This scenario failed 12 times in the last 16 test suite runs on the testing
branch, so it's starting to be really annoying.

Every time, SSH immediately fails with "nc: connection failed, SOCKSv5 error:
General SOCKS server failure". I suspect there's a bug in our test suite, that
makes us try to use Tor before it's ready. Regardless, we have a very similar
test case in ssh.feature that is pretty robust: it never failed in the 16 test
suite runs I've analyzed. I see two main potential reasons for this difference:

 - In tor_stream_isolation.feature we have the "I monitor the network
   connections of SSH" CPU hog running. This might make it harder for tor to do
   its job.

 - In ssh.feature, we use retry_tor so we retry up to
   MAX_NEW_TOR_CIRCUIT_RETRIES (default: 10); while in
   tor_stream_isolation.feature we only run SSH once.

In short, the fragile scenario runs in a context that makes it more likely to
f...

Fix-committed: #17162

Allow OnionShare to issue the control port command it uses for stealth onion services (refs: #17162)

Fix-committed: #17142

Fix-committed: #17144

Fix-committed: #17157

We do this in delete_chroot_browser_searchplugins(), presumably
to avoid issues when run under a strict umask. Let's make
these operations consistent.

If the shell can expand this glob, then it will. If it can't, then
it will pass it as-is to 7z, which is what we want.

In practice, the chances this glob will ever expand is minuscule, but
developers (at least myself) would have to wonder about this every time they
work on this piece of code, which is a little bit distracting.

Fixup against 09fcbc15.

* We don't have to use `ls * | xargs 7z d`, 7z also supports wildcards. Also,
  in case that the ls command fails or returns nothing, the `xargs 7z d`
  will delete all contents of the archive.
* We don't have to extract $searchplugins_dir, we don't do anything with
  the extacted files anyway.

The UI this test used to rely on was removed from Tor Browser 9.0a8's
code base, so let's re-implement it via prefs.js.

And in passing, only test one Socksport (chosen randomly among those configured
in torrc): this should be sufficient to verify that our firewall does not allow
the clearnet user to connect to services listening on the loopback interface,
which is what this scenario is essentially about.

Our firewall blocks access from the clearnet user to the loopback interface,
so proxies are not supposed to work. We validate this already with
a combination of two tests:

 - "Scenario: The Unsafe Browser can load a web page" would fail
   if a proxy was configured and the firewall is set up as intended.

 - "Scenario: The Unsafe Browser cannot be configured to use Tor and other local
   proxies" would fail if the firewall was not set up correctly.

So let's remove this extra test, which is hard to update since the UI it's
currently using was removed from Tor Browser 9.0a8's code base.

This hides the UI introduced for
https://trac.torproject.org/projects/tor/ticket/31286:

 - the "Tor" button in the left sidebar, which only points to UI that allows the
   user to configure how little-t-tor connects to the Tor network: OnionGrater
   blocks this so the information shown there is incorrect (when using
   non-default configuration) and cannot be modified successfully;

 - the same UI, when found via "Find in Preferences".

Note that we'll probably need to opt-in for userChrome.css and userContent.css
when we upgrade to a Tor Browser that's based on Firefox 69+:
https://www.ghacks.net/2019/05/24/firefox-69-userchrome-css-and-usercontent-css-disabled-by-default/

The Firefox Sync feature is disabled in Tor Browser, so this piece of CSS is
currently a no-op. Besides, it looks like even if Firefox Sync was enabled,
the CSS is outdated wrt. current about:preferences.

Ensure we install ibus 1.5.19-4+deb10u1.0tails1 even though its version number is lower than 1.5.19-4.0tails3 (refs: #17144)

We can drop this once the APT overlay suite that introduces
1.5.19-4+deb10u1.0tails1 (bugfix-17144-ibus-security) is merged into our
"testing" APT suite during the 4.0 release process: this will replace the now
obsolete 1.5.19-4.0tails3 packages with the updated
1.5.19-4+deb10u1.0tails1 ones.

Fix-committed: #17104

Merge remote-tracking branch 'origin/bugfix/17132-dont-ship-greeter-hook-dependency' into testing (Closes: #17132)

Current Test::BDD::Cucumber has a bug when dealing with non-implemented
scenarios with TAP output. Thankfully, the non-implemented scenarios
in tails-persistence-setup make no sense at all, so I deleted them,
which fixes the problem this "XXX" was about.

Fixup against fb3b3efd.

It's unclear why the apt-get autoremove command doesn't already
delete the locales package. But removing it explicitly in the
98-remove_unwanted_packages hook works.

wiki/src/home/testing.ar.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.ca.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.id.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.pl.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.ru.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.sr_Latn.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.tr.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.zh.po: updating as wiki/src/home/testing.de.po has changed.
wiki/src/home/testing.zh_TW.po: updating as wiki/src/home/testing.de.po has changed.

That old list comes from the languages that the first version of Tails Greeter
offered. Nobody remembers why we picked them. We now have a set of consciously
chosen criteria to pick languages that we try to support better than others
⇒ let's focus on those during our manual QA.

I had documented this in our design doc in
March (179b3335). A few months later, sajolida
document this again elsewhere
(ac10f0a3)

Let's not maintain this info in two different places, especially given it is
clearly not obvious how one could/should find the second instance.

wiki/src/install/inc/steps/download.inline.ar.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.ca.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.id.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.pl.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.ru.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.sr_Latn.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.tr.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.zh.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.
wiki/src/install/inc/steps/download.inline.zh_TW.po: updating as wiki/src/install/inc/steps/download.inline.de.po has changed.