4 years agoWIP: real meek for moatgitlab/feature/15331-moatimmerda/feature/15331-moatlabs/feature/15331-moat
WIP: real meek for moat
Merge remote-tracking branch 'origin/devel' into feature/15331-moat
Tor Launcher: provide Tor's default Meek bridges.
It is not clear we want to do this, but for now we enable them as a
workaround:
In current Tor Launcher (whatever version shipped with Tor Browser
8.0a1), if no default bridges are configured the whole group of radio
buttons that provide the Moat option ("Request another bridge") is
hidden (with only the text box for manual entry available). So let's
provide some to enable Moat.
Refs: #8243
It is not clear we want to do this, but for now we enable them as a
workaround:
In current Tor Launcher (whatever version shipped with Tor Browser
8.0a1), if no default bridges are configured the whole group of radio
buttons that provide the Moat option ("Request another bridge") is
hidden (with only the text box for manual entry available). So let's
provide some to enable Moat.
Refs: #8243
Fix supported_tor_browser_locales() when only en-US is available.
The old implementation gives crazy results if no .xpi exist.
The old implementation gives crazy results if no .xpi exist.
Install Tor Browser 8.0a1 (moat-2018-02-15).
Let's start working on Moat-integration in Tails.
Refs: #15331
Let's start working on Moat-integration in Tails.
Refs: #15331
ASP: reference the commit explaining how to use APT in the test suite.
Using chutney requires to use non-onion APT sources.
Refs: #14572, #11556
Using chutney requires to use non-onion APT sources.
Refs: #14572, #11556
Merge branch 'feature/15309-linux-4.15' into devel
Fix-committed: #15309
Fix-committed: #15309
Merge remote-tracking branch 'origin/devel' into feature/15309-linux-4.15
Merge remote-tracking branch 'origin/devel' into feature/15331-moat
Merge remote-tracking branch 'origin/feature/15198-asp-convert-to-python3-pep8' into devel
Fix-committed: #15198
Fix-committed: #15198
Merge remote-tracking branch 'origin/feature/14572-automated-tests-for-ASP-offline-mode' into devel
Fix-committed: #14570, #14572
Fix-committed: #14570, #14572
Fix python3 switch.
subprocess.Popen since Python 3.5 set STDIN and STDOUT output as binary,
unless its `universal_newlines` arg is set to True, in which case you
get text output that fits better with the way we parse this it later.
Refs: #15198
subprocess.Popen since Python 3.5 set STDIN and STDOUT output as binary,
unless its `universal_newlines` arg is set to True, in which case you
get text output that fits better with the way we parse this it later.
Refs: #15198
Merge remote-tracking branch 'origin/devel' into feature/15198-asp-convert-to-python3-pep8
Merge branch 'stable' into devel
Revert "Test suite: disable tests that are known broken due to a Tor Browser bug"
This reverts commit 15ff263293c612f69138e03f7fb2f9aedd006e23.
https://labs.riseup.net/code/issues/15024#note-6 was missed
when we closed #15024.
This reverts commit 15ff263293c612f69138e03f7fb2f9aedd006e23.
https://labs.riseup.net/code/issues/15024#note-6 was missed
when we closed #15024.
Merge remote-tracking branch 'origin/bugfix/15029-AppArmor-cups-backends' into devel
Fix-committed: #15029
Fix-committed: #15029
Refresh PO files.
This should hopefully make the devel branch build reproducibly again.
This should hopefully make the devel branch build reproducibly again.
Fix copy'n'paste error.
Factorize calls to ensure_hook_dependency_is_installed.
Merge remote-tracking branch 'origin/devel' into feature/15309-linux-4.15
… and thus convert the changes introduced by feature/15309-linux-4.15
to ensure_hook_dependency_is_installed.
… and thus convert the changes introduced by feature/15309-linux-4.15
to ensure_hook_dependency_is_installed.
Merge remote-tracking branch 'origin/feature/14521-improve-UX-when-GDM-fails-to-start' into devel
Fix-committed: #14521
Fix-committed: #14521
Merge remote-tracking branch 'origin/feature/15173-upgrade-intel-microcode' into devel
Refs: #15173
Refs: #15173
Merge remote-tracking branch 'origin/devel' into devel
Merge remote-tracking branch 'origin/devel' into devel
Merge remote-tracking branch 'origin/stable' into devel
Merge remote-tracking branch 'origin/bugfix/15322-fix-early-boot-hostname' into stable
Fix-committed: #15322
Fix-committed: #15322
Merge branch 'feature/12679-sandbox-firefox-content-renderers' into devel
Merge remote-tracking branch 'origin/feature/15298-thunderbird-52.6.0' into devel (Fix-committed: #15298)
The Thunderbird Debian packaging Git repo has moved.
Merge remote-tracking branch 'origin/feature/improved-dependency-mechanism-for-build-hooks' into devel (Fix-committed: #14818)
Merge remote-tracking branch 'origin/feature/12679-sandbox-firefox-content-renderers' into devel
Fix-committed: #12679, #15270
Fix-committed: #12679, #15270
Merge remote-tracking branch 'origin/stable' into devel
Merge remote-tracking branch 'origin/bugfix/15318-update-sysadmins-key' into stable
Fix-committed: #15318, #7037
Fix-committed: #15318, #7037
Merge remote-tracking branch 'origin/bugfix/15318-update-sysadmins-key' into devel
Fix-committed: #15318, #7037
Fix-committed: #15318, #7037
ASP: remove meaningless code.
It has no side-effects and its return value is not captured. It seems
to have been added by mistake, possibly intended as a `f.close()`.
It has no side-effects and its return value is not captured. It seems
to have been added by mistake, possibly intended as a `f.close()`.
Factor out setting up a kernel modules build environment.
We need all that both when building out-of-tree modules (e.g. aufs)
ourselves and for DKMS modules.
We need all that both when building out-of-tree modules (e.g. aufs)
ourselves and for DKMS modules.
Switch back to building the upstream aufs kernel module ourselves (refs: #15309)
aufs-dkms is not ready for 4.15 (https://bugs.debian.org/890733).
This reverts commit 31a272ad21c0bec2dec126fbe17eaf64c1124bb7
and adjusts more stuff.
aufs-dkms is not ready for 4.15 (https://bugs.debian.org/890733).
This reverts commit 31a272ad21c0bec2dec126fbe17eaf64c1124bb7
and adjusts more stuff.
Upgrade Linux to 4.15.0-1 (refs: #15309).
Merge remote-tracking branch 'origin/devel' into feature/15198-asp-convert-to-python3-pep8
Don't use ${} syntax that confuses the systemd unit parser.
The previously used syntax triggered "Invalid escape sequences in line,
correcting" error messages and the corresponding ExecStart= directive was
"corrected" in a way that somehow broke its functionality.
For the curious:
https://sources.debian.org/src/systemd/232-25+deb9u1/src/basic/extract-word.c/?hl=231#L231
The previously used syntax triggered "Invalid escape sequences in line,
correcting" error messages and the corresponding ExecStart= directive was
"corrected" in a way that somehow broke its functionality.
For the curious:
https://sources.debian.org/src/systemd/232-25+deb9u1/src/basic/extract-word.c/?hl=231#L231
Truncate graphics card name if needed so the entire message fits in 254 chars (refs: #14521).
"plymouth display-message" does not support longer messages.
Only one graphics card in current pci.ids would make the message _almost_ not
fit, but let's not take any bet and ensure it'll always work even for newer
graphics card with super long names: this is a troubleshooting facility in case
of GDM not starting, so it'd better not itself break randomly otherwise users
will be even more confused.
"plymouth display-message" does not support longer messages.
Only one graphics card in current pci.ids would make the message _almost_ not
fit, but let's not take any bet and ensure it'll always work even for newer
graphics card with super long names: this is a troubleshooting facility in case
of GDM not starting, so it'd better not itself break randomly otherwise users
will be even more confused.
Rephrase the error message on GDM startup failure (refs: #14521)
https://mailman.boum.org/pipermail/tails-ux/2018-February/003531.html
https://mailman.boum.org/pipermail/tails-ux/2018-February/003531.html
Ensure the SquashFS has /etc/hostname properly configured (refs: #15322).
live-config's 0020-hostname hook is confused because eth0 does not exists
yet when it runs, so let's help it figure out what the correct hostname
is. Otherwise, the system is configured with the localhost.localdomain
hostname until NetworkManager fixes that.
Incidentally, this gets rid of the many firewall rejection logs we see during
early boot due to localhost.localdomain DNS lookups (e.g. by sudo).
live-config's 0020-hostname hook is confused because eth0 does not exists
yet when it runs, so let's help it figure out what the correct hostname
is. Otherwise, the system is configured with the localhost.localdomain
hostname until NetworkManager fixes that.
Incidentally, this gets rid of the many firewall rejection logs we see during
early boot due to localhost.localdomain DNS lookups (e.g. by sudo).
Have systemd-tmpfiles create /usr/share/tails-iuk/trusted_gnupg_homedir with strict permissions and make them laxer only after having imported the public key in there (refs: #7037)
`mkdir -p --mode=0700' did not do anything because when it runs,
systemd-tmpfiles has already created the directory with 755 permissions.
`mkdir -p --mode=0700' did not do anything because when it runs,
systemd-tmpfiles has already created the directory with 755 permissions.
Merge remote-tracking branch 'origin/bugfix/7037-stricter-permissions-on-tails-upgrade-frontend-gnupg-homedir' into bugfix/15318-update-sysadmins-key (refs: #7037)
Merge branch 'stable' into devel
Test suite: mark scenarios that use the "The Report an Error launcher will…" step as fragile (refs: #15321)
Update tails-sysadmins@ OpenPGP public key (refs: #15318)
Merge remote-tracking branch 'origin/feature/12679-sandbox-firefox-content-renderers' into feature/15173-upgrade-intel-microcode
Install Intel processor microcode firmware from stretch-backports (refs: #15173).
The maintainer of intel-microcode in Debian carefully uploads to
stretch-backports updates he thinks are safe for stable users. For example,
right now stretch-backports has 3.20171117.1~bpo9+1 which is the latest
available version that's not affected by the many regressions introduced by
3.20180108.1.
This commit does *not* currently give us IBRS/IBPB/STIPB microcode support for
Spectre variant 2 mitigation: the currently available firmware with that support
is too buggy. Instead, it:
- updates microcode firmware to the latest good enough version, which usually
brings important bugfixes;
- paves the way for us to get this mitigation whenever it is ready in a form
that the maintainer of intel-microcode in Debian thinks can be safely pushed
to Debian stable users.
The maintainer of intel-microcode in Debian carefully uploads to
stretch-backports updates he thinks are safe for stable users. For example,
right now stretch-backports has 3.20171117.1~bpo9+1 which is the latest
available version that's not affected by the many regressions introduced by
3.20180108.1.
This commit does *not* currently give us IBRS/IBPB/STIPB microcode support for
Spectre variant 2 mitigation: the currently available firmware with that support
is too buggy. Instead, it:
- updates microcode firmware to the latest good enough version, which usually
brings important bugfixes;
- paves the way for us to get this mitigation whenever it is ready in a form
that the maintainer of intel-microcode in Debian thinks can be safely pushed
to Debian stable users.
Tor Browser AppArmor profiles: update our custom patch (refs: #12679).
Taken from 3286cb1f342218e9bbb2638e1bdda99b2d2f0737 in our
torbrowser-launcher.git.
Changes:
- Silence denial of access to ~/.cache/fontconfig/.
- Allow innocuous access to /usr/share/applications/gnome-mimeapps.list to
silence logs.
Taken from 3286cb1f342218e9bbb2638e1bdda99b2d2f0737 in our
torbrowser-launcher.git.
Changes:
- Silence denial of access to ~/.cache/fontconfig/.
- Allow innocuous access to /usr/share/applications/gnome-mimeapps.list to
silence logs.
Merge branch 'stable' into devel
Merge remote-tracking branch 'origin/master' into stable
Delete *.es.po files for pages that either were removed, or are not translatable anymore.
Breaking the News section on the English homepage was one consequence of
this bug.
Apparently the current Weblate setup does not handle (either automatically or
manually) these cases.
Breaking the News section on the English homepage was one consequence of
this bug.
Apparently the current Weblate setup does not handle (either automatically or
manually) these cases.
Merge remote-tracking branch 'emmapeel-weblate/shinySpanish'
bad link
updated PO files
Merge remote-tracking branch 'origin/master'
updated PO files
updated PO files
updated PO files
updated PO files
Merge remote-tracking branch 'origin/master'
updated PO files
sorted in alphabetical order
changes to ikiwiki setup files
new spanish files
updated PO files
Merge remote-tracking branch 'origin/master'
Point to the package installation doc + make it clear where the package must be installed.
updated PO files
Document how one can improve support of Tails in VMware (Closes: #7595).
Fix broken link.
It worked… until the report was published.
It worked… until the report was published.
Publish SponsorW 2018-01 report.
add weblate translation status
Merge branch 'stable' into devel
updated PO files
Fix formatting.
Link to newly documented role.
Merge remote-tracking branch 'origin/master'
Stop depending on transitional package.
Merge branch 'contrib/12552-describe-accounting-team'
Merge branch 'master' of webmasters.boum.org:wiki
Improve accounting role documentation
Prefer full if statements over &&-short circuiting with set -e.
During the review it was pointed out that under `set -e`, the line:
[ -z "${*}" ] && return
seemingly should result in an abort if the left operand fails, i.e. $*
is empty. However, the left operand of && (and ||) is considered
"explicitly tested", just like the conditional of an if-statement, so
it won't abort. Clearly this isn't common knowledge (disclaimer: I
doubted myself and had to look it up) so let's just avoid it.
During the review it was pointed out that under `set -e`, the line:
[ -z "${*}" ] && return
seemingly should result in an abort if the left operand fails, i.e. $*
is empty. However, the left operand of && (and ||) is considered
"explicitly tested", just like the conditional of an if-statement, so
it won't abort. Clearly this isn't common knowledge (disclaimer: I
doubted myself and had to look it up) so let's just avoid it.
Updated to new fake name (for mathias)
Added Mathias
Enable the feature-15298-thunderbird-52.6.0 APT overlay.
Will-fix: #15298
Will-fix: #15298
Avoid `[ -z "${@}" ]` pitfall.
The special expansion rules for $@ when it is quoted makes it
dangerous to use it with operators that expect a fixed amount of
arguments -- e.g. if it expands to `[ -z "foo" "bar" ]` we get a
syntax error at run time. So let's use $* which when quoted always
expands to a single argument.
The special expansion rules for $@ when it is quoted makes it
dangerous to use it with operators that expect a fixed amount of
arguments -- e.g. if it expands to `[ -z "foo" "bar" ]` we get a
syntax error at run time. So let's use $* which when quoted always
expands to a single argument.
updates
checking weblate for enabled langs
typos
Update roadmap.
Merge remote-tracking branch 'emmapeel/fr_updates'
Merge remote-tracking branch 'origin/master'
Fix wording and spelling
Add my bits /segfault
Fix #12833 link.