations
20966 of Shamir's Secret Sharing.
20967 - Install tor-geoipdb.
20968 - Remove dialog, mc and xterm.
20971 - Set extensions.torbutton.spoof_english to its default true value
20972 in order to workaround a security issue:
20973 https://amnesia.boum.org/security/Iceweasel_exposes_a_rare_User-Agent/
20976 - Install the Iceweasel extension.
20977 - Use a hkps:// keyserver.
20980 - Install gnupg from backports.org so that hkps:// is supported.
20981 - Use a hkps:// keyserver.
20982 - Proxy traffic via polipo.
20983 - Prefer up-to-date digests and ciphers.
20985 * Vidalia: rebased our custom package against 0.2.10.
20988 - Built images are now named like this:
20989 tails-i386-lenny-0.5-20100925.iso
20990 - Use live-helper support for isohybrid options instead of doing the
20991 conversion ourselves. The default binary image type we build is now
20993 - Remove .deb built by m-a after they have been installed.
20994 - Setup custom GConf settings at build time rather than at boot time.
20995 - Move $HOME files to /etc/skel and let adduser deal with permissions.
20996 - Convert to live-boot / live-config / live-build 2.x branches.
20997 - Replaced our custom live-initramfs with a custom live-boot package;
20998 included version is 2.0.5-1+tails2.6797e8 from our Git repository:
20999 git clone git://git.immerda.ch/tails_live-boot.git
21000 - Install live-config* from the live-snapshots Lenny repository.
21001 Rationale: live-config binary packages differ depending on the target
21002 distribution, so that using Squeeze's live-config does not produce
21003 fully-working Lenny images.
21004 - Rename custom scripts, packages lists and syslinux menu entries from
21005 the amnesia-* namespace to the tails-* one.
21008 - Use (authenticated) HTP instead of NTP.
21009 - The htpdate script that is used comes from commit 43f5f83c0 in our
21010 custom repository: git://git.immerda.ch/tails_htp.git
21011 - Start Tor and Vidalia only once HTP is done.
21014 - Fix IPv6 firewall restore file. It was previously not used at all.
21015 - Use ftp.us.debian.org instead of the buggy GeoIP-powered
21017 - Gedit: don't autocreate backup copies.
21018 - Build images with syslinux>=4.01 that has better isohybrid support.
21019 - amnesia-security-check: got rid of the dependency on File::Slurp.
21020 - Take into account the migration of backports.org to backports.debian.org.
21021 - Make GnuPG key import errors fatal on boot.
21022 - Warn the user when T(A)ILS is running inside a virtual machine.
21023 - DNS cache: forget automapped .onion:s on Tor restart.
21025 * Documentation: imported Incognito's walkthrough, converted to
21026 Markdown, started the needed adaptation work.
21028 -- T(A)ILS developers <amnesia@boum.org> Sun, 26 Sep 2010 11:06:50 +0200
21030 tails (0.5) unstable; urgency=low
21032 * The project has merged efforts with Incognito.
21033 It is now to be called "The (Amnesic) Incognito Live System".
21037 - Created the amnesia-news mailing-list.
21038 - Added a forum to the website.
21039 - Created a chatroom on IRC: #tails on irc.oftc.net
21042 - Workaround nasty NetworkManager vs. Tor bug that often
21043 prevented the system to connect to the Tor network: restart Tor and Vidalia
21044 when a network interface goes up.
21045 - onBoard now autodetects the keyboard layout... at least once some
21046 keys have been pressed.
21047 - New windows don't open in background anymore, thanks to
21048 a patched Metacity.
21049 - Memory wiping at shutdown is now lightning fast, and does not prevent
21050 the computer to halt anymore.
21051 - GNOME panel icons are right-aligned again.
21052 - Fixed permissions on APT config files.
21053 - Repaired mouse integration when running inside VirtualBox.
21056 - Torbutton: redirect to Scroogle when presented a Google captcha.
21057 - Revamped bookmarks
21058 . moved T(A)ILS own website to the personal toolbar
21059 . moved webmail links (that are expected to be more than 3 soon)
21060 to a dedicated folder.
21061 - Don't show AdBlock Plus icon in the toolbar.
21062 - Adblock Plus: updated patterns, configured to only update subscriptions
21063 once a year. Which means never, hopefully, as users do update their
21064 Live system on a regular basis, don't they?
21066 * Vidalia: rebased our custom package against 0.2.8.
21069 - Install Claws Mail from backports.org to use the X.509 CA
21070 certificates provided by Debian.
21071 - Enable PGP modules with basic configuration:
21072 . Automatically check signatures.
21073 . Use gpg-agent to manage passwords.
21074 . Display warning on start-up if GnuPG doesn't work.
21075 - Set the IO timeout to 120s (i.e. the double of the default 60s).
21078 - Automatically connect to irc.oftc.net with a randomized nickname,
21079 so as not to advertize the use of T(A)ILS; this nickname is made of:
21080 . a random firstname picked from the 2000 most registered by the U.S.
21081 social security administration in the 70s;
21082 . two random digits.
21083 Good old irc.indymedia.org is still configured - with same nickname -
21084 but is not enabled by default anymore.
21085 - Disabled MSN support, that is far too often affected by security flaws.
21087 * Build $HOME programmatically
21088 - Migrated all GConf settings, including the GNOME panel configuration,
21089 to XML files that are loaded at boot time.
21090 - Configure iceweasel profile skeleton in /etc/iceweasel.
21091 A brand new profile is setup from this skeleton once iceweasel is
21092 started after boot.
21093 . build sqlite files at build time from plain SQL.
21094 . FireGPG: hard-code current firegpg version at build time to prevent
21095 the extension to think it was just updated.
21096 . stop shipping binary NSS files. These were here only to
21097 install CaCert's certificate, that is actually shipped by Debian's
21101 - Updated Debian Live snapshots APT repository URL.
21102 - Purge all devel packages at the end of the chroot configuration.
21103 - Make sure the hook that fixes permissions runs last.
21104 - Remove unwanted Iceweasel search plugins at build time.
21107 - Added a progress bar for boot time file readahead.
21108 - Readahead more (~37MB) stuff in foreground at boot time.
21109 - Make the APT pinning persist in the Live image.
21110 - localepurge: keep locales for all supported languages,
21111 don't bother when installing new packages.
21112 - Removed syslinux help menu: these help pages are either buggy or
21113 not understandable by non-geeks.
21114 - Fixed Windows autorun.
21115 - Disable a few live-initramfs scripts to improve boot time.
21116 - Firewall: forbid any IPv6 communication with the outside.
21117 - Virtualization support: install open-vm-tools.
21118 - WhisperBack: updated to 1.2.1, add a random bug ID to the sent
21120 - Prompt for CD removal on shutdown, not for USB device.
21122 * live-initramfs: new package built from our Git (e2890a04ff) repository.
21123 - Merged upstream changes up to 1.177.2-1.
21124 - New noprompt=usb feature.
21125 - Fix buggy memory wiping and shutdown.
21126 - Really reboot when asked, rather than shutting down the system.
21129 - Upgraded to a new custom, patched package (0.93.0-0ubuntu4~amnesia1).
21130 - Added an entry in the Applications menu.
21133 - Install vim-nox with basic configuration
21135 - Install monkeysphere and msva-perl
21136 - Replaced randomsound with haveged as an additional source of entropy.
21139 - Build ralink rt2570 wifi modules.
21140 - Build rt2860 wifi modules from Squeeze. This supports the RT2860
21141 wireless adapter, found particularly in the ASUS EeePC model 901
21143 - Build broadcom-sta-source wifi modules.
21144 - Bugfix: cpufreq modules were not properly added to /etc/modules.
21145 - Use 800x600 mode on boot rather than 1024x768 for compatibility
21146 with smaller displays.
21148 -- amnesia <amnesia@boum.org> Fri, 30 Apr 2010 16:14:13 +0200
21150 amnesia (0.4.2) unstable; urgency=low
21152 New release, mainly aimed at fixing live-initramfs security issue
21153 (Debian bug #568750), with an additional set of small enhancements as
21156 * live-initramfs: new custom package built from our own live-initramfs
21157 Git repository (commit 8b96e5a6cf8abc)
21158 - based on new 1.173.1-1 upstream release
21159 - fixed live-media=removable behaviour so that filesystem images found
21160 on non-removable storage are really never used (Debian bug #568750)
21162 * Vidalia: bring back our UI customizations (0.2.7-1~lenny+amnesia1)
21164 * APT: consistently use the GeoIP-powered cdn.debian.net
21166 * Software: make room so that {alpha, future} Squeeze images fit on
21168 - only install OpenOffice.org's calc, draw, impress, math and writer
21170 - removed OpenOffice.org's English hyphenation and thesaurus
21171 - removed hunspell, wonder why it was ever added
21174 - explicitly disable persistence, better safe than sorry
21175 - removed compulsory 15s timeout, live-initramfs knows how to wait for
21176 the Live media to be ready
21178 * Build system: don't cache rootfs anymore
21180 -- amnesia <amnesia@boum.org> Sun, 07 Feb 2010 18:28:16 +0100
21182 amnesia (0.4.1) unstable; urgency=low
21184 * Brown paper bag bugfix release: have amnesia-security-check use
21185 entries publication time, rather than update time... else tagging
21186 a security issue as fixed, after releasing a new version, make this
21187 issue be announced to every user of this new, fixed version.
21189 -- amnesia <amnesia@boum.org> Sat, 06 Feb 2010 03:58:41 +0100
21191 amnesia (0.4) unstable; urgency=low
21193 * We now only build and ship "Hybrid" ISO images, which can be either
21194 burnt on CD-ROM or dd'd to a USB stick or hard disk.
21196 * l10n: we now build and ship multilingual images; initially supported
21197 (or rather wanna-be-supported) languages are: ar, zh, de, en, fr, it,
21199 - install Iceweasel's and OpenOffice.org's l10n packages for every
21201 - stop installing localized help for OpenOffice.org, we can't afford it
21202 for enough languages
21203 - when possible, Iceweasel's homepage and default search engine are localized
21204 - added Iceweasel's "any language" Scroogle SSL search engine
21205 - when the documentation icon is clicked, display the local wiki in
21206 currently used language, if available
21207 - the Nautilus wipe script is now translatable
21208 - added gnome-keyboard-applet to the Gnome panel
21211 - replaced Icedove with claws mail, in a bit rough way; see
21212 https://amnesia.boum.org/todo/replace_icedove_with_claws/ for best
21213 practices and configuration advices
21214 - virtual keyboard: install onBoard instead of kvkbd
21215 - Tor controller: install Vidalia instead of TorK
21216 - install only chosen parts of Gnome, rather than gnome-desktop-environment
21217 - do not install xdialog, which is unused and not in Squeeze
21218 - stop installing grub as it breaks Squeeze builds (see Debian bug #467620)
21219 - install live-helper from snapshots repository into the Live image
21222 - do not install the NoScript extension anymore: it is not strictly
21223 necessary but bloodily annoying
21225 * Provide WhisperBack 1.2 for anonymous, GnuPG-encrypted bug reporting.
21226 - added dependency on python-gnutls
21227 - install the SMTP hidden relay's certificate
21229 * amnesia-security-check: new program that tells users that the amnesia
21230 version they are running is affected by security flaws, and which ones
21231 they are; this program is run at Gnome session startup, after sleeping
21232 2 minutes to let Tor a chance to initialize.
21235 - uses the Desktop Notifications framework
21236 - fetches the security atom feed from the wiki
21237 - verifies the server certificate against its known CA
21238 - tries fetching the localized feed; if it fails, fetch the default
21241 * live-initramfs: new custom package built from our own live-initramfs
21242 Git repository (commit 40e957c4b89099e06421)
21243 - at shutdown time, ask the user to unplug the CD / USB stick, then run
21244 smem, wait for it to finish, then attempt to immediately halt
21247 - bumped dependency on live-helper to >= 2.0a6 and adapted our config
21248 - generate hybrid ISO images by default, when installed syslinux is
21250 - stop trying to support building several images in a row, it is still
21251 broken and less needed now that we ship hybrid ISO images
21252 - scripts/config: specify distribution when initializing defaults
21253 - updated Debian Live APT repository's signing key
21256 - disable virtualbox packages installing and module building on !i386
21257 && !amd64, as PowerPC is not a supported guest architecture
21258 - built and imported tor_0.2.1.20-1~~lenny+1_powerpc.deb
21261 - rough beginnings of a scratch Squeeze branch, currently unsupported
21262 - install gobby-infinote
21265 - updated GnuPG key with up-to-date signatures
21266 - more improvements on boot time from CD
21267 - enhanced the wipe in Nautilus UI (now asks for confirmation and
21268 reports success or failure)
21269 - removed the "restart Tor" launcher from the Gnome panel
21271 -- amnesia <amnesia@boum.org> Fri, 05 Feb 2010 22:28:04 +0100
21273 amnesia (0.3) unstable; urgency=low
21275 * software: removed openvpn, added
21281 - lvm2 (with disabled initscript as it slows-down too much the boot in certain
21283 - NetworkManager 0.7 (from backports.org) to support non-DHCP networking
21285 - randomsound to enhance the kernel's random pool
21287 - install the latest stable release from deb.torproject.org
21288 - ifupdown script now uses SIGHUP signal rather than a whole tor
21289 restart, so that in the middle of it vidalia won't start it's own
21291 - configure Gnome proxy to use Tor
21293 - adblockplus: upgraded to 1.0.2
21294 - adblockplus: subscribe to US and DE EasyList extensions, updated patterns
21295 - firegpg is now installed from Debian Squeeze rather than manually; current
21296 version is then 0.7.10
21297 - firegpg: use better keyserver ... namely pool.sks-keyservers.net
21298 - added bookmark to Amnesia's own website
21299 - use a custom "amnesiabranding" extension to localize the default search
21300 engine and homepage depending on the current locale
21301 - updated noscript whitelist
21302 - disable overriden homepage redirect on iceweasel upgrade
21304 - nicer default configuration with verified irc.indymedia.org's SSL cert
21305 - do not parse incoming messages for formatting
21306 - hide formatting toolbar
21307 * hardware compatibility
21309 - beginning of support for the ppc architecture
21310 - load acpi-cpufreq, cpufreq_ondemand and cpufreq_powersave kernel
21312 * live-initramfs: custom, updated package based on upstream's 1.157.4-1, built
21313 from commit b0a4265f9f30bad945da of amnesia's custom live-initramfs Git
21315 - securely erases RAM on shutdown using smem
21316 - fixes the noprompt bug when running from USB
21317 - disables local swap partitions usage, wrongly enabled by upstream
21318 * fully support for running as a guest system in VirtualBox
21319 - install guest utils and X11 drivers
21320 - build virtualbox-ose kernel modules at image build time
21322 - new (translatable) wiki, using ikiwiki, with integrated bugs and todo
21323 tracking system a static version of the wiki is included in generated
21324 images and linked from the Desktop
21326 - adapt for live-helper 2.0, and depend on it
21327 - get amnesia version from debian/changelog
21328 - include the full version in ISO volume name
21329 - save .list, .packages and .buildlog
21330 - scripts/clean: cleanup any created dir in binary_local-includes
21331 - updated Debian Live snapshot packages repository URL and signing key
21332 - remove duplicated apt/preferences file, the live-helper bug has been
21334 * l10n: beginning of support for --language=en
21336 - improved boot time on CD by ordering files in the squashfs in the order they
21337 are used during boot
21338 - added a amnesia-version script to built images, that outputs the current
21340 - added a amnesia-debug script that prepares a tarball with information that
21341 could be useful for developpers
21342 - updated Amnesia GnuPG key to a new 4096R one
21343 - set time with NTP when a network interface is brought up
21344 - import amnesia's GnuPG pubkey into the live session user's keyring
21345 - do not ask DHCP for a specific hostname
21346 - install localepurge, only keep en, fr, de and es locales, which reduces the
21347 generated images' size by 100MB
21348 - added a hook to replace /sbin/swapon with a script that only runs
21350 - moved networking hooks responsibility from ifupdown to NetworkManager
21352 -- amnesia <amnesia@boum.org> Thu, 26 Nov 2009 11:17:08 +0100
21354 amnesia (0.2) unstable; urgency=low
21356 * imported /home/amnesia, then:
21357 - more user-friendly shell, umask 077
21358 - updated panel, added launcher to restart Tor
21359 - mv $HOME/bin/* /usr/local/bin/
21360 - removed metacity sessions
21361 - removed gstreamer's registry, better keep this dynamically updated
21362 - rm .qt/qt_plugins_3.3rc, better keep this dynamically updated
21363 - removed .gnome/gnome-vfs/.trash_entry_cache
21364 - removed kconf_update log
21365 - removed and excluded Epiphany configuration (not installed)
21368 - enable caching in RAM
21369 - explicitly disable ssl v2, and enable ssl v3 + tls
21370 - removed prefs for the non-installed webdeveloper
21371 - removed the SSL Blacklist extension (not so useful, licensing issues)
21372 - deep profile directory cleanup
21373 - extensions cleanup: prefer Debian-packaged ones, cleanly reinstalled
21374 AddBlock Plus and CS Lite to allow upgrading them
21375 - updated pluginreg.dat and localstore.rdf
21376 - moved some settings to user.js
21377 - made cookie/JavaScript whitelists more consistent
21378 - force httpS on whitelisted sites
21379 - NoScript: marked google and gmail as untrusted
21380 - some user interface tweaks, mainly for NoScript
21381 - FireGPG: disable the buggy auto-detection feature, the link to firegpg's
21382 homepage in generated pgp messages and the GMail interface (which won't
21383 work without JavaScript anyway)
21384 - updated blocklist.xml
21385 - removed and excluded a bunch of files in the profile directory
21386 * icedove: clean the profile directory up just like we did for iceweasel
21387 * software: install msmtp and mutt
21389 - use rsync rather than tar
21392 - reviewed pidgin-otr security (see TODO)
21394 - stop calling home-refresh in lh_build
21395 - include home-refresh in generated images
21397 - fix permissions on local includes at build time
21398 - updated scripts/{build,clean} wrt. new $HOME handling
21399 - scripts/{build,config}: stop guessing BASEDIR, we must be run from
21400 the root of the source directory anyway
21401 - stop storing /etc/amnesia/version in Git, delete it at clean time
21403 - converted Changelog to the Debian format and location, updated
21404 build scripts accordingly
21405 - added a README symlink at the root of the source directory
21406 - basic debian/ directory (not working for building packages yet,
21407 but at least we can now use git-dch)
21408 - added debian/gbp.conf with our custom options for git-dch
21409 - config/amnesia: introduce new $AMNESIA_DEV_* variables to be used
21410 by developpers' scripts
21411 - added ./release script: a wrapper around git-dch, git-commit and git-tag
21413 -- amnesia <amnesia@boum.org> Tue, 23 Jun 2009 14:42:03 +0200
21415 amnesia (0.1) UNRELEASED; urgency=low
21417 * Forked Privatix 9.03.15, by Markus Mandalka:
21418 http://mandalka.name/privatix/index.html.en
21419 Everything has since been rewritten or so heavily changed that nothing
21420 remains from the original code... apart of a bunch of Gnome settings.
21421 * hardware support:
21422 - install a bunch of non-free wifi firmwares
21423 - install xsane and add the live user to the scanner group
21424 - install aircrack-ng
21425 - install xserver-xorg-video-geode on i386 (eCafe support)
21426 - install xserver-xorg-video-all
21427 - install firmware-linux from backports.org
21428 - install system-config-printer
21429 - added instructions in README.eCAFE to support the Hercules eCAFE EC-800
21432 - configure pinning to support installing chosen packages from
21433 squeeze; the APT source for testing is hardcoded in chroot_sources/,
21434 since there is no way to use $LH_CHROOT_MIRROR in chroot_local-hooks
21435 - give backports.org priority 200, so that we track upgrades of packages
21436 installed from there
21437 * release: include the Changelog and TODO in the generated images,
21438 in the /usr/share/doc/amnesia/ directory
21439 * software: install gnomebaker when building Gnome-based live OS, to
21440 easily clone myself when running from CD
21442 - build i386 images when the build host is amd64
21443 - added a version file: /etc/amnesia/version
21444 - use snapshot live-* packages inside the images
21445 - setup timezone depending on the chosen build locale
21446 - rely on standard live-initramfs adduser to do our user setup
21447 (including sudo vs. Gnome/KDE, etc.)
21448 - stop "supporting" KDE
21449 - allow building several images at once
21450 - migrated most of lh_config invocations to scripts/config
21451 - append "noprompt" so that halting/rebooting work with splashy
21452 - moved our own variables to config/amnesia, using the namespace
21455 - default search engine is now Scroogle SSL, configured to search pages
21456 in French language; the English one is also installed
21457 - never ask to save passwords or forms content
21458 - configured the torbutton extension to use polipo
21459 - installed the CACert root certificate
21460 - installed the SSL Blacklist extension and the blacklist data
21461 - installed the FireGPG extension
21462 - installed the CS Lite extension
21463 - installed the NoScript extension
21464 - NoScript, CS Lite: replaced the default whitelists with a list of
21465 trusted, non-commercial Internet Service Providers
21466 - configure extensions (add to prefs.js):
21467 user_pref("extensions.torbutton.startup", true);
21468 user_pref("extensions.torbutton.startup_state", 1);
21469 user_pref("extensions.torbutton.tor_enabled", true);
21470 user_pref("noscript.notify.hide", true);
21471 user_pref("capability.policy.maonoscript.sites", "about:
21472 about:blank about:certerror about:config about:credits
21473 about:neterror about:plugins about:privatebrowsing
21474 about:sessionrestore chrome: resource:");
21475 user_pref("extensions.firegpg.no_updates", true);
21476 - install the NoScript plugin from Debian squeeze
21477 - delete urlclassifier3.sqlite on $HOME refresh: as we disabled
21478 "safebrowsing", this huge file is of no use
21479 - torbutton: install newer version from Squeeze
21480 * linux: removed non-686 kernel flavours when building i386 images
21481 * compatibility: append "live-media=removable live-media-timeout=15", to
21482 prevent blindly booting another debian-live installed on the hard disk
21484 - gnome-app-install
21486 - cryptkeeper: Gnome system tray applet to encrypt files with EncFS
21487 - kvkbd: virtual keyboard (installed from backports.org)
21488 - sshfs (and added live user to the fuse group)
21489 - less, secure-delete, wipe, seahorse, sshfs, ntfs-3g
21492 - enable the transparent proxy, the DNS resolver, and the control port
21493 - save authentication cookie to /tmp/control_auth_cookie, so that the
21494 live user can use Tork and co.
21495 - autostart Tork with Gnome
21496 - Tork: installed, disabled most notifications and startup tips
21497 - added a restart tor hook to if-up.d (used by Network Manager as well),
21498 so that Tor does work immediately even if the network cable was
21499 plugged late in/after the boot process
21501 - added a nautilus-script to wipe files and directories
21502 - bash with working completion for the live user
21503 * polipo: install and configure this HTTP proxy to forward requests
21505 * DNS: install and configure pdnsd to forward any DNS request through
21507 * firewall: force every outgoing TCP connection through the Tor
21508 transparent proxy, discard any outgoing UDP connection
21510 - set syslinux timeout to 4 seconds
21511 - use splashy for more user-friendly boot/halt sequences
21513 -- amnesia <amnesia@boum.org> Sat, 20 Jun 2009 21:09:15 +0200