changelog 243 KB
Newer Older
intrigeri's avatar
intrigeri committed
1
tails (2.0~beta1) unstable; urgency=medium
2

intrigeri's avatar
intrigeri committed
3
  XXX: see changelog of custom packages
4

intrigeri's avatar
intrigeri committed
5
6
7
8
  * Major new features and changes
    - Upgrade to Debian 8 (Jessie).
    - Migrate to GNOME Shell in Classic mode.
    - Use systemd as PID 1.
9
    - Convert all our custom initscripts to native systemd units.
intrigeri's avatar
intrigeri committed
10
11
12
13
14
15
16
    - Remove the Windows camouflage feature: our call for help to port
      it to GNOME Shell (issues in January, 2015) was unsuccessful.

  * Security fixes


  * Bugfixes
17
18
19
20
21
    - Restore the logo in the "About Tails" dialog.
    - Don't tell the user that "Tor is ready" before htpdate is done
      (Closes: #7721).
    - Upgrader wrapper: make the check for free memory smarter
      (Closes: #10540, #8263).
intrigeri's avatar
intrigeri committed
22
23

  * Minor improvements
24
    - Remove obsolete code from various places.
intrigeri's avatar
intrigeri committed
25
26
    - Use socket activation for CUPS, to save some boot time.
    - Port XXX [check custom packages] to GTK3 / UDisks2 / Python 3 / whatever.
27
28
29
30
    - Don't install UDisks v1.
    - Adapt custom udev rules to UDisks v2 (Closes: #9054).
    - Adjust import-translations' post-import step for Tails Installer,
      to match how its i18n system works nowadays.
31
    - Set memlockd.service's OOMScoreAdjust to -1000.
intrigeri's avatar
intrigeri committed
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
    - Don't bother creating /var/lib/live in tails-detect-virtualization.
      If it does not exist at this point, we have bigger and more
      noticeable problems.
    - Simplify the virtualization detection & reporting system, and do it
      as a non-root user with systemd-detect-virt rather than virt-what.
    - Replace rsyslog with the systemd Journal (Closes: #8320), and adjust
      WhisperBack's logs handling accordingly.
    - Drop tails-save-im-environment.
      It's not been used since we stopped automatically starting the web browser.
    - Add a hook that aborts the build if any *.orig file is found. Such files
      appear mainly when a patch of ours is fuzzy. In most cases they are no big
      deal, but in some cases they end up being taken into account
      and break things.
    - Replace the tor+http shim with apt-transport-tor (Closes: #8198).
    - Install gnome-tweak-tool.
    - Don't bother testing if we're using dependency based boot.
    - Drop workaround to start spice-vdagent in GDM (Closes: #8025).
      This has been fixed in Jessie proper.
    - Don't install ipheth-utils anymore. It seems to be obsolete
      in current desktop environments.
    - Stop installing the buggy unrar-free, superseded in Jessie (Closes: #5838)
    - Drop all custom fontconfig configuration, and configure fonts rendering
      via dconf.
    - Drop zenity patch (zenity-fix-whitespacing-box-sizes.diff),
      that was applied upstream.
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
    - Install libnet-dbus-perl (currently 1.1.0) from jessie-backports,
      it brings new features we need.
    - Have the security check and the upgrader wait for Tor having bootstrapped
      with systemd unit ordering.
    - Get rid of tails-security-check's wrapper.
      Its only purpose was to wait for Tor to have bootstrapped,
      which is now done via systemd.
    - Don't allow the amnesia and tails-upgrade-frontend users to run
      tor-has-bootstrapped as root with sudo. They don't need it anymore,
      thanks to using systemd for starting relevant units only once Tor
      has bootstrapped.
    - Install python-nautilus, that enables MAT's context menu item in Nautilus.
      (Closes: #9151).
    - Configure GDM with a snippet file instead of patching its
      greeter.dconf-defaults.
    - WhisperBack:
      · port to Python 3 and GObject Introspection (Closes: #7755)
      · migrate from the gnutls module to the ssl one
      · use PGP/MIME for better attachments handling
      · migrate from the gnupginterface module to the gnupg one
      · natively support SOCKS  don't wrap with torsocks anymore
        (Closes: #9412)
      · don't try to include the obsolete .xession-errors in bug reports
        (Closes: #9966)
    - chroot-browser.sh: don't use static DISPLAY.
    - Simplify debugging:
      · don't hide the emergency shutdown's stdout
      · tails-unblock-network: trace commands so that they end up in the Journal
    - Configure the console codeset at ISO build time, instead of setting it
      to a constant via the Greeter's PostLogin.default.
    - Order the AppArmor policy compiling in a way that is less of a blocker
      during boot.
    - Include the major KMS modules in the initramfs. This helps seamless
      transition to X.Org when booting, and back to text mode on shutdown,
      can help for proper graphics hardware reinitialization post-kexec,
      and should improve GNOME Shell support in some virtual machines.
93
94
95
96
97
98
99
100
101
102
103
104
105
    - Always show the Universal Access menu icon in the GNOME panel.
    - Drop notification for not-migrated-yet persistence configuration,
      and persistence settings disabled due to wrong access rights.
      That migration happened more two years ago.
    - Remove the restricted network detector, that has been broken for too long;
      see #10560 for next steps (Closes: #8328).
    - Remove unsupported, never completed kiosk mode support.
    - clock_gettime_monotonic: use Perl's own function to get the integer part,
      instead of forking out to sed.
    - Don't (try to) disable lvm2 initscripts anymore. Both the original reason
      and the implementation are obsolete on Jessie.
    - Lower potential for confusion (#8443), by removing system-config-printer.
      One GUI to configure printers is enough (Closes: #8505).
106
    - Add "set -u" to tails-unblock-network.
intrigeri's avatar
intrigeri committed
107
108
109
110
111
112
113
114
115

  * Test suite
    - Adapt to the new desktop environment and applications' look.
    - Adapt new changed nmcli syntax and output.
    - New NetworkManager connection files must be manually loaded in Jessie.
    - Adapt to new pkexec behavior.
    - Use sysctl instead of echo:ing into /proc/sys.
    - Use oom_score_adj instead of the older oom_adj.
    - Adapt everything depending on logs to the use of the Journal.
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
    - Port to UDisks v2.
    - Check that the system partition is an EFI System Partition.
    - Add ldlinux.c32 to the list of bootloader files that are expected
      to be modified when we run syslinux (Closes: #9053).
    - Use apt(8) instead of apt-get(8).
    - Don't hide the cursor after opening the GNOME apps menu.
    - Convert the remote shell to into a systemd native service and a Python 3,
      script that uses the sd_notify facility (Closes: #9057).
    - Adjust to match where screenshots are saved nowadays.
    - Check that all system units have started (Closes: #8262)
    - Simplify the "too small device" test.
    - Spawn `poweroff' and `halt' in the background, and don't wait for them
      to return: anything else would be racy vs. the remote shell's stopping.
    - Bump video memory allocated to the system under test, to fix out of video
      memory errors.
    - When configuring the CPU to lack PAE support, use a qemu32 CPU instead
      of a Pentium one: the latter makes GNOME Shell crash.
      See #8778 for details about how Mesa's CPU features detection has
      room for improvement.
    - Adjust free(1) output parsing for Jessie.
    - vm-execute: rename --type option to --spawn.
    - Add method to set the X.Org clipboard, and install its dependency
      (xsel) in the ISO.
    - Paste URLs in one go, to work around issue with lost key presses
      in the browser (Closes: #10467).
    - Add wait_*_gnome_window() helpers and use them everywhere applicable
      for added reliability.
    - Reliably wait for Synaptic's search button to fade in.
144
145
146
147
148
149
150
151
152
153
    - Take into account that the sticky bit is not set on block devices
      on Jessie anymore.
    - Ensure that we can use a NetworkManager connection stored in persistence
      (Closes: #7966).
    - Use a stricter regexp when extracting logs for dropped packets.
    - Clone the host CPU for the test suite guests (Closes: #8778).
    - Run ping as root (aufs does not support file capabilities so we don't
      get cap_net_raw+ep, and if built on a filesystem that does support
      file capabilities, then /bin/ping is not setupd root).

154
155
156
  * Set the remote shell's OOM score adjustment value via its unit file, instead of dynamically at test suite run time.
  * Test suite: escape regexp special characters when constructing the firewall log parsing regexp.
    .. and pass -P to grep, since Ruby uses PCRE.
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
    * Fix is_persistent?() helper due to findmnt changes in Jessie.
    In jessie, findmnt correctly notices that / is an aufs mounts. Hence
    let's assume that we're not using read-only persistence (which uses
    aufs) in which case aufs => no persistence.
  * Rework how we measure pattern coverage.
    The approaches we used before just seems incorrect in multiple ways:
    * vm.overcommit_memory = 2 seems to make OOM killing happen way too
      early, around when 15% or RAM is still free, no matter the value of
      vm.overcommit_ratio and the various *reserved settings.
    * Using the ratio of a ration for the {min,max}_coverage calculations
      were just weird and a sign of incremental bandaid-like fixes.
    Now we do what we intended more explicitly, that is: measure the
    pattern coverage in the free RAM at the time we start filling it. We
    also have to reserve some RAM for the kernel (so it doesn't freeze
    when approaching full RAM) and admin processes like the remote shell
    (so it doesn't get unresponsive), and we exclude this from the free
    RAM in the calculations for a much more accurate result than before.
    Note that we may end up having a bit more than 100% pattern
    coverage. While that may seem strange it may just indicate that some
    unrelated RAM was freed after we noted the amount of free RAM right
    before we started filling it.
    Will-fix: #9705
  * Use blkid instead of parted to determine the filesystem type.
    In Jessie, "parted print NUMBER" doesn't work, and then blkid seems
    like a cleaner approach (bonus: the name blkid uses for swap is
    cleaner too).
  * Simplify by removing the wait_for_gnome*() helpers.
    They don't work well and do not seem needed. Also, it's used in only
    two places, and add to that that GNOME seems to be moving away from
    having the type of title bar we're looking for.
  * Start each fillram instance with the correct oom_score_adj.
    ... by starting them in sub shell with the desired oom_score_adj. The
    way we did it before left a window where they inherit the remote
    shell's oom_score_adj, which is the absolute opposite of the range,
    meaning that everything else will be prioritized.
  * Decide memory wiping waiting time on configured RAM.
    ... instead of detected RAM. This should only make us wait longer,
    since detected RAM <= configured RAM, so it's safe but potentially an
    increase in runtime.
    We actually do this since we often want to run these modified steps
    when the remote shell is not available any more, since Tails is
    shutting down.
  * Use --kiosk mode instead of --fullscreen in virt-viewer.
    The only effect will be that the tiny border of the in-viewer menu is
    removed (which *potentially* could be in the way some time) since
    --kiosk implies --fullscreen.
  * Remove scenario.
    In Jessie, org.gnome.gnome-screenshot.auto-save-directory is empty
    since the default is sensible, ~/Pictures. To save the removed
    scenario we'd have to set it explicitly, which seems stupid. Besides,
    the 'A screenshot is taken when the PRINTSCREEN key is pressed'
    scenario is already testing that GNOME Screenshot saves into this
    directory, which is enough.
  * Adapt Gnome notification handling for Debian Jessie.
    When waiting for specific notifications we'll completely depend on
    robust_notification_wait() from now on *and* it will leave other
    notifications unlike the old version.
    Will-fix: #8782
  * Migrate to robust_notification_wait() and update some related images for Jessie.


intrigeri's avatar
intrigeri committed
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240

  * Adjustments for Debian 8 (Jessie) with no or very little user-visible impact
    - Free the fixed UIDs/GIDs we need before creating the corresponding users.
    - Replace the real gnome-backgrounds with a fake, equivs generated one
      (Closes: #8055). Jessie's gnome-shell depends on gnome-backgrounds,
      which is too fat to ship considering we're not using it.
    - AppArmor: adjust CUPS profile to support our Live system environment
      (Closes: #8261):
      · Mangle lib/live/mount/overlay/... as usual for aufs.
      · Pass the the attach_disconnected flag, that's needed for compatibility
        with PrivateTmp.
    - Make sure we don't ship geoclue* (Closes: #7949).
    - Drop deprecated GDM configuration file.
    - Don't add the Live user to the deprecated 'fuse' group.
    - Drop hidepid mount option for /proc (Closes: #8256). In its current,
      simplistic form it cannot be supported by systemd.
    - Don't manually load acpi-cpufreq at boot time. It fails to load
      whenever no device it supports is present, which makes the
      systemd-modules-load.service fail. These days, the kernel
      should just automatically load such modules when they are needed.
    - Drop sysvinit-specific (sensigs.omit.d) tweaks for memlockd.
    - Disable the GDM unit file's Restart=always, that breaks our "emergency
      shutdown on boot medium removal" feature.
241
242
243
244
245
246
247
248
249
250
    - Update the implementation of the memory erasure on shutdown feature:
      · check for rebooting state using systemctl, instead of the obsolete
        $RUNLEVEL (Closes: #8306)
      · the kexec-load initscript normally silently exits unless systemd is
        currently running a reboot job. This is not the case when the emergency
        shutdown has been triggered, so we removed this check
      · migrate tails-kexec to the /lib/systemd/system-shutdown/ facility
      - don't (try to) switch to tty1 on emergency shutdown: it apparently
        requires data that we haven't locked into memory, and then it blocks
        the whole emergency shutdown process
intrigeri's avatar
intrigeri committed
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
    - Display a slightly darker version of the desktop wallpaper on the screen
      saver, instead of the default flashy "Debian 8" branding (Closes: #9038).
    - Disable software autorun from external media.
    - Disable a few unneeded D-Bus services. Some of these services are
      automatically started (via D-Bus activation) when GNOME Shell tries
      to use them. The only "use" I've seen for them, except eating
      precious RAM, is to display "No appointment today" in the calendar pop-up.
      (Closes: #9037)
    - Prevent NetworkManager services from starting at boot time
      (Closes: #8313). We start them ourselves after changing the MAC address.
    - Unfuzzy all patches (Closes: #8268) and drop a few obsolete ones.
    - Adapt IBus configuration for Jessie (Closes: #8270), i.e. merge the two
      places where we configure keyboard layout and input methods: both are now
      configured in the same place in Jessie's GNOME.
    - Migrate panel launchers to the favorite apps list (Closes: #7992).
    - Drop pre-GNOME Shell menu tweaks.
    - Hide "Log out" button in the GNOME Shell menu (Closes: #8364).
    - Add a custom shutdown-helper GNOME Shell extension (Closes: #8302, #5684
      and #5878) that removes the press-Alt-to-turn-shutdown-button-into-Suspend
      functionality from the GNOME user menu, and makes Restart and Shutdown
      immediate, without further user interaction. Accordingly remove our custom
      Shutdown Helper panel applet (#8302).
    - Drop GNOME Panel configuration, now deprecated.
    - Disable GNOME Shell's screen lock feature.
      We're not there yet (see #5684).
    - Disable GNOME Shell screen locker's user switch feature.
    - Explicitly install libany-moose-perl (Closes: #8051).
      It's needed by our OpenPGP applet. On Wheezy, this package was pulled
      by some other dependency. This is not the case anymore on Jessie.
    - Don't install notification-daemon nor gnome-mag: GNOME Shell has taken
      over this functionality (Closes: #7481).
    - Don't install ntfsprogs: superseded on Jessie.
    - Don't install barry-util: not part of Jessie.
    - Link udev-watchdog dynamically, and lock it plus its dependencies
      in memory.
    - Migrate from gdm-simple-greeter to a custom gdm-tails session
      (Closes: #7599).
288
289
290
291
292
293
294
295
296
    - Update Plymouth installation and configuration:
      · install the plymouth packages via chroot_local-hooks: lb 2.x's "standard"
        packages list pulls console-common in, which plymouth now conflicts with
      · don't patch the plymouth initscript anymore, that was superseded
        by native systemd unit files
      · mask the plymouth-{halt,kexec,poweroff,reboot,shutdown} services,
        to prevent them from occupying the active TTY with an (empty) splash
        screen on shutdown/reboot, that would hide the messages we want to show
        to the user via tails-kexec (Closes: #9032)
intrigeri's avatar
intrigeri committed
297
298
299
300
301
302
    - Migrate GNOME keyboard layout settings from libgnomekbd to input-sources
      (Closes: #7898).
    - Explicitly install syslinux-efi, that we need and is not automatically
      pulled by anything else anymore.
    - Workaround #7248 for GDM: use a solid blue background picture,
      instead of a solid color fill, in the Greeter session.
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
    - De-install gcc-4.8-base and gcc-4.9 at the end of the ISO build process.
    - Revert the "Wrap syndaemon to always use -t" Wheezy-specific workaround.
    - htpdate: run date(1) in a Jessie-compatible (and nicer) way.
    - Remove obsolete dconf screenshot settings and the corresponding test.
    - Drop our patched python-dbus{,-dev} package (Closes: #9177).
    - live-persist: stop overriding live-boot's functions, we now have
      a recent enough blkid.
    - Adjust sdmem initramfs bits for Jessie:
      · Directly call poweroff instead of halt -p.
      · Don't pass -n to poweroff and reboot, it's not supported anymore.
    - Wrap text in the Unsafe Browser startup warning dialog
      (Jessie's zenity does not wrap it itself).
    - Associate application/pgp-keys with Seahorse's "Import Key" application
      (Closes: #10571).
    - Install topIcons GNOME Shell extension (v28), to work around the fact
      that a few of the applets we use hijack the notification area.
    - "cd /" to fix permissions issue at tails-persistence-setup startup
      (Closes: #8097).
    - Install gstreamer1.0-libav, so that Totem can play H264-encoded videos.
    - Adjust APT sources configuration:
      · remove explicit jessie and jessie-updates sources:
        automatically added by live-build
      · add Debian testing
      · add jessie-backports
    - Firewall: white-list access to the accessibility daemon (Closes: #8075).
    - Adjust to changed desktop notification behavior and supported feature set
      (Closes: #7989):
      · pass the DBUS_SESSION_BUS_ADDRESS used by the GNOME session
        to notify-send
      · update waiting for a notification handler: gnome-panel and nm-applet
        are obsolete, GNOME Shell is now providing this facility, so instead
        wait for a process that starts once GNOME Shell is ready, namely
        ibus-daemon (Closes: #8685)
      · port tails-warn-about-disabled-persistence and tails-virt-notify-user
        to notification actions (instead of hyperlinks), and make the latter
        transient; to this end, add support to Desktop::Notify for "hints"
        and notification actions
      · tails-security-check: use a dialog box instead of desktop notifications
      · MAC spoofing failure notification: remove the link to the documentation;
        it was broken on Tails/Wheezy already, see #10559 for next steps
343
344
345
346
347
348
349
350
351
352
353
    - Don't explicitly install gnome-panel nor gnome-menus, so that they go away
      whenever the Greeter does not pull them in anymore.
    - Install gkbd-capplet, that provides gkbd-keyboard-display (Closes: #8363).
    - Install Tor 0.2.7 from deb.torproject.org: we don't need to rebuild it
      ourselves for seccomp support anymore.
    - Wrap Seahorse with torsocks when it is started as a D-Bus service too
      (Closes: #9792).
    - Rename the AppArmor profile for Tor, so it applies to the system-wide
      Tor service we run (Closes: #10528).
    - Essentially revert ALSA state handling to how it was pre-Jessie, so that
      mixer levels are unmuted and sanitized at boot time (Closes: #7591).
intrigeri's avatar
intrigeri committed
354
    - Pass --yes to apt-get when installing imagemagick.
intrigeri's avatar
intrigeri committed
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430

  * Drop Wheezy-era hacks to make the PulseAudio initscript silent.
    It has never been used in Tails, and has finally been removed on Jessie:
    per-user sessions for everyone.
  * Make removable devices user writable.
    This fixes #8273, but I'm not sure whether it's a proper solution or
    just a workaround.
  * Only make floppy own devices that we support installing Tails to.
    Tails Installer requires raw block device access to such devices,
    which is why we have this workaround in the first place.
  * On MAC spoofing failure, disable NM services in addition to stopping then.
    ... and actually stop all of them.

  * Convert a few X session startup programs to `systemd --user' units.
    This is merely preparatory work that lays down some foundations.
    For now, we're using two targets:
     * basic.target sets up things that should be done as early as possible, don't
       need access to X, notifications, nor D-Bus ; it is automatically started by
       `systemd --user' when the logind session is created. Note that this happens
       after persistence has been set up, when the GDM autologin is triggered, and
       before /etc/gdm3/Xsession is run:
       - tails-add-GNOME-bookmarks.service
       - tails-create-tor-browser-directories.service
     * desktop.target: we're starting it via xdg/autostart during the GNOME session
       startup. There are a few units wanted by this target so far:
       - tails-configure-keyboard.service
       - tails-virt-notify-user: ideally, this should have something like
         After=notifications-ready.target (and then, most other things that
         wait for GNOME Shell to be ready to handle notifications could do the
         same instead of grep'ing the process list).
       - tails-warn-about-disabled-persistence.service
       - tails-upgrade-frontend.service: the idea is to later use systemd units
         ordering to make it run at a time that increases chances for the system
         having enough free memory; e.g. as soon as possible once the session is
         ready, Tor has bootstrapped, and some other memory-hungry programs we run
         at session startup time have completed.
       - tails-security-check.service: similarly, the idea is that we could get
         rid of the wrapper — that merely waits for Tor to have finished
         bootstrapping — given another systemd unit.
    Most of these units exit early unless they're run by the `amnesia' user.
    Otherwise they break e.g. Tails Greeter startup, and probably worse.
    Also note that the units that may take ages to complete have Type=simple.
    With Type=oneshot, systemd would wait for them to complete before running any
    follow-up units, and before considering the target they're part of has been
    reached. Two of our units can take minutes to complete, so the desktop.target
    startup would fail. Now, using Type=simple has one drawback: it makes it harder
    to order other units relatively to tails-security-check-wrapper's and
    tails-upgrade-frontend-wrapper's completion. This doesn't feel too bothering,
    though: it's more likely that we want to configure these units to start after
    others, than the opposite.
    Also, when the GNOME session is initialized, we import the relevant D-Bus, X11
    and locales variables into systemd --user's environment, so that our units can
    use them. We do that immediately before starting desktop.target.
  * Don't start tails-restricted-network-detector.service unless MAC spoofing is enabled.
    Previously, this check was done in PostLogin.default. Let's import it here
    so that the unit file becomes the canonical place that describes this service,
    including whether it should start or not.
  * Migrate tails-unblock-network to a systemd service, that handles starting NetworkManager.
    In the current state of things, this change merely speeds up login a bit since
    this allows us to start this service in a non-blocking way in Tails Greeter,
    without losing the ability to retrieve its status and output later.
    That's the first step towards Will-fix: #8327.
    Also, we move the "start NetworkManager as soon as the network is unblocked"
    logic to tails-unblock-network.service.
    Previously, /usr/local/sbin/tails-unblock-network (started by
    tails-unblock-network.service) would manually start NetworkManager services.
    This feels ugly, since it encodes systemd unit ordering in /usr/local/sbin/,
    while it really belongs to the unit files themselves.
    So, we use:
     * Requires= to trigger the startup of the NM services;
     * Before= to ensure that said startup only happens once the network
       has been unblocked.
    Note that tails-unblock-network.service is *not* WantedBy multi-user.target.
    Otherwise, it would try to start on boot before the user has had the chance to
    opt-out from MAC spoofing. And then it would fail, since its EnvironmentFile
    (/var/lib/gdm3/tails.physical_security) does not exist yet.
431

intrigeri's avatar
intrigeri committed
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
  * tor-browser, 60-tor-ready.sh: use systemctl to determine if Tor has bootstrapped already.
    Note that `systemctl is-active' returns false for a service that's in
    "activating" state. The thing is, tails-wait-until-tor-has-bootstrapped.service
    *is* in "activating" state until Tor has bootstrapped. So, we explicitly check
    for its state to be "inactive" (meaning it has completed, and Tor has
    bootstrapped).
  * Harden system-wide systemd unit files.
  * 60-tor-ready.sh: sleep for a shorter time between checking if Tor has bootstrapped.
    This is now done via systemctl, and doesn't require grep'ing logs everytime,
    so let's decrease the time until the user is made aware that Tor is ready.
  * Make sure the blacklist has disappeared from the filesystem before triggering udev events.
    There's apparently a race condition somewhere. We've already seen cases when
    a file we've just deleted was still visible to some other process for a short
    amount of time, so let's try to be on the safe side.
  * Mimic systemd-udev-trigger.service when triggering udev events.
    The default setting for `udevadm trigger' is --type=devices.
    That's why systemd-udev-trigger.service runs it twice, once
    with --type=subsystems, and then with --type=devices.
    Given the racy behaviour I'm seeing in tails-unblock-network.service,
    it seems worth doing exactly the same thing as systemd-udev-trigger does.
  * Disable udev's 75-persistent-net-generator.rules.
    This should help preventing races between MAC spoofing and interface naming.
  * Move udevadm stuff to PostLogin/Default.
    Apparently, udevadm calls are not always honored when they're started from
    tails-unblock-network.service, possibly because we started it in a non-blocking
    way.
  * Import network unblocking steps + NM startup back into /usr/local/sbin/tails-unblock-network.
    We've previously moved the udevadm mangling out of
    tails-unblock-network.service, but the NM startup handling was left in there.
    So, NM could possibly start before the MAC address has been spoofed, which we
    need to avoid.
    Another option would have been to add all of this to PostLogin, but it has so
    little to do with the Greeter's job that I felt it would be nicer to have
    PostLogin simply run a script that does all the work, so that most of it is
    self-contained in our main Git repo. For the same reason, this commit also
    imports the restricted network detector startup in the very same script.
  * Test suite: use a slightly cheaper way to test if Tor is working.
    The grep'ing and grepping etc. is now done in a systemd unit file, so we just
    have to wait for it to complete. That's what tor-has-bootstrapped now does,
    let's use it.


  * Explicitly disable systemd-networkd, to prevent any risk of DNS leaks it might cause.

  * Allow the amnesia user, when active, to open non-system devices for writing with udisks2.
    This is roughly udisks2's equivalent of having direct write access to raw block
    storage devices. Tails Installer (ported to Jessie) uses this functionality
    (with call_open_for_restore_sync) so that most operations can be done non-Tails
    systems without special privileges on the target block device.
  * Test suite: don't wait for window title while we're waiting for its content already.
    I've found wait_for_gnome_window to be fragile in this scenario (especially
    combined with #9692), and we don't really need it here.
  * Update polkit rules wrt. the porting of t-p-s to udisks2.
    Will-fix: #9270
  * Really allow the t-p-s user to modify system devices without requiring authentication.
    Without this, the operator of the current session (that is, the amnesia user)
    is asked to authenticate: polkit somewhat considers that this person controls
    the client, even if run as a different user, which kinda makes sense.
    Will-fix: #9270
  * Disable hwclock-save.service, to avoid sync'ing the system clock to the hardware clock on shutdown.
    Closes: #9363
  * Use "mask" instead of "disable" for disabling hwclock-save.service.
    It's more reliable, as it has less chances to be reverted by some upgrade.
  * Explicitly disable timesyncd: we have our own time synchronization mechanism.
    It's not enabled by default in Jessie, but it will be in Stretch, so let's be
    explicit about it.
  * tails-unblock-network: add some logging to help debugging race conditions.
  * tails-unblock-network: sleep a bit after unblocking network devices, and before triggering udev events.
    That's ugly but I wasn't able to find anything better. We'll see if it fixes
    the problem everywhere, or if it merely makes it less frequent..
    Closes: #9012
  * Replace patch against NetworkManager.conf with drop-in files.
  * Replace resolvconf with simpler NetworkManager and dhclient configuration.
    Refs: #7708

  * Replace patching of the gdomap, i2p, hdparm, tor and ttdnsd initscripts with 'systemctl disable'.
    Closes: #9881
  * apparmor-adjust-cupsd-profile.diff: adjust to parse fine on current Jessie.
    Closes: #9963
    More specifically:
    a) avoid "conflicting x modifiers" for /usr/bin/hpijs, by modifying the
       /usr/bin/* rule to not match it;
    b) add missing backends to the list of confined ones, and:
       asked how we can better maintain this list :
       https://lists.ubuntu.com/archives/apparmor/2015-August/008463.html
    c) to avoid "conflicting x modifiers", replaced glob that matches
       all remaining backends by a hard-coded list of third-party ones
       we ship;
    d) Added a note to the RM role duties to sanity check these two lists.
    Also, add the attach_disconnected flag to the third_party local profile in
    there, as was done in sid already, and is needed for it to work under systemd
    (this patch already did that for /usr/sbin/cupsd).
  * Replace patches that wrapped apps with torsocks with dynamic patching with a hook.
    This should avoid the need to maintain these patches and avoid them becoming
    fuzzy, especially when migrating to new versions of Debian.

  * Allow the amnesia user, when active, to use all CUPS actions needed by the GNOME printing setup dialog.
    These rules override those shipped by cups-pk-helper 0.2.5-2+b1 in
    /usr/share/polkit-1/actions/org.opensuse.cupspkhelper.mechanism.policy
    Closes: #8443
  * apparmor-adjust-cupsd-profile.diff: drop explicit support of /lib/live/mount/overlay.
    This is now globally handled with aliases.
  * apparmor-adjust-cupsd-profile.diff: fix access to aufs whiteouts for /etc/cups, /var/{cache,log,spool}/cups.
    Closes: #10210
  * tails-virt-notify-user: notify the user if running in a non-free vm.
    Thanks to Austin English <austinenglish@gmail.com> for the patch.
    Sorry, my `git am' does not want to hear about this patch,
    so I'm applying it by hand.
    Closes: #5315

  * Upgrade to experimental Tor 0.2.7 packages.
    Note that this introduces a regression as-is, since we lose
    the patch for https://bugs.torproject.org/15482. That's tracked by
    Refs: #10194

  * Turn htpdate.service into Type=oneshot.
    I want to use time-sync.target (see systemd.special(7)), so that we can
    order stuff after it.
    But with Type=simple, we can't tell when htpdate is done, so we can't
    specify that time-sync.target has not been reached until then. So let's
    use Type=oneshot. But then, 20-time.sh would block until htpdate is
    done, which is not what we want; this is solved by using --no-block when
    restarting the service there.
  * Explicitly declare htpdate.service as being needed for time-sync.target.
    This ensures that "services where correct time is essential should be
    ordered after this unit" (as long as such services have themselves
    declared the right dependencies). We don't ship any such services
    currently, so this is rather pedantic a commit.
    Note: in our case, we don't want the Tor service to wait for
    time-sync.target, since we still use the Tor consensus for time
    sync' purposes.
  * Explicitly use tor@default.service when it's the one we mean.
    Tor 0.2.7.x packaging now uses a template systemd unit file,
    and the instance we use is called tor@default.service.

567
568
569
570
571
572
573
574
  * Add a systemd target whose completion indicates that Tor has bootstrapped.
  * Create a tails-wait-until-tor-has-bootstrapped.service in the systemd user instance.
    The systemd user and system instances don't share units. Thus, the dependency
    we have from the security check and upgrader user services on
    tails-wait-until-tor-has-bootstrapped had no effect.
    So, we have the *system* tails-wait-until-tor-has-bootstrapped.service create
    a file upon completion -- and the identically named *user* unit file wait for
    that file to appear.
intrigeri's avatar
intrigeri committed
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
  * Introduce a dedicated systemd target for "Tor has bootstrapped" state.
    ... and move tails-wait-until-tor-has-bootstrapped.service from
    default.target to it. The main effect is that anything that wants to
    start after graphical.target or multi-user.target does not have to wait
    for Tor to have bootstrapped (which could very well never happen, e.g.
    when working offline) anymore.
    Will-fix: #9393

  * Install tails-installer instead of liveusb-creator.
    Refs: #8561

  * Refactor GNOME/X env exporting to Tails' shell library.
  * Grab the rest of the variables from gnome-shell's environment.
    The static guess for DISPLAY *could* be wrong, and the how we relied
    on a shell blog for XAUTHORITY could results in problems if there's a
    leftover database from a previous session for some reason. Besides,
    the new approach feels more consistent.
  * Include the GNOME/X environment in the remote shell.
    And kill the (inferior) code about DISPLAY and XAUTHORITY since
    they're set by export_gnome_env() into the environment.
  * Disable screen blanking in the automated test suite.
    In the automated test suite we sometimes need to wait long enough so
    screen blanking activates, which can mess with Sikuli wait():ing for
    some image. This is the case in e.g. the 'Install packages using
    Synaptic' scenario, in which the APT update can take >5 minutes.
    Will-fix: #10403

602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
  * Simplify ISO image naming rules.
    ... by using the base rule we use for Jenkins all the time, except
    when building from a tag (i.e. building a release).
    Will-fix: #10349

  * Use the menu to open Pidgin's account manager
  * Retry running whois when "LIMIT EXCEEDED" is in its output.
    Will-fix: #10523
  * Revert back to using @screen.wait.
    We're going to end up restarting Seahorse on segfault. While doing lots
    of testing for #9791 I'm fairly confident that I've figured out
    Seahorse's failure modes and when it'll segfault. allowing code to be
    simplified.
  * Make keyid an instance variable in the GnuPG CLI step.
    Doing this will allow this variable to be used in the Seahorse
    keysyncing steps.
  * Start Seahorse with its own function.
    We'll also keep track of how Seahorse was opened in case we need to
    restart it during the test suite.
  * Improve Seahorse key syncing test robustness
  * Avoid waiting unneccesarily for the results window if there's an error
  * Use more generalized name for menu image's name.
    Gedit no longer has a menu bar at the top of its window, causing this
    feature to be broken..
  * Teminate gpg after 120 seconds have passed.
    During my testing I found that it seems that if we're going to get a
    successful result it'll happen by the time two minutes have passed.
    If the key retrieval neither succeeds nor fails within 2 minutes we'll
    terminate the running gnupg process, force a new Tor circuit, and try
    fetching again.
  * Reduce timeouts in Seahorse to 2 minutes
  * explicitly check that there's not an error from Seahorse
  * Don't wait unnecessarily.
    Since all of the gpg operations will retry after forcing a new Tor
    circuit, by the time we reach the step that checks whether the key is in
    the keyring the key should be there. We'll gain nothing from waiting two
    additional minutes.
  * Reduce redundancy with checking for seahorse errors
  * Allow step to be retried.
    If we don't monitor whether the key has been fetched with the gpg CLI
    tool we can move to the next step which used to check whether the key is
    in the keyring. By that time it's too late to retry fetching.
    Instead let's check with `gpg` for the key. If the key is not in the
    keyring within two minutes we'll fail the step, force a new tor circuit,
    and try retrieving the key again.
  * Remove unneeded return
  * s/gsub/sub/
  * Pass argument by name
  * (Hopefully) more accurate name of function
  * More specific variable name
  * Typo fix

  * Reword scenario title.
  * Test suite: move upgrade scenarios to the feature dedicated to them.
  * Test suite: fix error message for isohybrid test.
  * Update jenkins-tools submodule.
  * Stop tweaking /etc/modules.
    It's 2015, the kernel should load these things automatically.
    Will-Fix: #10609
  * Remove obsolete "override our Wheezy-specific package" entries from APT pinning.
    They were useful when feature/jessie was an overlay on top of devel,
    but it's been not the case for a while.
    Will-Fix: #10607
  * Install obfs4proxy from deb.torproject.org on Jessie as well.
    The package in Jessie is older than the one from deb.tpo, that we currently ship
    in Tails 1.x, so let's fetch it from the same place.
    Will-Fix: #10605
  * Install Tor from deb.torproject.org's stable repo.
    The one we currently want (0.2.7) has been released as stable.
    Will-Fix: #10604
  * Call out to the shell less often in htpdate.service.
    On my test system they all are run within the same seconds, but it adds up to
    everything else we're doing at the same time.
    Will-Fix: #10612
  * Clarify status of ttdnsd: we do run it, but via a NetworkManager hook.
    Closes: #10608
  * Convert config/chroot_local-hooks/21-gdm_unit_file to a drop-in override.
    I see no reason to patch it at build time the way we did it.
    Will-Fix: #10606
  * Wrap Totem with torsocks when it's run via its D-Bus service too.
    Will-Fix: #10603
  * 09-torsocks-apps: make regexps a bit stricter.
  * Have systemd hardening let Tor modify its configuration.
    Tor Launcher needs that.
    Closes: #10696

  * Tag `@doc` scenarios that rely on the documentation.
    Will-fix: #10706

  * Restore image into broken symlink.
    The symlink's target image was removed.
  * Remove test of the removed restricted network detector.
  * Remove silly executable bit.
  * s/syslog/journal/
  * Refactor the PAUSE_ON_FAIL functionality.
    A well-placed `pause()` can act as a breakpoint when debugging.
  * Kill + inline strangely named function.
    And fix the code so we get the proper middle, i.e. measure from the
    top's bottom to the bottom's top (hah!).
  * Remove old workaround that seems obsolete.
    ... at least on my system, that previously could reproduce it.
  * Adapt test to how we disable networking in feature/jessie.
    See `stop_and_disable_NM()` in the `tails-mac-spoof` script.
  * Bump some images for feature/jessie.
  * Kill Vidalia before we restart Tor.
    Otherwise Vidalia will be running and showing errors while we make
    sure that Tor bootstraps, which could take a while.
  * Remove unnecessary waiting code.
    Earlier we already ensure that Tor has bootstrapped, which implies
    that the control port must be up.
  * Remove obsolete comment.
    The referred-to comment in checks.feature is not there any more, and
    in this feature we use snapshots any way (although not as freely as
    we'd like).
  * Use snapshot.
    This scenario is not using a filesystem share, so unlike some other
    scenarios in this feature there's nothing preventing us.
  * Remove superfluous part of test.
    We still do the essential part i.e. test that Totem can open videos
    over Tor. The removed part is essentially a test of the GUI, and what
    a confusing and hard-to-discover GUI it is! I doubt users will ever
    find out how to do it, so I fail to see why we should test it (and
    waste time dealing with the robustness issue that plague this test).
  * Add retry magic to the Totem HTTPS scenario.
  * Use journalctl instead of (non-existing) syslog.
  * Adapt test for new Tails Installer.
    The USBCreateLiveUSB.png image cannot be relied upon for waiting on
    the main installer window, since it can be greyed out. Also, the error
    message when a device is not upgradable appears without even clicking
    the install button.
  * Remove comment about OCR, and commented OCR code.
    Sikuli's OCR capabilities are way too bad, so let's forget about this.
  * Introduce a new XML-based iptables parser.
    The old `iptables_parse()` way relies on regex parsing the output of
    the `iptables` output, which of course is not very reliable. In Jessie
    the `ip6tables` output has changed and differs (if there are no
    options the "opt" column will be empty, and not have a "--"). The new
    parser fixes this.
    The goal will be to convert all `iptables_parse()` instances to the
    new parser.
    Will-fix: #9704
  * Convert `iptables_parse()` instance.
  * Convert `iptables_parse()` instance.
  * Convert `iptables_parse()` instance.
  * Convert `iptables_parse()` instance.
  * Kill the now unused `iptables_parse()`.

  * Lower waiting time for USB installation in the test suite.
    So far we were waiting up to one hour, which is just the same as our
    Jenkins inactivity timeout, so in practice when Tails Installer fails
    and displays an error message, instead of reporting that the job failed
    (which is the point of the exercise) we abort the job due to this
    timeout (which communicates waaaay less clearly to me, with my Tails
    Installer developer hat, that there's probably a bug I should fix, as
    opposed to "here's a transient failure caused by instabilities of our
    Jenkins setup"). My understanding is that this is what prevented the
    Tails Installer bug described on #10717 from being identified earlier,
    and I don't want to see that happen again.
    IIRC this 1h timeout was relevant for running with nested virtualization
    on slightly old (ThinkPad X200) hardware. I don't think anyone does that
    anymore, and I would bet that on such hardware, lots of other bits of
    our test suite will time out anyway.
    Fix-committed: #10718
  * Mark apt-get scenario as fragile.
    Refs: #10496

  * Flag online scenarios as fragile.
    They all rely on the `wait_until_tor_is_working` helper which has lately
    proven to be still buggy. That's tracked by ticket #10497.
  * Flag a online scenario in Jessie as fragile.
    It depends on the `wait_until_tor_is_working` helper which is buggy.
    Refs: #10497

  * Mark as fragile all tests that rely on Tails Installer.
    Refs: #10720
  * Test suite: fix steps that shutdown/reboot via the applet.
    When we hide the cursor, they often fail: the menu appears and
    disappears immediately, before the shutdown or reboot button
    is located.
  * Use `systemctl mask' instead of manually symlinking, and thus avoid unneeded daemon-reload.
    `systemctl daemon-reload' is a very big hammer: while it's running, socket
    activation, D-Bus activation, and more systemd functionality are disabled.
    In this case, as long as we use only systemctl {stop, disable, mask}, then we
    don't need to do a global daemon reload, so let's not take the risk.
  * Fix typo.
  * Relax permissions on Tor and its child processes, to fix obfs4proxy startup.
    Closes: #10724
  * Install apparmor-profiles-extra from jessie-backports, that grants Totem access to DVD readers (refs: #10455), and fixes a freeze when trying to disable visual effects (refs: #9990).
  * Fix shell syntax in hook that detects leftover .orig files.
  * Unfuzzy apparmor-adjust-pidgin-profile.diff.
  * Unfuzzy chroot_local-patches/unmute_alsa_channels.patch.
  * Fix shell syntax error.
    In commit:3e85f97 I've fixed one such error and introduced another one
    ("git add -p" :)
  * Update a test suite image for Jessie.
  * Fix scenario name.
    This one does not test ~/.gnupg/.
  * Test suite: don't reboot when not needed.
    These lines somehow survived or were re-introduced via merge
    conflict resolution. That's the only explanation I have for them.
  * Optimize memory erasure anti-test: block the boot to save CPU on the host.

  * Add the bugfix-9713-electrum-2.5 APT overlay.
    Will-fix: #9713
  * Fix pinnings for electrum and its dependencies.
    Now we install a custom Wheezy backport of electrum from our own
    repo. Note that python-pbkdf2 is not even in Wheezy Backports, so we
    install it from Debian Jessie.
  * Make config appropriate for electrum 2.5.x.
    For now, let's also drop "auto connect" and server until we've decided
    on a server we can trust.

  * Flag forgoten online scenarios as fragile.
    Refs: #10497

  * Refresh patch against Tor's AppArmor profile to apply on top of 0.2.7.6-1.

  * Upgrade Tor Browser to 5.0.5.
    Will-fix: #10751

  * Warn if the claws-mail persistence is enabled when starting icedove.
    Refs: #10458
  * Warn if claws-mail persistence is activated AND it contains a accountrc file.
    Otherwise people will get the notification every time they start Icedove
    during the 1.8 lifetime.
    Will-fix: #10458

  * Update AdBlock Plus patterns.

  * Add Icedove to GNOME launcher, remove Claws-Mail

  * Empty the list of APT overlays: they were merged
  * Update PO files.

  * Install Electrum from jessie-backports.
    That is, currently: 2.5.4-1~bpo8+1. This is older than what we'll
    be shipping in Tails 1.8 (#9713), and we'll need a patch that's
    in 2.5.4-2, but for now it's still better than Jessie's 1.9.8-4,
    presumably.
    refs: #10754

  * Update changelog for 1.8.
  * Updating SquashFS sort file

  * Fix ticket number

  * Add security updates to the 1.8 changelog entry.

  * Test suite: drop unused steps.
    We're not doing anything with that file, no need to copy it.
  * Set base branch to devel.
  * Update POT and PO files.

intrigeri's avatar
intrigeri committed
855
 -- Tails developers <tails@boum.org>  Thu, 19 Nov 2015 16:01:19 +0000
856

anonym's avatar
anonym committed
857
tails (1.8) unstable; urgency=medium
anonym's avatar
anonym committed
858

anonym's avatar
anonym committed
859
860
  * Security fixes
    - Upgrade Tor to 0.2.7.6-1~d70.wheezy+1+tails1.
sajolida's avatar
sajolida committed
861
    - Upgrade Tor Browser to 5.0.5. (Closes: #10751)
862
863
864
865
866
867
868
869
870
871
872
    - Upgrade LibreOffice to 1:3.5.4+dfsg2-0+deb7u5.
    - Upgrade krb5-based packages to 1.10.1+dfsg-5+deb7u6.
    - Upgrade Linux to 3.16.7-ckt11-1+deb8u6.
    - Upgrade wpasupplicant to 1.0-3+deb7u3.
    - Upgrade libpng12-0 to 1.2.49-1+deb7u1.
    - Upgrade openjdk-7 to 7u91-2.6.3-1~deb7u1.
    - Upgrade libnspr4 to 2:4.9.2-1+deb7u3
    - Upgrade dpkg to 1.16.17.
    - Upgrade gnutls26 to 2.12.20-8+deb7u4.
    - Upgrade Icedove to 1:38.0.1-1~deb7u1.
    - Upgrade OpenSSL to 1.0.1e-2+deb7u18.
anonym's avatar
anonym committed
873

anonym's avatar
anonym committed
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
  * Bugfixes
    - Upgrade to Electrum 2.5.4-2~d70.wheezy+1+tails1. Now Electrum
      should work again. Note that the documentation has not been
      adapted to the slight changes in the Electrum account setup
      wizard yet.

  * Minor improvements
    - Upgrade I2P to 0.9.23-2~deb7u+1.
    - Rebase our patch against the Tor Browser AppArmor profile on top
      of the one shipped in torbrowser-launcher 0.2.1-2.
    - Warn if the claws-mail persistence is enabled and contains a
      Claws Mail configuration when starting icedove. (Closes: #10458)
    - Replace the Claws Mail GNOME launcher with Icedove. (Closes:
      #10739)
    - Remove the Claws Mail persistence feature from the Persistence
      Assistant. (Closes: #10742)

  * Build system
    - Simplify ISO image naming rules by using the base rule we use
      for Jenkins all the time, except when building from a tag
      (i.e. building a release).  (Closes: #10349)

  * Test suite
    - Lower the waiting time for USB installation in the test suite.
      So far we were waiting up to one hour, which is just the same as
      our Jenkins inactivity timeout, so in practice when Tails
      Installer fails and displays an error message, instead of
      reporting that the job failed (which is the point of the
      exercise) we abort the job due to this timeout which
      communicates less clearly that there's probably a bug. (Closes:
      #10718)
    - Remove the check for the sound icon in the systray in the
      Windows Camouflage tests. (Closes: #10493)
    - Retry running whois when "LIMIT EXCEEDED" is in its output for
      increased robustness. (Closes: #10523)
    - Make Seahorse tests more robust. (Closes: #9095, #10501)
    - Make the handling of Pidgin's account manager more robust.
      (Closes: #10506)
anonym's avatar
anonym committed
912

anonym's avatar
anonym committed
913
 -- Tails developers <tails@boum.org>  Mon, 14 Dec 2015 23:07:19 +0100
anonym's avatar
anonym committed
914

anonym's avatar
anonym committed
915
tails (1.7) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
916

anonym's avatar
anonym committed
917
  * Major new features and changes
anonym's avatar
anonym committed
918
    - Upgrade Tor Browser to 5.0.4. (Closes: #10456)
anonym's avatar
anonym committed
919
920
921
    - Add a technology preview of the Icedove Email client (a
      rebranded version of Mozilla Thunderbird), including OpenPGP
      support via the Enigmail add-on, general security and anonymity
sajolida's avatar
sajolida committed
922
      improvements via the Torbirdy add-on, and complete persistence
anonym's avatar
anonym committed
923
924
925
926
927
928
929
930
      support (which will be enabled automatically if you already have
      Claws Mail persistence enabled). Icedove will replace Claws Mail
      as the supported email client in Tails in a future
      release. (Closes: #6151, #9498, #10285)
    - Upgrade Tor to 0.2.7.4-rc-1~d70.wheezy+1+tails1. Among the many
      improvement of this new Tor major release, the new
      KeepAliveIsolateSOCKSAuth option allows us to drop the
      bug15482.patch patch (taken from the Tor Browse bundle) that
sajolida's avatar
sajolida committed
931
      enabled similar (but inferior) functionality for *all*
anonym's avatar
anonym committed
932
933
934
935
936
937
      SocksPort:s -- now the same circuit is only kept alive for
      extended periods for the SocksPort used by the Tor
      Browser. (Closes: #10194, #10308)
    - Add an option to Tails Greeter which disables networking
      completely. This is useful when intending to use Tails for
      offline work only. (Closes: #6811)
bertagaz's avatar
bertagaz committed
938

anonym's avatar
anonym committed
939
940
  * Security fixes
    - Fix CVE-2015-7665, which could lead to a network interface's IP
elouann's avatar
elouann committed
941
      address being exposed through wget. (Closes: #10364)
anonym's avatar
anonym committed
942
943
944
945
    - Prevent a symlink attack on ~/.xsession-errors via
      tails-debugging-info which could be used by the amnesia user to
      read the contents of any file, no matter the
      permissions. (Closes: #10333)
anonym's avatar
anonym committed
946
947
948
949
950
951
952
953
954
955
956
957
958
    - Upgrade libfreetype6 to 2.4.9-1.1+deb7u2.
    - Upgrade gdk-pixbuf packages to 2.26.1-1+deb7u2.
    - Upgrade Linux to 3.16.7-ckt11-1+deb8u5.
    - Upgrade openjdk-7 packages to 7u85-2.6.1-6~deb7u1.
    - Upgrade unzip to 6.0-8+deb7u4.

  * Bugfixes
    - Add a temporary workaround for an issue in our code which checks
      whether i2p has bootstrapped, which (due to some recent change
      in either I2P or Java) could make it appear it had finished
      prematurely. (Closes: #10185)
    - Fix a logical bug in the persistence preset migration code while
      real-only persistence is enabled. (Closes: #10431)
anonym's avatar
anonym committed
959
960

  * Minor improvements
anonym's avatar
anonym committed
961
962
    - Rework the wordings of the various installation and upgrade
      options available in Tails installer in Wheezy. (Closes: #9672)
anonym's avatar
anonym committed
963
964
965
966
967
    - Restart Tor if bootstrapping stalls for too long when not using
      pluggable transports. (Closes: #9516)
    - Install firmware-amd-graphics, and firmware-misc-nonfree instead
      of firmware-ralink-nonfree, both from Debian Sid.
    - Update the Tails signing key. (Closes: #10012)
anonym's avatar
anonym committed
968
969
970
971
972
973
    - Update the Tails APT repo signing key. (Closes: #10419)
    - Install the nmh package. (Closes: #10457)
    - Explicitly run "sync" at the end of the Tails Upgrader's upgrade
      process, and pass the "sync" option when remounting the system
      partition as read-write. This might help with some issues we've
      seen, such as #10239, and possibly for #8449 as well.
anonym's avatar
anonym committed
974
975
976

  * Test suite
    - Add initial automated tests for Icedove. (Closes: #10332)
elouann's avatar
elouann committed
977
    - Add automated tests of the MAC spoofing feature. (Closes: #6302)
anonym's avatar
anonym committed
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
    - Drop the concept of "background snapshots" and introduce a general
      system for generating snapshots that can be shared between
      features. This removes all silly hacks we previously used to
      "skip" steps, and greatly improves performance and reliability
      of the whole test suite. (Closes: #6094, #8008)
    - Flush to the log file in debug_log() so the debugging info can
      be viewed in real time when monitoring the debug log
      file. (Closes: #10323)
    - Force UTF-8 locale in automated test suite. Ruby will default to
      the system locale, and if it is non-UTF-8, some String-methods
      will fail when operating on non-ASCII strings. (Closes: #10359)
    - Escape regexp used to match nick in CTCP replies. Our Pidgin
      nick's have a 10% chance to include a ^, which will break that
      regexp. We need to escape all characters in the nick. (Closes:
      #10219)
    - Extract TBB languages from the Tails source code. This will
      ensure that valid locales are tested. As an added bonus, the
      code is greatly simplified. (Closes: #9897)
anonym's avatar
anonym committed
996
997
    - Automatically test that tails-debugging-info is not susceptible
      to the type of symlink attacks fixed by #10333.
anonym's avatar
anonym committed
998
999
1000
    - Save all test suite artifacts in a dedicated directory with more
      useful infromation encoded in the path. This makes it easier to
      see which artifacts belongs to which failed scenario and which
For faster browsing, not all history is shown. View entire blame