changelog 373 KB
Newer Older
anonym's avatar
anonym committed
1
tails (3.12) unstable; urgency=medium
anonym's avatar
anonym committed
2

3 4 5 6 7
  * Major changes
    - Make the USB image the main supported way to install Tails (refs: #15292).
      On first boot, grow the system partition to a size that's a factor
      of the size of the boot medium and randomize GUIDs (Closes: #15319).
    - Upgrade Linux to 4.19, version 4.19.13-1 (Closes: #16073, #16224).
intrigeri's avatar
intrigeri committed
8 9 10
      Fixes CVE-2018-19985, CVE-2018-19406, CVE-2018-16862, CVE-2018-18397,
      CVE-2018-18397, CVE-2018-18397, CVE-2018-18397, CVE-2018-19824,
      CVE-2018-14625.
11 12 13 14
    - Remove Liferea (Closes: #11082, #15776).
    - Upgrade to the Debian Stretch 9.6 point-release.

  * Security fixes
anonym's avatar
anonym committed
15
    - Upgrade Tor Browser to 8.0.5 (MFSA-2019-02; Closes #163883).
16 17 18 19 20 21 22 23 24 25
    - Upgrade Thunderbird to 60.4.0 (DSA-4362-1; Closes: #16261).
    - Upgrade OpenSSL to 1.0.2q-1~deb9u1 (DSA-4355-1).
    - Upgrade libarchive to 3.2.2-2+deb9u1 (DSA-4360-1).
    - Upgrade GnuTLS to 3.5.8-5+deb9u4 (CVE-2018-10844, CVE-2018-10845).
    - Upgrade libgd3 to 2.2.4-2+deb9u3 (CVE-2018-1000222, CVE-2018-5711).
    - Upgrade libmspack to 0.5-1+deb9u3 (CVE-2018-18584, CVE-2018-18585).
    - Upgrade libopenmpt to 0.2.7386~beta20.3-3+deb9u3 (CVE-2018-10017).
    - Upgrade libx11 to 2:1.6.4-3+deb9u1 (CVE-2018-14598, CVE-2018-14599,
      CVE-2018-14600).
    - Upgrade libxcursor to 1:1.1.14-1+deb9u2 (CVE-2015-9262).
anonym's avatar
anonym committed
26
    - Upgrade NetworkManager to 1.6.2-3+deb9u2+0.tails1 (CVE-2018-15688).
27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
    - Upgrade wpa to 2:2.4-1+deb9u2 (CVE-2018-14526).
    - Upgrade zeromq3 to 4.2.1-4+deb9u1 (CVE-2019-6250).

  * Bugfixes
    - Fix Totem's access to the Internet when it's started from the Applications
      menu.
    - Rename HTP pools to avoid confusion (Closes: #15428).
    - Fix memory erasure on shutdown with systemd v239+, by mounting
      a dedicated tmpfs on /run/initramfs instead of trying to remount /run
      with the "exec" option (Closes: #16097).
    - Make the KeePassX wrapper dialog translatable.
    - Fix detection of first Thunderbird run.

  * Minor improvements and updates
    - Upgrade tor to 0.3.4.9-1~d90.stretch+1.
    - Upgrade Mesa to 18.2.6-1~bpo9+1, libdrm to 2.4.95-1~bpo9+1,
      and libglvnd to 1.1.0-1~bpo9+1.
    - Upgrade firmware-linux and firmware-nonfree to 20190114-1.
    - Upgrade amd64-microcode to 3.20181128.1.
    - Upgrade intel-microcode to 3.20180807a.2~bpo9+1.
    - Remove the boot readahead feature (Closes: #15915).
      In most supported use cases, it did not improve boot time anymore,
      or even increases it.
    - Require TLS 1.2 in our Upgrader and tails-security-check (Closes: 11815).
    - Enable O_CREAT restriction in /tmp directories for FIFOs and regular
      files (Closes: #16072).
    - Upgrade systemd to 240-4~bpo9+0tails1 (Closes: #16352).
      Fixes CVE-2018-16864, CVE-2018-16865, and CVE-2018-16866.
    - Upgrade Enigmail to 2.0.8-5~deb9u1 (Closes: #15657).
    - Upgrade Torbirdy to 0.2.6-1~bpo9+1 (Closes: #15661).
    - Modify Torbirdy configuration in a way that's easier to maintain.
intrigeri's avatar
intrigeri committed
58 59
    - Tell the user they need to use sudo when they attempt to use su
      (Closes: #15583).
60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86

  * Build system
    - Make the build of the USB image reproducible (Closes: #15985).
    - Allow specifying which set of APT snapshots shall be used during
      the build, with the APT_SNAPSHOTS_SERIALS build option (Closes: #15107).
    - Fix more GIDs and display more information when changing UIDs or GIDs
      fails (Closes: #16036).
    - Remove obsolete patches, refresh remaining ones to apply on top
      of currently installed packages version.
    - Disable irrelevant recurring jobs in Vagrant build box (refs: #16177)
      that increase the chance of FTBFS due to mksquashfs being reaped
      by the OOM killer.
    - Adjust for recent GnuPG error'ing out when it has no controlling terminal.

  * Test suite
    - Adjust test suite for USB image:
      - Add tests that exercise behavior on first boot from a device
        installed using the USB image (Closes: #16003).
      - Drop tests for use cases we don't support anymore with the introduction
        of the USB image (refs: #16004).
      - Adjust remaining tests to focus on main supported use cases,
        i.e. Tails installed from a USB image (refs: #16004.
    - In scenarios where we simulate MAC spoofing failure, test safety-critical
      properties even if the desktop notification is buggy (refs: #10774).
    - Update expected title for our Redmine (Closes: #16237).
    - Update expected image for OpenPGP key search.

anonym's avatar
anonym committed
87
 -- Tails developers <tails@boum.org>  Mon, 28 Jan 2019 13:26:26 +0100
88

89
tails (3.11) unstable; urgency=medium
90

91 92 93 94 95 96 97 98
  * Security fixes
    - Upgrade Tor Browser to 8.0.4-build2 (Closes: #16193).
    - Upgrade Thunderbird to 60.3.0-1~deb9u1.0tails1 (Closes: #16118).
    - Thunderbird: unconditionally disable Autocrypt, as it is not safe in
      its current state (See: #15923, Closes: #16186).
    - Upgrade Linux to 4.18.20 and aufs to 4.18.11+-20181119
      (Closes: #16145).
    - Upgrade cURL to 7.52.1-5+deb9u8 (DSA-4331).
99
    - Upgrade Ghostscript to 9.26~dfsg-0+deb9u1 (DSA-4336, DSA-4346).
100 101 102 103 104 105 106
    - Upgrade Perl to 5.24.1-3+deb9u5 (DSA-4347).
    - Upgrade Policykit to 0.105-18+deb9u1 (DSA-4350).
    - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u4 (DSA-4345).
    - Upgrade OpenSSL to 1.1.0j-1~deb9u1 (DSA-4348).
    - Upgrade libtiff to 4.0.8-2+deb9u4 (DSA-4349).

  * Bugfixes
107 108 109 110 111 112 113
    - Tails Upgrader:
      · Improve support for incremental upgrades to avoid issues with
        partially applied upgrades (Closes: #14754).
      · Add a prompt after the IUK has been downloaded so the user can
        control when the network will be disabled; previously this was
        done without users having a say, possibly leading to confusion and
        lost work (Closes: #15282).
114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140
    - Thunderbird: always set locale according to environment (Closes: #16113).

  * Minor improvements and updates
    - Remove packages which were needed for getTorBrowserUserAgent
      (Closes: #16024).
    - Fix persistence configuration window opening on full screen
      (Closes: #15894).
    - Time sync: don't temporarily increase tor's log level when using
      bridges/PTs (Closes: #15743).
    - Warn about non-free software depending on the host operating system
      and/or virtualization stack (Closes: #16195).

  * Build system
    - Create USB image after building the ISO, and include it in build
      artifacts (Closes: #15984, #15985, #15990).
    - Release process: adapt to IDF v2 (Closes: #16171).

  * Test suite
    - Add new Using "VeraCrypt encrypted volumes" feature, with scenarios
      split into two parts: "Unlock VeraCrypt Volumes" and "GNOME Disks"
      (Closes: #14469, #14471, #15238, #15239).
    - Reintroduce "Clock is one day in the future in bridge mode" test
      (Closes: #15743).
    - Make starting apps via GNOME Activities Overview more robust
      (Closes: #13469).
    - Check for "Upgrading the system" and adjust to "Upgrade successfully
      downloaded" new UI (See: #14754, #15282).
141

142
 -- Tails developers <tails@boum.org>  Mon, 10 Dec 2018 20:37:06 +0100
143

144
tails (3.10.1) unstable; urgency=medium
145

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
146
  * Declare that Enigmail is compatible with Thunderbird 60.*.
147

148
 -- Tails developers <tails@boum.org>  Tue, 23 Oct 2018 01:30:00 +0200
149

150
tails (3.10) unstable; urgency=medium
anonym's avatar
anonym committed
151

152 153 154 155 156
  * Security fixes
    - Harden sudo config to avoid potential future privilege escalation
      (Closes: #15829).
    - Upgrade Linux to 4.18 and aufs to 4.18-20181008 (Closes: #15936).
    - Upgrade the snapshot of the Debian archive to 2018100901 accordingly.
157
    - Upgrade Tor Browser to 8.0.3-build1 (Closes: #16067).
158
    - Upgrade Thunderbird to 60.2.1 (Closes: #16037).
159 160 161 162 163 164 165 166

  * Bugfixes
    - Fix installation of mesa/stretch-backports by installing libwayland*
      from stretch-backports (Closes: #15846).
    - Tor Browser AppArmor profile patch: update to apply cleanly on top
      of torbrowser-launcher 0.2.9-5.
    - Additional Software: fix issues spotted during the code review
      (Closes: #15838).
167 168
    - Additional Software: make sure to offer persistence only for newly
      installed packages, avoiding inconsistency (Closes: #15983).
169 170 171 172 173 174 175
    - Improve button labels in confirmation dialogs of the Tails installer
      (Closes: #11501).
    - Hardcode User Agent in htpdate.user-agent (Closes: #15912), as the
      Tor Browser doesn't expose it anymore.
    - Fix encoding-related crashes in Tails Installer (Closes: #15166).
    - Set the Firefox preferences to spoof English, to avoid leaking
      information about locale settings (Closes: #16029).
176 177 178 179
    - VeraCrypt: Hide PIM entries in GNOME Shell and Disks, since a newer
      cryptsetup would be needed (Closes: #16031).
    - VeraCrypt: Fix support for multiple encryption, by iterating over
      all children in the device-mapper tree (Closes: #15967).
180 181 182
    - Update translations.

  * Minor improvements and updates
183 184
    - Add dmsetup and losetup output in WhisperBack reports to help debug
      VeraCrypt-related issues (Closes: #15966).
185 186 187 188 189
    - Let AppArmor allow access to /usr/local/share/mime, reducing noise
      in logs due to many DENIED entries (Closes: #15965).
    - Use proper stem.connection module in onion-grater instead of trying
      to read the auth cookie manually: that's fragile and breaks some use
      cases (e.g. custom auth cookie).
190
    - Unlock VeraCrypt Volumes: Improve internationalization support.
191 192 193 194 195 196

  * Test suite
    - Ensure the test suite doesn't break when changing the headline of
      /home (Closes: #12156).
    - Update test suite for updated button labels in confirmation dialogs
      of the Tails installer (Closes: #11501).
anonym's avatar
anonym committed
197

198
 -- Tails developers <tails@boum.org>  Tue, 23 Oct 2018 01:30:00 +0200
anonym's avatar
anonym committed
199

anonym's avatar
anonym committed
200
tails (3.9.1) unstable; urgency=medium
201

202 203
  * Security fixes
    - Upgrade Tor Browser to 8.0.2, based on Firefox 60.2.1 (Closes: #16017).
anonym's avatar
anonym committed
204 205
    - Upgrade Thunderbird to 60.0-3~deb9u1.0tails2 (Closes: #15959). Also
      imported the same security fixes that caused Tor Browser 8.0.2.
206 207 208 209 210 211 212 213 214
    - Upgrade curl to 7.52.1-5+deb9u7 (DSA-4286).
    - Upgrade Ghostscript to 9.20~dfsg-3.2+deb9u5 (DSA-4294).
    - Upgrade libarchive-zip-perl to 1.59-1+deb9u1 (DSA-4300).
    - Upgrade libkpathsea6 to 2016.20160513.41080.dfsg-2+deb9u1 (DSA-4299).
    - Upgrade LittleCMS 2, aka. liblcms2-2, to 2.8-4+deb9u1 (DSA-4284).
    - Upgrade Python 2.7 to 2.7.13-2+deb9u3 (DSA-4306).
    - Upgrade Python 3.5 to 3.5.3-1+deb9u1 (DSA-4307).

  * Bugfixes
anonym's avatar
anonym committed
215 216 217
    - Make Thunderbird translated in non-English locales via
      intl.locale.requested, which works correctly since 60.0-3
      (Closes: #15942).
218 219 220
    - Totem: backport AppArmor profile fix to allow opening the help
      (Closes: #15841)
    - Remove mutt, that was accidentally installed in 3.9 (Closes: #15904).
sajolida's avatar
sajolida committed
221
    - Fix VeraCrypt volumes not being opened in GNOME Files (Closes: #15954).
222 223 224 225 226 227 228
    - Fix displaying the "General" section in the Tor Browser preferences
      (Closes: #15917).
    - Fix APT pinning at Tails runtime for our custom APT repository
      and for Debian backports (Closes: #15837, #15973).

  * Minor improvements and updates
    - Upgrade tor to 0.3.4.8-1~d90.stretch+1 (Closes: #15889).
229

anonym's avatar
anonym committed
230
 -- Tails developers <tails@boum.org>  Wed, 03 Oct 2018 12:12:33 +0200
231

intrigeri's avatar
intrigeri committed
232
tails (3.9) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
233

intrigeri's avatar
intrigeri committed
234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
  * Major changes
    - Upgrade Tor Browser to 8.0 (Closes: #15803, #15907).
      Notable user-visible changes and relevant details:
      · Adjust to the fact Tor Browser 8.0a10 replaces firefox with a wrapper.
      · Don't use the bundled copy of libstdc++.so.6, ours is recent enough.
      · Drop obsolete Torbutton prefs (Closes: #15706).
      · Switch back to 128px icons (Closes: #15081).
      · AppArmor profile: take into account new Firefox binary path.
    - Upgrade Thunderbird to 60.0 (Closes: #15792).
      Notable user-visible changes and relevant details:
      · AppArmor profile: patch to avoid conflicting x modifiers for ps(1).
    - Upgrade tor to 0.3.4.7-rc (Closes: #15772).

  * Security fixes
    - Upgrade Linux to 4.17.17-1 and intel-microcode to 3.20180807a.1
      This fixes CVE-2018-3620 aka. Foreshadow aka. L1 Terminal Fault
      (Closes: #15796).
    - Upgrade OpenSSH to 1:7.4p1-10+deb9u4 (DSA-4280).

  * Bugfixes
    - Fix Totem on Intel graphics cards by inlining the backported mesa
      and dri-enumerate abstractions into its AppArmor profile: they are needed
      with recent Mesa and libdrm (Closes: #15821). Regression introduced
      in 3.9~rc1.
    - Fix unlocking "hidden" TrueCrypt/VeraCrypt volumes via GNOME Shell
      (Closes: #15843).
    - Fix confusing error message when unlocking TrueCrypt/VeraCrypt volumes
      (Closes: #15733).
    - Revert to Stretch's X.Org nouveau video driver (Closes: #15833).
      It seems that the regression brought by the upgraded one
      is worse than the improvements reported after our call for testing.
      Regression introduced in 3.9~rc1.
    - Use the intel X.Org driver for Intel Corporation UHD Graphics 620.
    - Fix regressions introduced in 3.9~rc1 in/by Additional Software Packages:
      · Don't break new empty persistence configuration files creation when
        permissions are incorrect (Closes: #15802).
      · Fix UX when the user has specified a distribution or version
        for a given package in their live-additional-software.conf
        (Closes: #15822).
      · Don't show installation notifications on upgrade (Closes: #15879).
    - Make more Additional Software Packages strings translatable in the
      configuration dialog and PolicyKit messages.

  * Minor improvements and updates
    - Upgrade firmware-nonfree to 20180825-1.
    - Update the deb.torproject.org APT repository signing key.
    - Unlock VeraCrypt Volumes: add disclaimer (Closes: #15849).

  * Test suite
    - Update Thunderbird test suite for 60.0 (Closes: #15791).
    - Fix various robustness issues.
    - Make the Chutney nodes use a higher V3AuthVotingInterval to make client
      bootstrap more robust (Closes: #15799).
    - Update the Tor Launcher binary path.
    - Adjust to the fact "New Circuit for this Site" is now in the site
      information and not under the Torbutton anymore.
    - Delete unused images.
intrigeri's avatar
intrigeri committed
291

intrigeri's avatar
intrigeri committed
292
 -- Tails developers <tails@boum.org>  Tue, 04 Sep 2018 12:15:43 +0000
intrigeri's avatar
intrigeri committed
293

intrigeri's avatar
intrigeri committed
294
tails (3.9~rc1) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
295

intrigeri's avatar
intrigeri committed
296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315
  * Major changes
    - Integrate the Additional Software Packages feature into the desktop
      and revamp the interface of "Configure Persistent Volume".
    - Support TrueCrypt/VeraCrypt encrypted volumes on the desktop.
    - Upgrade Tor Browser to 8.0a9, based on Firefox 60 ESR (Closes: #15023).
      Notable user-visible changes and relevant details:
      · Drop search engine customization and stick to Tor Browser's defaults.
      · Upgrade uBlock Origin to its WebExtension version and now rely
        on the filter lists shipped in the Debian package.
      · Tweak the number of web content processes to work better with 2 GiB
        of RAM (Closes: #15716).
      · Revamp how we're handling our custom prefs, drop obsolete ones,
        reduce our delta with pristine Tor Browser.
    - Upgrade Thunderbird to 60.0b10 (Closes: #15091). Notable details:
      · Install Torbirdy 0.2.5 from stretch-backports and drop our patches
        that were merged upstream.
      · Enable the optional part of the fixes for EFAIL (Closes: #15602).
    - Upgrade Linux to 4.17 (Closes: #15763).
    - Upgrade tor to 0.3.4.6-rc (Closes: #15770).
    - Upgrade to Debian Stretch 9.5.
bertagaz's avatar
bertagaz committed
316

intrigeri's avatar
intrigeri committed
317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365
  * Security fixes
    - Upgrade CUPS to 2.2.1-8+deb9u2 (DSA-4243).
    - Upgrade Exiv2 to 0.25-3.1+deb9u1 (DSA-4238).
    - Upgrade FUSE to 2.9.7-1+deb9u1 (DSA-4257).
    - Upgrade GDM to 3.22.3-3+deb9u2 (DSA-4270).
    - Upgrade libsoup to 2.56.0-2+deb9u2 (DSA-4241).
    - Upgrade Imagemagick to 8:6.9.7.4+dfsg-11+deb9u5 (DSA-4245).
    - Upgrade ffmpeg to 7:3.2.12-1~deb9u1 (DSA-4258, DSA-4249).
    - Upgrade libmspack to 0.5-1+deb9u2 (DSA-4260).
    - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u3 (DSA-4271).
    - Upgrade the Apache XML Security for C++ library to 1.7.3-4+deb9u1
      (DSA-4265).

  * Bugfixes
    - Don't display the Enigmail configuration wizard in every Tails session
      (Closes: #15693, #15746). Fix against Tails 3.8.
    - Make the torstatus GNOME Shell extension actually translatable
      (Closes: #15715). Fix against the first Tails release that included
      this extension.
    - Drop Icedove  Thunderbird migration code which started causing trouble.
    - Tails Installer:
      · Link to upgrade documentation when upgrading (Closes: #7904).
      · Show the reinstall option only when the device is big enough to make
        a full reinstallation (Closes: #14810).
      · Make the main window fit in a 600px-high screen (Closes: #14849).
      · Show the correct device size in the reinstall confirmation dialog
        (Closes: #15590).
    - Tails Greeter: don't display file:/// URLs to users (Closes: #15582).

  * Minor improvements and updates
    - Install Mesa and libdrm* from stretch-backports and upgrade the Nouveau
      X.Org video driver to 1.0.15. This improves support for some graphics
      cards such as NVIDIA Pascal series (Closes: #14910)
    - htpdate: improve diagnostics output when the date header can't be fetched.
    - Onion Grater: support named AppArmor profiles.
    - Update Onion Grater's config for new Tor Browser AppArmor profile name.
    - Enable e10s in the Unsafe Browser.
    - Delete all search plugins for the Unsafe Browser (Closes: #15708).
    - Display a deprecation warning when starting Liferea (#11082).
    - Upgrade VirtualBox guest modules to 5.2.16-dfsg-3~bpo9+2.
    - Use Tor Browser for browsing the documentation even when offline
      (Closes: #15720).
    - Provide feedback while Tor Browser, "Tails documentation"
      or "Report an error" are starting (Closes: #15101).
    - WhisperBack: remove the right pane (Closes: #7180).
    - tails-debugging-info: return machine-readable, structured data.
      Adjust WhisperBack accordingly (Closes: #8514). This paves the way
      towards more usable bug reports (#8722).
    - Port lots of our Perl code to more lightweight libraries.
366 367
      This decreases the amount of memory used by the persistence
      configuration interface.
intrigeri's avatar
intrigeri committed
368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398
    - Do not hide applications that require an admin password (Closes: #11013).
    - Try unlocking every persistent volume when multiple ones are
      available (Closes: #15653).
    - Upgrade Electrum to 3.1.3-1~bpo9+1.
    - Upgrade most firmware to 20180518-1.
    - Upgrade Intel microcode to 3.20180703.2~bpo9+1.
    - Upgrade AMD microcode to 3.20180524.1.

  * Build system
    - Drop AppArmor feature set pinning: this is now done in Debian Stretch
      (Closes: #15341).
    - Remove the now unused deb.torproject.org sid APT source (Closes: #15638).
    - Install OnionShare from our custom APT repo instead of from sid.
      We've mistakenly tracked sid for a while and it has become a problem,
      so stick to the version that works for us until Tails 4.0.
    - Fix building the ISO on zfs by dropping the cache=none setting for
      vmproxy's storage (Closes: #14404).
    - Update the Vagrant basebox for any change under vagrant/.
      Previously, some relevant changes were not effective until something under
      vagrant/definitions/tails-builder/ was changed.
    - Make intltool ignore .py files: `intltool-update --maintain` seems to be
      buggy with .py files.
    - Refresh our CUPS AppArmor profile patch to apply on 2.2.1-8+deb9u2.
    - Make it more obvious that the .orig file check is fatal (Closes: #15727).
    - Delete baseboxes once they're 6 months old instead of 4.
      This is more in line with the delay between our major releases these days.
    - Rename /usr/share/amnesia to /usr/share/tails. It was about time.
    - Abort the build if /etc/{passwd,group} has changed (Closes: #15419).
      Such changes can break Tails after an automatic upgrade was applied
      so let's detect it ASAP. Consequently, ensure a few GIDs — that wanted
      to play musical chairs — are the same as in Tails 3.8 (Closes: #15695).
399 400
    - Don't fail the build if the APT lists don't include any package
      whose name matches ^geoclue.
intrigeri's avatar
intrigeri committed
401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430

  * Test suite
    - Adjust to the new tails-persistence-setup API.
    - Update the Tor Browser's AppArmor profile name.
    - Re-enable the "I can print the current page […]" test.
    - Update tests wrt. the fact tails-upgrade-frontend-wrapper was ported
      to Python (Closes: #15379).
    - Make a test more robust by waiting for the page to have loaded.
    - Adjust to the fact the WhisperBack debugging info is now configured
      in a machine-readable file.
    - Remove test for tails-debugging-info, that has been a no-op for a while.
    - Adjust for Tor Browser 8.
    - Make the "I open the address" step more robust and accordingly
      stop marking the tests that use it in the Unsafe Browser
      as fragile (refs: #14771).
    - De-duplicate a number of images of standard GTK+ 3 widgets.
    - Make the audio and WebM tests more robust.
    - Make the "I start the Tor Browser in offline mode" step more robust.
    - Make the "AppArmor has (not )? denied" step more robust.
    - Don't try and use XVFB_PID if it's not set (Closes: #15730).
    - Adjust Pidgin test to use a certificate that's still in Debian
      (Closes: #15762).
    - Use a hopefully more reliable public GnuPG key and make tests
      more robust against new subkeys being added (Closes: #15771).
    - Stop hard-coding the list of RTL Tor Browser locales.
    - Fix the "Unsafe Browser can be used in all languages supported in Tails"
      test for locales that have a translated homepage (Closes: #11711).
    - Take into account that apt(8) won't return when run in the remote shell
      with the ASP hooks enabled.

intrigeri's avatar
intrigeri committed
431
 -- Tails developers <tails@boum.org>  Thu, 16 Aug 2018 18:37:47 +0000
intrigeri's avatar
intrigeri committed
432

intrigeri's avatar
intrigeri committed
433
tails (3.8) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
434

intrigeri's avatar
intrigeri committed
435
  * Security fixes
intrigeri's avatar
intrigeri committed
436
    - Upgrade Tor Browser to 7.5.6 (MFSA 2018-17; Closes: #15683).
intrigeri's avatar
intrigeri committed
437 438 439 440 441 442 443 444 445 446 447 448 449
    - Upgrade Enigmail to 2.0.7 (partly fixes #15602 aka. EFAIL).
    - Upgrade libgcrypt to 1.7.6-2+deb9u3 (DSA-4231-1).
    - Upgrade perl to 5.24.1-3+deb9u4 (DSA-4226-1).

  * Bugfixes
    - Thunderbird: fix importing public OpenPGP keys from email attachments
      (Closes: #15610).
    - Make the Unsafe Browser home page translatable again (Closes: #15461).

  * Minor improvements
    - Don't display the "Know your rights" message on Thunderbird first run.
    - Move Thunderbird's default userChrome.css to /etc/thunderbird, just like
      we do for Tor Browser, for easier upgrade handling.
intrigeri's avatar
intrigeri committed
450

intrigeri's avatar
intrigeri committed
451
 -- Tails developers <tails@boum.org>  Mon, 25 Jun 2018 09:59:22 +0000
intrigeri's avatar
intrigeri committed
452

intrigeri's avatar
intrigeri committed
453
tails (3.7.1) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
454

intrigeri's avatar
intrigeri committed
455
  * Security fixes
intrigeri's avatar
intrigeri committed
456
    - Upgrade Tor Browser to 7.5.5 (MFSA 2018-14; closes: #15643).
intrigeri's avatar
intrigeri committed
457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489
    - Upgrade Thunderbird to 52.8.0 (DSA-4209-1; Closes: #15607).
      - Partially fixes EFAIL.
      - Fixes importing OpenPGP keys from keyservers with Enigmail.
      - Accordingly refresh our Thunderbird AppArmor profile patch.
    - Upgrade cURL to 7.52.1-5+deb9u6 (DSA-4202-1).
    - Upgrade GnuPG (modern) 2.1.18-8~deb9u2 (DSA-4222-1).
    - Upgrade GnuPG (legacy) to 1.4.21-4+deb9u1 (DSA-4223-1).
    - Upgrade Git to 1:2.11.0-3+deb9u3 (DSA-4212-1).
    - Upgrade PackageKit to 1.1.5-2+deb9u1 (DSA-4207-1).
    - Upgrade procps to 2:3.3.12-3+deb9u1 (DSA-4208-1).
    - Upgrade wavpack to 5.0.0-2+deb9u2 (DSA-4197-1).
    - Upgrade wget to 1.18-5+deb9u2 (DSA-4195-1).
    - Upgrade xdg-utils to 1.1.1-1+deb9u1 (DSA-4211-1).

  * Bugfixes
    - Fix setting a screen locker password with non-ASCII characters
      (Closes: #15636).
    - WhisperBack:
      - Rename the WhisperBack launcher to "WhisperBack Error Reporting"
        so that users have a better chance to understand what it does
        (Closes: #6432)
      - Ensure debugging info in Whisperback reports don't contain email
        signature markers so that email clients forward it in full
        (Closes: #15468).
      - Wrap text written by the user to 70 chars (Closes: #11689).

  * Minor improvements
    - The "Tails documentation" desktop launcher now opens /doc instead of
      the aging /getting_started that confused people during user testing
      (Closes: #15575).

  * Test suite
    - Update to match "Tails documentation" behaviour change.
bertagaz's avatar
bertagaz committed
490

intrigeri's avatar
intrigeri committed
491
 -- Tails developers <tails@boum.org>  Sat, 09 Jun 2018 19:53:51 +0000
bertagaz's avatar
bertagaz committed
492

bertagaz's avatar
bertagaz committed
493
tails (3.7) unstable; urgency=medium
anonym's avatar
anonym committed
494

bertagaz's avatar
bertagaz committed
495
  * Security fixes
bertagaz's avatar
bertagaz committed
496
    - Upgrade Tor Browser to 7.5.4 (MFSA 2018-12, Closes: #15588).
bertagaz's avatar
bertagaz committed
497 498 499 500 501 502 503 504 505
    - Upgrade OpenSSL to 1.1.0f-3+deb9u2 (DSA-4157).
    - Upgrade Perl to 5.24.1-3+deb9u3 (DSA-4172).
    - Upgrade Libre Office to 1:5.2.7-1+deb9u4 (DSA-4178).
    - Upgrade libmad to 0.15.1b-8+deb9u1 (DSA-4192).

  * Bugfixes
    - Enable the removal of OpenPGP keyblock in Whisperback (closes: #7797).
    - Show the logo in Whisperback's About menu (closes: #13198).
    - Use the same font in all the Whisperback report (Closes: #11272).
506
    - Update tails-bugs@tails.boum OpenPGP key (Closes: #15534).
bertagaz's avatar
bertagaz committed
507 508 509 510

  * Minor improvements
    - Stop installing python-qt4 and python-trezor (Closes: #15391).
    - Make WhisperBack easier to find in the GNOME Overview (Closes: #13299).
anonym's avatar
anonym committed
511

bertagaz's avatar
bertagaz committed
512
 -- Tails developers <tails@boum.org>  Tue, 08 May 2018 01:47:22 +0200
anonym's avatar
anonym committed
513

anonym's avatar
anonym committed
514
tails (3.6.2) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
515

anonym's avatar
anonym committed
516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545
  * Security fixes
    - Upgrade Tor Browser to 7.5.3 (MFSA 2018-10, Closes: #15459).
    - Upgrade Thunderbird to 1:52.7.0-1~deb9u1.0tails1 (DSA-4155,
      Closes: #15471).
    - Upgrade libicu to 57.1-6+deb9u2 (DSA-4150).
    - Upgrade intel-microcode to 3.20180312.1~bpo9+1. Implements
      IBRS/IBPB/STIPB support, Spectre-v2 mitigation for: Sandybridge,
      Ivy Bridge, Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake
      (Closes: #15173).

  * Bugfixes
    - Tor Browser AppArmor profile:
     * Grant the main Firefox process access to machine-id: needed for
       IBus support (Closes: #15437).
     * Allow access to extensions installed by the user such as Tails
       Verification (Closes: #15434).
    - Remove packages needed to support Video Acceleration API
      (VA-API) because they breaks opening GNOME Settings and Totem in
      Tails 3.6 on some computers (only NVIDIA for now but perhaps
      other hardware is affected). (Closes: #15433, #15449)
    - Upgrade Linux to 4.15.11-1 and bump the aufs submodule (Closes:
      #15456, #15457).
    - tails-documentation script:
      * open translated documentation page in Tor Browser when online
        (Closes: #15371).
      * use documented syntax for os.execv (Refs: #15332)
      * re-add support for passing a HTML anchor as the second
        argument.
    - Fix issue where the tails-persistence-setup user's guid would be
      changed when it was the uid that was intended (Closes: #15422).
bertagaz's avatar
bertagaz committed
546

anonym's avatar
anonym committed
547
 -- Tails developers <tails@boum.org>  Thu, 29 Mar 2018 17:49:42 +0200
bertagaz's avatar
bertagaz committed
548

intrigeri's avatar
intrigeri committed
549
tails (3.6.1) unstable; urgency=medium
550

intrigeri's avatar
intrigeri committed
551 552 553 554 555 556 557 558
  * Security fixes
    - Upgrade Tor Browser to 7.5.2 (MFSA 2018-08 i.e. CVE-2018-5146).
    - Upgrade libvorbis to 1.3.5-4+deb9u2 (DSA 4140-1 aka. CVE-2018-5146).
    - Upgrade curl to 7.52.1-5+deb9u5 (DSA 4136-1).
    - Upgrade samba to 2:4.5.12+dfsg-2+deb9u2 (DSA 4135-1).

  * Bugfixes
    - Fix ISO build reproducibility (Closes: #15400)
intrigeri's avatar
intrigeri committed
559 560 561
    - Disable Selfrando: Tor Browser upstream currently enables it only
      in non-release builds
      (https://trac.torproject.org/projects/tor/ticket/24912#comment:8).
562

intrigeri's avatar
intrigeri committed
563
 -- Tails developers <tails@boum.org>  Fri, 16 Mar 2018 22:42:00 +0000
564

bertagaz's avatar
bertagaz committed
565
tails (3.6) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
566

root's avatar
root committed
567
  * Major changes
bertagaz's avatar
bertagaz committed
568
    - Upgrade Tor Browser to 7.5.1.
569
    - Upgrade Tor to 0.3.2.10. (Closes: #15158)
intrigeri's avatar
intrigeri committed
570
    - Add ability to lock the screen. (Closes: #5684)
571
    - Add initial support for Meek bridges. (Closes: #8243)
root's avatar
root committed
572 573 574
    - Upgrade to Thunderbird 52.6.0. (Closes: #15298)
    - Enable Thunderbird AppArmor profile. (Closes: 11973)
    - Upgrade Linux to 4.15.0-1. (Closes: #15309).
intrigeri's avatar
intrigeri committed
575
    - Upgrade systemd to 237.
root's avatar
root committed
576
    - Upgrade Electrum to 3.0.6. (Closes: #15022)
bertagaz's avatar
bertagaz committed
577 578
    - Upgrade the base system to the Debian Stretch 9.4 point-release
      (Closes: #15341)
579
    - Port a few shell scripts to Python thanks to GoodCrypto. (Closes: #11198)
anonym's avatar
anonym committed
580

root's avatar
root committed
581 582 583
  * Security fixes
    - Upgrade Intel processor microcode firmware. (Closes: #15173).
    - Upgrade poppler to 0.48.0-2+deb9u1. (CVE-2017-14929, CVE-2017-1000456)
bertagaz's avatar
bertagaz committed
584
    - Upgrade tiff to 4.0.8-2+deb9u2 (CVE-2017-9935, CVE-2017-11335,
root's avatar
root committed
585 586 587 588
      CVE-2017-12944, CVE-2017-13726, CVE-2017-13727, CVE-2017-18013)
    - Upgrade ffmpeg to 7:3.2.10-1~deb9u1. (CVE-2017-17081)
    - Upgrade libtasn1-6 to 4.10-1.1+deb9u1. (CVE-2017-10790, CVE-2018-6003)
    - Upgrade Libre Office to 1:5.2.7-1+deb9u2. (CVE-2018-6871)
bertagaz's avatar
bertagaz committed
589
    - Upgrade libvorbis to 1.3.5-4+deb9u1. (CVE-2017-14632, CVE-2017-14633)
root's avatar
root committed
590
    - Upgrade gcc to 6.3.0-18+deb9u1.
bertagaz's avatar
bertagaz committed
591 592 593
    - Upgrade util-linux to 2.29.2-1+deb9u1. (CVE-2018-7738)
    - Upgrade isc-dhcp to 4.3.5-3+deb9u1 (CVE-2017-3144, CVE-2018-5732,
      CVE-2018-5733)
root's avatar
root committed
594 595

  * Minor improvements
596 597 598
    - Avoid noisy warning at boot time by creating tails-upgrade-frontend's
      trusted GnuPG homedir with stricter permissions, then making it looser.
      (Closes: #7037)
root's avatar
root committed
599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625
    - Drop (broken) Thunderbird dedicated SocksPort. (Closes: #12460)
    - Drop customized update-ca-certificates.service. (Closes: #14756)
    - Update AppArmor cupsd profile. (Closes: #15029)
    - Improve UX when GDM does not start. (Closes: #14521)
    - Install packages needed to support Video Acceleration API.
      (Closes: #14580)
    - Upgrade aufs-dkms for Linux 4.15. (Closes: #15132).
    - Ship pdf-redact-tools, thanks to dachary <loic@dachary.org>.
      (Closes: #15052)
    - Additional Software Packages: convert to python3 and PEP-8.
      (Closes: #15198)
    - Additional Software Packages: do not check for updates every time the
      network gets reconnected. (Closes: #9819)
    - Revert to xorg-xserver from Stretch. (Closes: #15232)
    - Open Tails documentation in Tor Browser when online. (Closes: #15332)
    - Disable Enigmail's Memory Hole feature. (Closes: #15201)
    - Persistence Setup: stop depending on Synaptic. (Closes: #15263)

  * Bugfixes
    - Additional Software Packages: fix the "incomplete online upgrade
      process" bug in offline mode (Closes: #14570)
    - Additional Software Packages: do not block Desktop opening.
      (Closes: #9059)
    - Install OpenPGP Applet 1.1. (Closes: #6398).
    - Repair rng-tools using a real start-stop-daemon program.
      (Closes: #15344)
    - Tails installer: fix bug with unicode status messages. (Closes: #15254)
anonym's avatar
anonym committed
626

root's avatar
root committed
627 628 629
  * Build system
    - Abort if tails-custom-apt-sources failed.
    - Abort the ISO build when DKMS modules are not built. (Closes: #14789).
630
    - Improve how we track dependencies in build hooks. (Closes: #14818)
root's avatar
root committed
631 632 633 634
    - Fix (potential) rare race condition during build.
    - Ensure the SquashFS has /etc/hostname properly configured.
      (Closes: #15322)
    - Bump builder VM's RAM. (Closes: #15310)
anonym's avatar
anonym committed
635

root's avatar
root committed
636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653
  * Test suite
    - Log the list of systemd jobs when systemctl is-system-running fails.
      (Closes: #14772).
    - Allow more time for 'systemctl is-system-running' to succeed.
    - Only support SikuliX, not Sikuli.
    - Disable SPICE clipboard sharing.
    - Don't flood the debug logger with the journal contents.
    - Rescue exception.
    - Enter a name into the Thunderbird account configuration.
      (Closes: #11256)
    - Fix the "I do not see ..." step's case. (Closes: #14929)
    - Mark scenarios that use the "The Report an Error launcher will…" step
      as fragile (Closes: #15321)
    - Test that Tor Browser opens docs when online. (Closes: #15332)
    - Adapt test after warning moved to after Unsafe Browser verification
      dialog. (Closes: #8775)
    - Dogtailify electrum.feature.
    - Add additional software packages feature. (Closes: #14572)
intrigeri's avatar
intrigeri committed
654
    - Disable test that is broken due to a Tor Browser bug. (refs: #15336)
anonym's avatar
anonym committed
655

bertagaz's avatar
bertagaz committed
656
 -- Tails developers <tails@boum.org>  Mon, 12 Mar 2018 21:28:29 +0100
anonym's avatar
anonym committed
657

anonym's avatar
anonym committed
658
tails (3.5) unstable; urgency=medium
anonym's avatar
anonym committed
659

anonym's avatar
anonym committed
660 661 662
  * Security fixes
    - Upgrade amd64-microcode to 3.20171205.1, for the mitigation
      against Spectre (CVE-2017-5715) (Closes: #15148).
anonym's avatar
anonym committed
663
    - Upgrade Tor Browser to 7.5-build3 (Closes:  #15197).
anonym's avatar
anonym committed
664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679
    - Upgrade Thunderbird to 1:52.5.2-2~deb9u1.0tails1 (Closes: #15033)
    - Upgrade gdk-pixbuf to 2.36.5-2+deb9u2.0tails1 (Closes: #15177).
    - Upgrade bind9 to 1:9.10.3.dfsg.P4-12.3+deb9u4.
    - Upgrade libxml2 to 2.9.4+dfsg1-2.2+deb9u2.

  * Minor improvements
    - Upgrade Linux to 4.14.13, which is the first kernel that has the
      "[x86] microcode/AMD: Add support for fam17h microcode loading"
      commit, that's needed to load the AMD fam17h microcode for
      mitigating the Spectre vulnerability (CVE-2017-5715).

  * Bugfixes
    - Drop Claws Mail persistence setting migration. Whenever
      persistent Claws Mail setting is enabled, this creates an empty
      ~/.icedove/ directory, that prevents Thunderbird from starting
      (Closes: #12734).
intrigeri's avatar
intrigeri committed
680
    - Don't prevent the GNOME Applications button from opening its menu if
anonym's avatar
anonym committed
681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698
      time syncing resulted in a shift back in time (Closes: #14250).
    - Tails Installer: when cloning Tails to another USB drive, check
      if the target device has enough space *before* any destructive
      actions are made (Closes: #14622).
    - Tor Browser: make "Print to file" work again, for all locales
      (Closes: #13403, #15024).

  * Build system
    - Fix option passed to cmp: -q is not supported but --quiet is.
      Spotted on feature/buster that's the first branch that exercises
      this code, but there's no reason to fix it only there.

  * Test suite
    - Adapt tests for Tor Launcher 0.2.14.3, i.e. the one shipped with
      Tor Browser 7.5 in Tails 3.5 (Closes: #15064).
    - Add support for creating arbitrarily sized partitions.
    - Add a "Try cloning Tails to a too small partition" scenario
      (regression test for #14622).
anonym's avatar
anonym committed
699

anonym's avatar
anonym committed
700
 -- Tails developers <tails@boum.org>  Tue, 23 Jan 2018 00:57:58 +0100
anonym's avatar
anonym committed
701

anonym's avatar
anonym committed
702
tails (3.4) unstable; urgency=medium
anonym's avatar
anonym committed
703

anonym's avatar
anonym committed
704
  * Security fixes
705
    - Install Linux 4.14.0-3 from sid (Closes: #14976). This enables
706
      the kernel-side mitigations for Meltdown.
anonym's avatar
anonym committed
707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807
    - Upgrade curl to 7.52.1-5+deb9u3.
    - Upgrade enigmail to 2:1.9.9-1~deb9u1.
    - Upgrade gimp to 2.8.18-1+deb9u1.
    - Upgrade imagemagick to 8:6.9.7.4+dfsg-11+deb9u4.
    - Upgrade libav (ffmpeg) to 7:3.2.9-1~deb9u1.
    - Upgrade libxcursor to 1:1.1.14-1+deb9u1.
    - Upgrade libxml-libxml-perl to 2.0128+dfsg-1+deb9u1.
    - Upgrade poppler to 0.48.0-2+deb9u1.
    - Upgrade rsync to 3.1.2-1 3.1.2-1+deb9u1.
    - Upgrade samba to 2:4.5.12+dfsg-2+deb9u1.
    - Upgrade sensible-utils to 0.0.9+deb9u1.
    - Upgrade tor to 0.3.1.9-1~d90.stretch+1.

  * Minor improvements
    - Display TopIcons systray on the left of the system menu. This
      fixes #14796 (on Buster, it is displayed in the middle of the
      screen, on the left of the clock) and an annoying UX problem we
      have on Stretch: OpenPGP applet is in the middle of icons that
      share the exact same (modern, GNOME Shell-like) behaviour, which
      is disturbing when opening one of the modern menus and moving
      the mouse left/right to the others, because in the middle one
      icon won't react as expected, and the nice blue bottom border
      continuity is broken.
    - Use the "intel" X.Org driver for integrated graphics in Intel
      i5-7300HQ (Closes: #14990).
    - Enable HashKnownHosts in the OpenSSH client (Closes: #14995).
      Debian enables HashKnownHosts by default via /etc/ssh/ssh_config
      for good reasons, let's not revert to the upstream default.
    - Pin the AppArmor feature set to the Stretch's kernel one. Linux
      4.14 brings new AppArmor mediation features and the policy
      shipped in Stretch may not be ready for it. So let's disable
      these new features to avoid breaking stuff: it's too hard to
      check if all the policy for apps we ship (and that users install
      themselves) has the right rules to cope with these new mediation
      features.

  * Bugfixes
    - Don't delete downloaded debs after install (Closes: #10958).
    - Install xul-ext-ublock-origin from sid to make the dashboard
      work again(Closes: #14993). Thanks to cacahuatl
      <cacahuatl@autistici.org> for the patch!
    - Additional software feature: use debconf priority critical to
      prevent failure when installing packages otherwise requiring
      manual configuration (Closes: #6038)
    - Don't include anything under /lib/live/mount/medium/ in the
      readahead list (Closes: #14964). This fixes the boot time
      regression introduced in Tails 3.3.

  * Build system
    - Display a more helpful error message when the 'origin' remote
      does not point to the official Tails Git repository. This task
      calls git_base_branch_head() which relies on the fact 'origin'
      points to our official repo.
    - Vagrant: never build the wiki early. This has caused several
      issues throughout the years, the lastest instance being the
      reopening of #14933. (Closes: #14933)
    - Install libelf-dev during the time we need it for building DKMS modules.
    - Make the DKMS build hook verbose, and display DKMS modules build
      logs on failure. This hook is a recurring cause of headaches,
      let's simplify debugging.
    - Remove obsolete duplicate build of the virtualbox-guest DKMS
      module.

  * Test suite
    - Log the list of systemd jobs when systemctl is-system-running
      fails (Closes: #14772). Listing the units is not enough: in most
      cases I've seen, is-system-running returns "starting" which
      means the job queue is not empty, and to debug that we need the
      list of jobs.
    - Only support SikuliX; drop support for Sikuli.
    - Disable SPICE clipboard sharing in the guest. It could only mess
      things up, and in fact has confused me by suddenly setting my
      *host's* clipboard to "ATTACK AT DAWN"... :)
    - Decode Base64.decode64 return value appropriately; it returns
      strings encoded in ASCII-8bit.
    - Don't flood the debug logger with the journal contents.
    - Handle case where $vm is undefined during an extremely early
      scenario failure.
    - Allow more time for 'systemctl is-system-running' to
      succeed. (Refs: #14772)
    - Make Sikuli attempt to find replacements on FindFailed by
      employing fuzz, or "lowering the similarity factor". The
      replacements (if found) are saved among the artifacts, and
      serves as potential drop-in-replacements for outdated
      images. The main use case for this is when the font
      configuration in Tails changes, which normally invalidates a
      large part of our images given that our default high similarity
      factor. We also add the `--fuzzy-image-matching` where the
      replacements are used in case of FindFailed, so the tests can
      proceed beyond the first FindFailed. The idea is that a full
      test suite run will produce replacements for potentially *all*
      outdated images.
    - Fix our findAny() vs findfailed_hook. For findAny() it might be
      expected that some images won't be found, so we shouldn't use
      our findfailed_hook, which is about dealing with the situation
      where images need to be updated.
    - Make sure Pidgin's D-Bus policy changes are applied (Closes:
      #15007). Without the HUP there's a race that we sometimes lose.
    - Nump the Unsafe Browser's start page image (Closes: #15006).
    - Hot-plug a 'pcnet' network device instead of 'virtio' on Sid,
      since the latter is not detected on Sid (Closes: #14819).
anonym's avatar
anonym committed
808

anonym's avatar
anonym committed
809
 -- Tails developers <tails@boum.org>  Mon, 08 Jan 2018 16:57:07 +0100
anonym's avatar
anonym committed
810

anonym's avatar
anonym committed
811
tails (3.3) unstable; urgency=medium
812

anonym's avatar
anonym committed
813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886
  * Major changes
    - Upgrade the base system to the Debian Stretch 9.2 point-release
      which gives us tons of bugfixes (Closes: #14714).
    - Install Linux 4.13.0-1 (Closes: #14789).

  * Security fixes
    - Upgrade Thunderbird to 52.4.0 (Closes: #14963).
    - Upgrade Tor Browser to 7.0.10 (Closes: #14940).
    - Upgrade gdk-pixbuf to 2.36.5-2+deb9u1.0tails1 (Closes: #14729).

  * Minor improvements
    - Upgrade to Tor 0.3.1.8-2~d90.stretch+1, a new stable Tor series.
    - tails-documentation: rewrite in Python + use WebKit for display
      instead of the Tor Browser. Since Tor Browser 7.0.8 rendering of
      local pages (like our docs) fail (#14962) so this is probably a
      temporary workaround of that.
    - Replace the Unsafe Browser's warning pages with static,
      pure-HTML versions. This is truly a *temporary* workaround for
      #14962.
    - Update deb.tails.boum.org APT repo key (Closes: #14927)
    - Refresh Tor Browser AppArmor profile patch to apply on top of
      torbrowser-launcher 0.2.8-4's (Closes: #14923).
    - Drop obsolete manual enabling of AppArmor on the kernel
      command-line: it's now enabled by default, so the (Tails -
      Debian) delta gets smaller. :)

  * Bugfixes
    - Install Tails Installer 5.0.2. Fixes:
      * Most notably, fix an issue preventing Tails Installer from
        installing to drives containing a non-Tails partition that
        (obviously) has affected a lot of users. (Closes: #14755).
      * Fix an issue that made the resulting installations unbootable
        if Tails Installer was using a too recent udisks2, e.g. the
        one currently in Debian Sid (Closes: #14809).
      * Code clean-ups (Closes: #14721, #14722, #14723).
    - Fix UEFI boot for USB sticks installed with Universal USB
      Installer (Closes: #8992).
    - Force Tor Browser and Thunderbird to enable accessibility
      support even if no a11y feature is enabled in GNOME yet (Closes:
      #14752, #9260).
    - Mark our custom Desktop launchers as trusted (Closes: #14793,
      Refs: 14584).
    - Add a systemd --user target for bits of GNOME
      EarlyInitialization managed by systemd, and make the keyboard
      layout configuration as part of it. This fixes an issue where
      the layout chosen in the Greeter sometimes wasn't applied in the
      GNOME session (Closes: #12543).

  * Build system
    - auto/{build,clean,config}: run with `set -eu`.
    - Add script to sanity check the website. Currently it ensures all
      blog posts and security advisories have valid Ikiwiki 'meta
      date' directives, since we depend on it for reproducibility.
      Also make passing this sanity check a pre-condition for building
      the website (Closes: #12726, #14767).
    - Abort the ISO build when DKMS modules were not built.
    - Take into account where DKMS modules get installed nowadays.
    - auto/build: normalize file timestamps in wiki/src before
      building. The copy of the website included in the ISO image has
      "Posted" timestamps that apparently match when we cloned the Git
      repository, which affects reproducibility. (Closes: #14933).
    - Fix reproducibility of builds of topic branches that lag behind
      their base branch with the mergebasebranch build option enabled.
      Two otherwise identical merge commits done at different times
      get different IDs, and we happen to embed in the ISO the ID of
      the commit we're building from. (Closes: #14946)

  * Test suite
    - Bump timeout for "I can save the current page as", otherwise the
      "The Tor Browser directory is usable" scenario fails randomly
      when the system is under load.
    - New scenario: installing Tails to an eligible drive with an
      existing filesystem. This is a regression test for #14755.
    - New scenario: re-installing over an existing Tails installation.
887

anonym's avatar
anonym committed
888
 -- Tails developers <tails@boum.org>  Tue, 14 Nov 2017 04:53:27 +0100
889

anonym's avatar
anonym committed
890
tails (3.2) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
891

anonym's avatar
anonym committed
892 893
  * Major changes
    - Upgrade Linux packages to the Debian kernel 4.12.0-2, based on
894
      mainline Linux 4.12.12 (Closes: #11831, #12732, #14673).
anonym's avatar
anonym committed
895 896

  * Security fixes
anonym's avatar
anonym committed
897
    - Upgrade Tor Browser to 7.0.6-build3 (Closes: #14696).
anonym's avatar
anonym committed
898 899 900 901 902 903 904 905 906 907 908 909 910
    - Upgrade to Thunderbird 52.3.0 (Closes: #12639).
    - Deny access to Pidgin's D-Bus service (Closes: #14612). That D-Bus
      interface is dangerous because it allows _any_ application running
      as `amnesia' that has access to the session bus to extract
      basically any information from Pidgin and to reconfigure it:
      https://developer.pidgin.im/wiki/DbusHowto
    - Block loading of Bluetooth kernel modules (Closes: #14655) and
      block Bluetooth devices with rfkill (Closes: #14655).
    - Add localhost.localdomain to the hosts file to prevent loopback
      leaks to Tor circuits (Closes: #13574). Thanks to tailshark for
      the patch!

  * Minor improvements
911
    - Upgrade to Tails Installer 5.0.1 (Closes: #8859, #8860, #12707). This
anonym's avatar
anonym committed
912 913
      version gets rid of the splash screen, detects when Tails is already
      installed on the target device (and then proposes to upgrade),
914 915
      and generally improves the UX. It also increases the Tails partition
      size and refuses to install to devices smaller than 8 GB.
anonym's avatar
anonym committed
916 917
    - Deprecate Thunderbird's preferences/0000tails.js (Closes: #12680).
    - Install the BookletImposer PDF imposition toolkit (Closes: #12686).
anonym's avatar
anonym committed
918 919 920 921
    - Tor Browser:
      * Fallback to ~/Tor Browser for uploads (Closes: #8917).
      * Silence some common operations that always are denied and
        otherwise would spam the journal (Closes: #14606)
anonym's avatar
anonym committed
922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960
    - Shell library: remove now unused functions (Closes: #12685).
    - Add pppoe to the installed packages (Closes #13463). Thanks to geb
      for the patch!
    - Replace syslinux:i386 with syslinux:amd64 in the ISO9660
      filesystem (Closes: #13513).
    - htpdate: fix date header regexp (Closes: #10495). It seems that
      some servers (sometimes) do not send their headers with first
      letter uppercased, hence a lot of failures to find the date in it.
    - Install aufs-dkms from Debian unstable (Closes: #12732).
    - Install vim-tiny instead of vim-nox (Closes: #12687). On Stretch,
      vim-nox started pulling ruby and rake in the ISO. I think vim-tiny
      would be good enough, and would save a few MiB in the ISO. Those
      who use vim more intensively and want another flavour of vim are
      likely to need persistence anyway, and can thus install a more
      featureful vim with the additional software packages feature.
    - Remove gksu and its and gconf's dependencies (Closes: #12738). We
      use pkexec instead of gksudo. gksu is unmaintained, buggy
      (e.g. #12000), and it is the only reason we ship GConf, which we
      want to remove. The other removals are:
      * libgnomevfs2-extra, which was previously used for SSH/FTP support in
        Nautilus, but isn't needed for that any more.
      * libgnome2-bin which provides gnome-open, which isn't required by
        any application in Tails (as far as we know).
      * Configurations and scripts that become obsolete because of these
        removals.
    - Refresh torbrowser-AppArmor-profile.patch to apply cleanly on top
      of torbrowser-launcher 0.2.8-1 (Closes: #14602).
    - Switch from Florence to GNOME's on-screen keyboard (Closes: #8281)
      and incidentally improve accessibility in GTK+ 2.0 and Qt
      applications. This drops Florence and the corresponding GNOME
      Shell extension.
    - Make ./HACKING.mdwn a symlink again (Closes: #13600).
    - Implement refresh-translations --force .
    - Rework how we handle the individual POT files of our applications.
      Comparing the new temporary POT files we generate with the
      temporary POT files we generated last time (if ever, and if we
      did, for which branch?) is not relevant; these POT files are only
      used for merging into a new tails.pot and *that* one is relevant
      to diff against the old tails.pot.
961
    - Update the Tails signing key. (Closes: #11747)
anonym's avatar
anonym committed
962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002
    - Reproducibility:
      * Ensure reproducible permissions for /etc/hostname (Closes:
        #13623).
      * Patch desktop-file-utils to make its mimeinfo.cache reproducible
        (Closes: #13439).
      * Patch glib2.0 to make its giomodule.cache reproducible (Closes:
        #13441).
      * Patch gdk-pixbuf to make its loaders.cache reproducible (Closes:
        #13442).
      * Patch gtk2.0 and gtk3.0 to make their immodules.cache
        reproducible (Closes: #13440).
      * Remove GCconf: it is a source of non-determinism in the
        filesystem (element order in /var/lib/gconf/defaults/%gconf-tree-*.xml)
        which made Tails unreproducible.
      * Ignore comment updates in POT files, which was a source of
        non-determinism and therefore prevented Tails from being
        reproducible (Closes: #12641).
    - Kernel hardening:
      * Increase mmap randomization to the maximum supported value
        (Closes: #11840). This improves ASLR effectiveness, and makes
        address-space fragmentation a bit worse.
      * Stop explicitly enabling kaslr: it's enabled by default in
        Debian, and this kernel parameter is not supported anymore.
      * Disable kexec, to make our attack surface a bit smaller.

  * Bugfixes
    - Start Nautilus silently in the background when run as root
      (Closes: #12034). Otherwise, after closing Nautilus one gets the
      prompt back only after 5-15 seconds, which confuses users and makes
      our doc more complicated than it should.
    - Ensure pinentry-gtk2 run by Seahorse has the correct $DISPLAY set
      (Closes: #12733).

  * Build system
    - build-manifest-extra-packages.yml: remove squashfs-tools version
      we don't use anymore (Closes: #12684). Apparently our
      apt-get/debootstrap wrapper tricks are enough to detect the
      version of squashfs-tools we actually install and use.
    - Merge base branch earlier, i.e. in auto/config instead of
      auto/build (Closes: #14459). Previously, a given build from a topic
      branch would mix inconsistent versions of things.
anonym's avatar
anonym committed
1003 1004 1005 1006 1007 1008 1009 1010
    - Fail builds started before SOURCE_DATE_EPOCH (Closes:
      #12352). Such builds would not be reproducible, and this is an
      assumption (a reasonable one!) that we do all over the place, so
      let's fail early. While we're at it, let's fail if
      SOURCE_DATE_EPOCH is not set as well. Actually we would fail any
      way if that was the case when reaching our
      99-zzzzzz_reproducible-builds-post-processing build hook, but
      let's fail early.
anonym's avatar
anonym committed
1011 1012 1013

  * Test suite
    - Test the GNOME Root Terminal.
anonym's avatar
anonym committed
1014
    - Take into account that Tails Installer 5.0.1 refuses to install
anonym's avatar
anonym committed
1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025
      Tails to devices smaller than 8 GiB. It'll still allow *upgrading*
      such sticks though.
    - Use 7200 MiB virtual USB drives when we really mean 8 GiB. In the
      real world, USB sticks labeled "8 GB" can be much smaller, so
      Tails Installer will accept anything that's at least 7200 MiB.
      This commit makes us exercise something closer to what happens in
      the real world, and incidentally it'll save storage space on our
      isotesters and improve test suite performance a bit. :)
    - Have unclutter poll every 0.1s instead of continuously. On current
      sid, virt-viewer eats a full CPU and doesn't do its job when
      "unclutter -idle 0" is running.
anonym's avatar
anonym committed
1026
    - Adapt tests for Tails Installer 5.0.1.
anonym's avatar
anonym committed
1027 1028 1029
    - Workaround Pidgin's DBus interface being blocked since we actually
      depend on it for some tests.
    - Test that Pidgin's DBus interface is blocked.
anonym's avatar
anonym committed
1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047
    - Save more data on test suite failures (Refs: #13541):
      * When Tor fails to bootstrap, save Tor logs and chutney nodes
        data.
      * When Htpdate fails to synchronize the clock, save its logs.
      * Always save the systemd journal on failure.
    - When testing emergency shutdown, wait longer for Tails to tell
      us it has finished wiping the memory. The goal here is to help
      us understand whether (Refs: #13462) is a bug in the emergency
      shutdown feature or in our test suite.
    - Restart nautilus-desktop if Desktop icons are not visible
      (Closes: #13461).
    - Test suite: fix assert_raise() when using ruby-test-unit >=
      3.2.5 (Closes: #14654). ruby-test-unit 3.2.5 added native Java
      exception support for JRuby. The fact we defined the :Java
      constant was enough to trigger that JRuby-specific code, which
      failed.
    - Test suite: take into account that click-to-play is not required
      anymore for WebM videos in Tor Browser (Closes: #14586).
intrigeri's avatar
intrigeri committed
1048

anonym's avatar
anonym committed
1049
 -- Tails developers <tails@boum.org>  Mon, 25 Sep 2017 22:23:01 +0200
intrigeri's avatar
intrigeri committed
1050

bertagaz's avatar
bertagaz committed
1051
tails (3.1) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
1052

bertagaz's avatar
bertagaz committed
1053 1054
  * Security fixes
    - Upgrade Tor Browser to 7.0.4-build1 (Closes: #13577).
bertagaz's avatar
bertagaz committed
1055
    - Upgrade Linux to 4.9.30-2+deb9u3.
bertagaz's avatar
bertagaz committed
1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086
    - Upgrade libtiff to 4.0.8-2+deb9u1.
    - Upgrade bind9 to 1:9.10.3.dfsg.P4-12.3+deb9u2.
    - Upgrate evince to 3.22.1-3+deb9u1.
    - Upgrade imagemagick 8:6.9.7.4+dfsg-11+deb9u1.
    - Ensure Thunderbird cleans its temporary directory. (Closes: #13340).

  * Minor improvements
    - Patch gconf to produce reproducible XML output (refs: #12738). This is
      the temporary solution for #12738 in Tails 3.1 which will be reverted
      (and fixed permanently by removing gconf) in Tails 3.2.
    - Apply Debian bts patch to cracklib to produce reproducible dictionnaries
      (Closes: #12909).
    - Upgrade to Debian 9.1 (Closes: #13178).

  * Bugfixes
    - Replace faulty URL in htpdate neutral pool (Closes: #13472).
    - Keep installing a version of Enigmail compatible with Thunderbird 45.x
      (Closes: #13530).
    - Fix the time syncing and Tor notifications translations (Closes: #13437).

  * Build system
    - Upgrade the Vagrant basebox for building ISO images to Stretch
      (Closes: #11738).
    - Fix on-disk build by bumping Vagrant build VM memory to 768M
      (Closes: #13480).
    - Fix rescue build option by exporting TAILS_BUILD_FAILURE_RESCUE
      (Closes: #13476).

  * Test suite
    - mark gnome screenshot scenario as fragile (refs: #13458)
    - mark UEFI scenario as fragile (refs: #13459).
intrigeri's avatar
intrigeri committed
1087

1088
 -- Tails developers <tails@boum.org>  Sat, 05 Aug 2017 15:25:51 +0200
intrigeri's avatar
intrigeri committed
1089

anonym's avatar
anonym committed
1090
tails (3.0.1) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
1091

anonym's avatar
anonym committed
1092 1093 1094 1095 1096 1097 1098
  * Security fixes
    - Upgrade tor to 0.3.0.9-1~d90.stretch+1 (Closes: #13253).
    - Upgrade Linux to 4.9.30-2+deb9u2.
    - Upgrade libc to 2.24-11+deb9u1.
    - Upgrade libexpat1 to 2.2.0-2+deb9u1.
    - Upgrade libgcrypt20 to 1.7.6-2+deb9u1.
    - Upgrade libgnutls30 to 3.5.8-5+deb9u1.
intrigeri's avatar
intrigeri committed
1099
    - Enable Debian security APT sources (Closes: #12309).
intrigeri's avatar
intrigeri committed
1100

anonym's avatar
anonym committed
1101 1102 1103 1104 1105
  * Minor improvements
    - Use a higher resolution image in Tails persistence setup
      (Closes: #12510).

  * Bugfixes
1106
    - Forcibly set $SSH_AUTH_SOCK before starting GNOME
anonym's avatar
anonym committed
1107 1108 1109 1110 1111 1112 1113
      Shell. Apparently, due to a race condition, GNOME keyring
      sometimes fails to tell the session manager about the correct
      SSH_AUTH_SOCK, and thus GNOME Terminal hasn't this variable set
      and any ssh process started in there won't use the (perfectly
      working) SSH agent (Closes: #12481).
    - Fix issue that made Tails Installer rejects working USB drives,
      pretending they're not "removable" (Closes: #12696).
1114
    - Make behavior of the power button and lid close actions in the Greeter
anonym's avatar
anonym committed
1115 1116 1117 1118 1119 1120 1121 1122 1123
      consistent with the regular GNOME session (Closes: #13000).

  * Build system
    - Track the latest debian-security archive for the corresponding
      APT sources, and not for the unrelated jessie-updates (Closes:
      #12829).
    - Print APT sources used in the build VM, to help debugging issues
      such as #12829.

anonym's avatar
anonym committed
1124
 -- Tails developers <tails@boum.org>  Tue, 04 Jul 2017 15:59:18 +0200
intrigeri's avatar
intrigeri committed
1125

intrigeri's avatar
intrigeri committed
1126
tails (3.0) unstable; urgency=medium
1127

intrigeri's avatar
intrigeri committed
1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217
  * Major changes
    - Upgrade Tor Browser to 7.0.1 (Closes: #12635, #12657).
    - Upgrade to a new snapshot of the Debian and Torproject
      APT repositories: respectively 2017060904 and 2017060903
      (Closes: #12609).

  * Minor improvements
    - Tor Browser: enable Electrolysis (e10s), i.e. render content in a separate
      child process, which will allow to improve performance and security
      further along the road. This required us to drop our branding add-on
      and re-implement its functionality in our Tor Browser wrapper
      (Closes: #12569).
    - Clean obsolete cached packages when using the Additional Software Packages
      feature (Closes: #12400).
    - Improve KeePassX database migration handling (Closes: #12375).
    - Upgrade OnionShare to 0.9.2, from Debian sid as it has been removed
      from Stretch (Closes: #12610).
    - Upgrade Tor to 0.3.0.8 (Closes: #12656).
    - Drop obsolete bilibop patch, that was applied in 0.5.2.1.
    - Include disk space usage information in the WhisperBack bug reports.
    - Reorder technical details in WhisperBack bug reports in way that makes
      more sense when reading them.
    - Convert lc.py to Python 3.
    - Simplify some Python code thanks to subprocess.check_ouput.
    - Set the initial keyboard focus on the "Start Tails" button
      in Tails Greeter (Closes: #12509).
    - Convert Tails Greeter's Debian packaging to current best practices.

  * Bugfixes
    - Fix persistent Thunderbird configuration migration when there is
      a mimeTypes.rdf, that doesn't contain any associations to "icedove"
      or "/usr/bin/iceweasel" (Closes: #12580).
    - Fix persistent browser bookmarks, by generating them from an sqlite dump
      (Closes: #12568).
    - Use the "intel" X.Org driver for Intel Atom/Celeron/Pentium Processor
      x5-E8000/J3xxx/N3xxx Integrated Graphics Controller.
    - `exec' from our Thunderbird wrapper so it doesn't remain running.
    - Tails Installer: don't allow installing on non-removable drives
      (Closes: #10731).
    - Fetch the torbrowser-launcher sources from Debian sid:
      it's been removed from Debian testing.
      Refresh torbrowser-AppArmor-profile.patch accordingly.
    - Unsafe Browser: remove the search bar, that's currently buggy
      and its presence only encourages unsupported usage (Closes: #12573).
    - Unsafe Browser: disable searching in the address bar. It can result
      in leaking hostnames and credentials to the default search
      engine operator (Closes: #12540).
    - Make our omni.ja modifications reproducible (Closes: #12620).
    - Generate the fontconfig cache in a reproducible manner (Closes: #12567).
    - Don't include torrents/rss.html in the ISO. It's not generated
      in a deterministic manner and is worthless in the ISO (Closes: #12619).
    - Improve the language  default keyboard layout mapping
      in Tails Greeter (Closes: #12547).
    - Don't close Tails Greeter's main window when Alt-F4 is pressed
      (Closes: #12462).

  * Test suite
    - Run emergency_shutdown.feature after usb_*.feature, to reduce disk
      space requirements (Closes: #12565).
    - Deal with server messages in Pidgin.
    - Improve Pidgin connectivity check robustness.
    - Flag the Synaptic test as fragile (i.e. #12586).
    - Optimization: only test once that Tails, booted on DVD, eventually
      shuts down after wiping memory.
    - Move tests about the shutdown applet to a dedicated feature,
      as they have nothing to do with Tails' "emergency" shutdown feature.
    - Adapt the network connectivity check to Stretch, and improve it to check
      both link and IP connectivity (Closes: #12602).
    - Apply a fix from upstream Git to mutter, to fix some of its interactions
      with dogtail (Closes: #11718).
    - Mark "Scenario: Watching a WebM video" as fragile (i.e. #10442).

  * Build system
    - Set create_box -e, to make the vagrant box generation a bit more robust.
      (Closes: #12578).
    - Install kernel from backports and Tails build deps before performing
      APT upgrade, to avoid useless bandwidth usage (Closes: #12529).
    - Update submodules after merging the base branch (Closes: #12556).
    - Rakefile: fix date comparison in basebox:clean_old (Closes: #12575).
    - Rakefile: have basebox:clean_old delete baseboxes more than 4 months old
      (refs: #12576).
    - Also check for fuzzy patches' .orig files at the end of our build hooks,
      so we detect any fuzzy patches applied by hooks (Closes: #12617).
    - Remove .orig files for patches we allow to be fuzzy.
    - Don't pre-build the wiki when mergebasebranch is enabled.
      When pre-building the wiki, we modify the PO files which results in a
      conflict from the base branch merge in case it modifies the same
      files, which breaks the build (Closes: #12611).
    - Rakefile: add a task that removes all tails-builder-* libvirt volumes
      (Closes: #12599).
1218

intrigeri's avatar
intrigeri committed
1219
 -- Tails developers <tails@boum.org>  Sat, 10 Jun 2017 14:39:10 +0000
1220

anonym's avatar
anonym committed
1221
tails (3.0~rc1) unstable; urgency=medium
1222

1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238
  * Major changes
    - Install Thunderbird 1:45.8.0-3+tails2 and handle the Icedove → Thunderbird
      migration, including wrt. persistent data (Closes: #11712, #12242).
      This package also has the patch from
      https://bugzilla.mozilla.org/show_bug.cgi?id=1281959 applied,
      to ease future integration of the Thunderbird AppArmor profile.
      Also, drop the Claws → Icedove migration path.
    - Upgrade to a new snapshot of the Debian and Torproject
      APT repositories: 2017051803 (Closes: #12554).
    - Upgrade Linux packages to the Debian kernel 4.9.0-3, based on
      mainline Linux 4.9.25.
    - Replace the kexec-based memory erasure feature with the Linux kernel's
      memory poisoning (Closes: #12354, #12428). The kexec-based implementation
      was not reliable enough and provided a poor UX. Instead, we now return
      to the initramfs on shutdown and unmount all filesystems there, so their
      content and corresponding caches are erased.
1239 1240 1241 1242 1243 1244
    - Upgrade Tor Browser to 7.0a4 based on Firefox 52.1.1esr (Closes:
      #12115, #12464):
      * Unfortunately e10s (multi-process Firefox) is disabled (#12569).
      * Unfortunately persistent bookmarks created for the first time
        in Tails 3.0~rc1 is broken (#12568).
      * Adds exceptions for the extensions Tails installs on top of
1245
        the vanilla Tor Browser (Closes: #11419).
1246 1247 1248 1249 1250
    - Upgrade tor to 0.3.0.7-1 (Closes: #12485) and log both to the
      usual file and the journal (Closes: #12412).
    - Merge the code that makes Tails almost build reproducibly (Refs:
      #5630); we still have issues with the fontconfig cache (Refs:
      #12567).
1251 1252

  * Minor improvements
1253 1254 1255 1256 1257
    - Add a HACKING document for new code contributors (Closes:
      #12164).
    - Rename tor-controlport-filter to onion-grater (Closes: #12394)
      and import patches killing the delta against Whonix version
      (Closes: #12173).
1258 1259 1260 1261 1262 1263