changelog 144 KB
Newer Older
Tails developers's avatar
Tails developers committed
1
tails (1.2.2) unstable; urgency=medium
2

Tails developers's avatar
Tails developers committed
3
4
5
6
7
8
  * Bugfixes
    - Create a CA bundle for Tails Upgrader at ISO build time, and
      patch tails-iuk to use it. Specifically this will make it
      possible to check for Tails upgrades after our website changes
      certificate around the 2014 to 2015 transition (Partially fixes
      #8404).
9

Tails developers's avatar
Tails developers committed
10
 -- Tails developers <tails@boum.org>  Mon, 15 Dec 2014 10:05:17 +0100
11

Tails developers's avatar
Tails developers committed
12
tails (1.2.1) unstable; urgency=low
13

Tails developers's avatar
Tails developers committed
14
15
16
  * Security fixes
    - Upgrade Linux to 3.16.0-4, i.e. 3.16.7-1.
    - Install Tor Browser 4.0.2 (based on Firefox 31.3.0esr).
17

Tails developers's avatar
Tails developers committed
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
  * Bugfixes
    - Install syslinux-utils, to get isohybrid back (Closes: #8155).
    - Update xserver-xorg-input-evdev to 1:2.7.0-1+tails1 which
      includes a patch that restores mouse scrolling in KVM/Spice
      (Closes: 7426).
    - Set Torbutton logging preferences to the defaults (Closes:
      #8160). With the default settings, no site-specific information is
      logged.
    - Use the correct stack of rootfs:s for the chroot browsers (Closes:
      #8152, #8158). After installing incremental upgrades Tails' root
      filesystem consists of a stack squashfs:s, not only
      filesystem.squashfs. When not stacking them correct we may end up
      using the Tor Browser (Firefox) from an older version of Tails, or
      with no Tor Browser at all, as in the upgrade from Tails 1.1.2 to
      1.2, when we migrated from Iceweasel to the Tor Browser. Based on
      a patch contributed by sanic.
    - Use the Tor Browser for MIME type that GNOME associates with
      Iceweasel (Closes: #8153). Open URLs from Claws Mail, KeePassX
      etc. should be possible again.
    - Update patch to include all Intel CPU microcodes (Closes: #8189).
    - AppArmor: allow Pidgin to run Tor Browser unconfined, with
      scrubbed environment (Closes: #8186). Links opened in Pidgin are
      now handled by the Tor Browser.
    - Install all localized Iceweasel search plugins (Closes: #8139).
    - When generating the boot profile, ignore directories in
      process_IN_ACCESS as well (Closes: #7925). This allows ut to
      update the squashfs-ordering again in Tails 1.2.1.
    - gpgApplet: Don't pass already encoded data to GTK2 (Closes:
      #7968). It's now possible to clearsign text including non-ASCII
      characters.
    - Do not run the PulseAudio initscript, neither at startup nor
      shutdown (Closes: #8082).

  * Minor improvements
    - Upgrade I2P to 0.9.17-1~deb7u+1.
    - Make GnuPG configuration closer to the best practices one
      (Closes: #7512).
    - Have GnuPG directly use the Tor SOCKS port (Closes: #7416).
    - Remove TrueCrypt support and documentat how to open TrueCrypt
      volumes using cryptsetup (Closes: #5373).
    - Install hopenpgp-tools from Debian Jessie.

  * Build system
    - Add gettext >= 0.18.3 as a Tails build dependency. We need it for
      xgettext JavaScript support in feature/jessie.

  * Automated test suite
    - Don't click to open a sub-menu in the GNOME applications menu
      (Closes: #8140).
    - When testing the Windows camouflage, look for individual systray
      applets, to avoid relying on their ordering (Closes: #8059).
    - Focus the Pidgin Buddy List before looking for something
      happening in it (Closes: #8161).
    - Remove workaround for showing the TBB's menu bar (Closes #8028).

 -- Tails developers <tails@boum.org>  Tue, 02 Dec 2014 11:34:03 +0100
74

Tails developers's avatar
Tails developers committed
75
tails (1.2) unstable; urgency=medium
Tails developers's avatar
Tails developers committed
76

77
78
  * Major new features
    - Migrate from Iceweasel to the Tor Browser from the Tor Browser
79
80
      Bundle 4.0 (based on Firefox 31.2.0esr). This fixes the POODLE
      vulnerability.
81
82
83
84
85
      The installation in Tails is made global (multi-profile), uses
      the system-wide Tor instance, disables the Tor Browser updater,
      and keeps the desired deviations previously present in Iceweasel,
      e.g. we install the AdBlock Plus add-on, but not Tor Launcher (since
      we run it as a standalone XUL application), among other things.
86
    - Install AppArmor's userspace tools and apparmor-profiles-extra
87
88
89
90
      from Wheezy Backports, and enable the AppArmor Linux Security
      Module. This adds Mandatory Access Control for several critical
      applications in Tails, including Tor, Vidalia, Pidgin, Evince
      and Totem.
91
    - Isolate I2P traffic from the Tor Browser by adding a dedicated
92
      I2P Browser. It is set up similarly to the Unsafe Browser,
93
      but further disables features that are irrelevant for I2P, like
94
      search plugins and the AdBlock Plus addon, while keeping Tor Browser
95
      security features like the NoScript and Torbutton addons.
96
    - Upgrade Tor to 0.2.5.8-rc-1~d70.wheezy+1.
Tails developers's avatar
Tails developers committed
97

98
99
100
101
102
103
104
105
106
  * Security fixes
    - Disable TCP timestamps (Closes: #6579).

  * Bugfixes
    - Remove expired Pidgin certificates (Closes: #7730).
    - Use sudo instead of gksudo for running tails-upgrade-frontend to
      make stderr more easily accessible (Closes: #7431).
    - Run tails-persistence-setup with sudo instead of gksudo to make
      stderr more easily accessible, and allow the desktop user to
107
108
      pass the --verbose parameter (Closes: #7623).
    - Disable CUPS in the Unsafe Browser. This will prevent the
109
      browser from hanging for several minutes when accidentally
110
      pressing CTRL+P or trying to go to File -> Print (Closes: #7771).
111
112

  * Minor improvements
113
114
115
116
117
    - Install Linux 3.16-3 (version 3.16.5-1) from Debian
      unstable (Closes: #7886, #8100).
    - Transition away from TrueCrypt: install cryptsetup and friends
      from wheezy-backports (Closes: #5932), and make it clear that
      TrueCrypt will be removed in Tails 1.2.1 (Closes: #7739).
118
119
120
121
122
123
124
125
126
    - Install Monkeysign dependencies for qrcodes scanning.
    - Upgrade syslinux to 3:6.03~pre20+dfsg-2~bpo70+1, and install
      the new syslinux-efi package.
    - Upgrade I2P to 0.9.15-1~deb7u+1
    - Enable Wheezy proposed-updates APT repository and setup APT
      pinnings to install packages from it.
    - Enable Tor's syscall sandbox. This feature (new in 0.2.5.x)
      should make Tor a bit harder to exploit. It is only be enabled
      when when no special Tor configuration is requested in Tails
127
      Greeter due to incompatibility with pluggable transports.
128
129
130
    - Start I2P automatically when the network connects via a
      NetworkManager hook, and "i2p" is present on the kernel command
      line. The router console is no longer opened automatically, but
131
132
      can be accessed through the I2P Browser (Closes: #7732).
    - Simplify the IPv6 ferm rules (Closes: #7668).
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
    - Include persistence.conf in WhisperBack reports (Closes: #7461)
    - Pin packages from testing to 500, so that they can be upgraded.
    - Don't set Torbutton environment vars globally (Closes: #5648).
    - Enable VirtualBox guest additions by default (Closes: #5730). In
      particular this enables VirtualBox's display management service.
    - In the Unsafe Browser, hide option for "Tor Browser Health
      report", and the "Get Addons" section in the Addon manager
      (Closes: #7952).
    - Show Pidgin's formatting toolbar (Closes: #7356). Having the
      formatting toolbar displayed in Pidgin makes the OTR status more
      explicit by displaying it with words.

  * Automated test suite
    - Add --pause-on-fail to ease VM state debugging when tests
      misbehave.
    - Add execute_successfully() and assert_vmcommand_success() for
      added robustness when executing some command in the testing VM.
    - Use Test::Unit::Assertions instead of our home-made assert().
    - Add test for persistent browser bookmarks.
    - Add basic tests for Pidgin, Totem and Evince, including their
      AppArmor enforcement.
    - Factorize some common step pattern into single steps.
    - Factorize running a command in GNOME Terminal.
    - Add common steps to copy a file and test for its existence.
    - Add a wait_and_double_click Sikuli helper method.
    - Add a VM.file_content method, to avoid repeating ourselves, and
      use it whenever easily doable.
    - Drop test that diffs syslinux' exithelp.cfg: we don't ship this
      file anymore.
    - In the Unsafe Browser tests, rely on subtle timing less (Closes:
      #8009).
    - Use the same logic to determine when Tor is working in the test
      suite as in Tails itself. The idea is to avoid spamming the Tor
      control port during bootstrap, since we've seen problems with
      that already.

Tails developers's avatar
Tails developers committed
169
 -- Tails developers <tails@boum.org>  Wed, 15 Oct 2014 18:34:50 +0200
Tails developers's avatar
Tails developers committed
170

Tails developers's avatar
Tails developers committed
171
tails (1.1.2) unstable; urgency=medium
172

Tails developers's avatar
Tails developers committed
173
174
175
176
  * Security fixes
    - Upgrade the web browser to 24.8.0esr-0+tails3~bpo70+1
      (fixes Mozilla#1064636).
    - Install Linux 3.16-1 from sid (Closes: #7886).
177
178
179
180
181
    - Upgrade file to 5.11-2+deb7u5 (fixes CVE-2014-0207,
      CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479,
      CVE-2014-3480, CVE-2014-3487, CVE-2014-3538 and CVE-2014-3587).
    - Upgrade curl to 7.26.0-1+wheezy10 (fixes CVE-2014-3613 and
      CVE-2014-3620).
182
183
    - Upgrade bind9-based packages to 1:9.8.4.dfsg.P1-6+nmu2+deb7u2
      (fixes CVE-2014-0591).
184
185
    - Upgrade gnupg to 1.4.12-7+deb7u6 (fixes CVE-2014-5270).
    - Upgrade apt to 0.9.7.9+deb7u5 (fixes CVE-2014-0487,
186
187
      CVE-2014-0488, CVE-2014-0489, CVE-2014-0490, and
      CVE-2014-6273.).
188
189
190
191
    - Upgrade dbus to 1.6.8-1+deb7u4 (fixes CVE-2014-3635,
      CVE-2014-3636, CVE-2014-3637, CVE-2014-3638 and CVE-2014-3639).
    - Upgrade libav-based pacakges to 6:0.8.16-1 (fixes
      CVE-2013-7020).
192
    - Upgrade bash to 4.2+dfsg-0.1+deb7u1 (fixes CVE-2014-6271).
193

Tails developers's avatar
Tails developers committed
194
 -- Tails developers <tails@boum.org>  Tue, 23 Sep 2014 23:01:40 -0700
195

Tails developers's avatar
Tails developers committed
196
tails (1.1.1) unstable; urgency=medium
197

Tails developers's avatar
Tails developers committed
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
  * Security fixes
    - Upgrade the web browser to 24.8.0esr-0+tails1~bpo70+1
      (Firefox 24.8.0esr + Iceweasel patches + Torbrowser patches).
      Also import the Tor Browser profile at commit
      271b64b889e5c549196c3ee91c888de88148560f from
      ttp/tor-browser-24.8.0esr-3.x-1.
    - Upgrade Tor to 0.2.4.23-2~d70.wheezy+1 (fixes CVE-2014-5117).
    - Upgrade I2P to 0.9.14.1-1~deb7u+1.
    - Upgrade Linux to 3.14.15-2 (fixes CVE-2014-3534, CVE-2014-4667
      and CVE-2014-4943).
    - Upgrade CUPS-based packages to 1.5.3-5+deb7u4 (fixes
      CVE-2014-3537, CVE-2014-5029, CVE-2014-5030 and CVE-2014-5031).
    - Upgrade libnss3 to 2:3.14.5-1+deb7u1 (fixes CVE-2013-1741,
      CVE-2013-5606, CVE-2014-1491 and CVE-2014-1492).
    - Upgrade openssl to 1.0.1e-2+deb7u12 (fixes CVE-2014-3505,
      CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509,
      CVE-2014-3510, CVE-2014-3511, CVE-2014-3512 and CVE-2014-5139).
    - Upgrade krb5-based packages to 1.10.1+dfsg-5+deb7u2 (fixes
      CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344 and
      CVE-2014-4345).
    - Upgrade libav-based packages to 6:0.8.15-1 (fixes CVE-2011-3934,
      CVE-2011-3935, CVE-2011-3946, CVE-2013-0848, CVE-2013-0851,
      CVE-2013-0852, CVE-2013-0860, CVE-2013-0868, CVE-2013-3672,
      CVE-2013-3674 and CVE-2014-2263.
    - Upgrade libgpgme11 to 1.2.0-1.4+deb7u1 (fixes CVE-2014-5117).
    - Upgrade python-imaging to 1.1.7-4+deb7u1 (fixes CVE-2014-3589).
    - Prevent dhclient from sending the hostname over the network
      (Closes: #7688).
    - Override the hostname provided by the DHCP server (Closes: #7769).
    - Add an I2P boot parameter. Without adding "i2p" to the kernel
      command line, I2P will not be accessible for the Live user.
    - Stricter I2P firewall rules:
      * deny I2P from accessing the LAN
      * deny I2P from accessing the loopback device, except for select
        whitelisted services
      * allow I2P access to the Internet
      The ACCEPT rules will only be enabled when the string 'i2p' is
      passed at the boot prompt. The rules which DENY or REJECT
      access for the 'i2psvc' user will always be applied.
    - Disable I2P plugins, since it doesn't make much sense without
      persistence, and should eliminate some attack vectors.
    - Disable I2P's BOB port. No maintained I2P application uses it.
240

Tails developers's avatar
Tails developers committed
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
  * Bugfixes
    - Fix condition clause in tails-security-check (Closes: #7657).
    - Don't ship OpenJDK 6: I2P prefers v7, and we don't need both.
    - Prevent Tails Installer from updating the system partition
      properties on MBR partitions (Closes: #7716).

  * Minor improvements
    - Upgrade to Torbutton 1.6.12.1.
    - Install gnome-user-guide (Closes: #7618).
    - Install cups-pk-helper (Closes: #7636).
    - Update the SquashFS sort file.
    - Compress the SquashFS more aggressively (Closes: #7706).
    - I2P: Keep POP3 email on server. The default in the I2P webmail
      app was to keep mail on the server, but that setting was changed
      recently. This configuration setting (susimail.config) will only
      be copied over in I2P 0.9.14 and newer.
    - Add a Close button to the Tails Installer launcher window.

  * Build system
    - Migrate Vagrant basebox to Debian Wheezy (Closes #7133, #6736).
    - Consistently use the same Debian mirror.
    - Disable runtime APT proxy configuration when using APT in
      binary_local-hooks (Closes: #7691).

  * Automated test suite
    - Automatically test hostname leaks (Closes: #7712).
    - Move autotest live-config hook to be run last. This way we'll
      notice if some earlier live-config hook cancels all hooks by
      running the automated test suite since the remote shell won't be
      running in that case.
    - Test that the I2P boot parameter does what it's supposed to do
      (Closes: #7760).
    - Start applications by using the GNOME Applications menu instead
      of the GNOME Run Dialog (Closes: #5550, #7060).
275

Tails developers's avatar
Tails developers committed
276
 -- Tails developers <tails@boum.org>  Sun, 31 Aug 2014 20:49:28 +0000
277

Tails developers's avatar
Tails developers committed
278
tails (1.1) unstable; urgency=medium
279

280
281
282
283
284
285
  * Rebase on Debian Wheezy
    - Upgrade literally thousands of packages.
    - Migrate to GNOME3 fallback mode.
    - Install LibreOffice instead of OpenOffice.
    - Remove custom LSB logging: Wheezy has fancy colored init
      logging.
286

287
  * Major new features
288
    - UEFI boot support.
289
290
    - Replace the Windows XP camouflage with an experimental Windows 8
      camouflage.
291
    - Install Linux 3.14.12-1 from Debian unstable.
292
293
294
    - Bring back VirtualBox guest modules, installed from Wheezy
      backports. Full functionality is only available when using the
      32-bit kernel.
295

296
  * Security fixes
297
    - Fix write access to boot medium via udisks (#6172).
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
    - Don't allow the desktop user to pass arguments to
      tails-upgrade-frontend (Closes: #7410).
    - Make persistent file permissions safer (Closes #7443):
      * Make the content of /etc/skel non-world-readable. Otherwise,
        such files may be copied to /home/amnesia, and in turn to the
        persistent volume, with unsafe permissions. That's no big deal
        in /home/amnesia (that is itself not world-readable), *but*
        the root of the persistent volume has to be world-readable.
      * Have activate_custom_mounts create new directories with safe
        permissions.
      * Set strict permissions on /home/amnesia (Closes: #7463).
      * Fix permissions on persistent directories that were created
        with unsafe permissions (Closes: #7458).
      * Fix files ownership while copying persistence (Closes: #7216).
        The previous instructions to copy the persistent data were
        creating personal files that belong to root. I don't think
        there is a way of preserving the original ownership using
        Nautilus (unless doing a "move" instead of a "copy" but that's
        not what we are trying to do here).
    - Disable FoxyProxy's proxy:// protocol handler (Closes: #7479).
      FoxyProxy adds the proxy:// protocol handler, which can be used
      to configure the proxy via an URI. A malicious web page can
      include (or a malicious exit node can inject) some JavaScript
      code to visit such an URI and disable or otherwise change
      Iceweasel's proxy settings. While using this to disable
      proxying will be dealt with safely by our firewall, this could
      be used to defeat stream isolation, although the user must be
      tricked into accepting the new proxy settings.
326
327
328
329
330
331
332
    - Upgrade the web browser to 24.7.0esr-0+tails1~bpo70+1
      (Firefox 24.7.0esr + Iceweasel patches + Torbrowser patches).
    - Upgrade to Linux 3.14.12-1 (fixes CVE-2014-4699).
    - Upgrade libav-based packages to 0.8.13-1 (fixes CVE-2014-4609).
    - Upgrade to libxml2 2.8.0+dfsg1-7+wheezy1 (fixes CVE-2014-0191).
    - Upgrade to dbus 1.6.8-1+deb7u3 (fixes CVE-2014-3477,
      CVE-2014-3532 and CVE-2014-3533).
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352

  * Bugfixes
    - Disable GNOME keyring's GnuPG functionality. (Closes: #7330) In
      feature/regular-gnupg-agent, we installed the regular GnuPG
      agent so that it is used instead of GNOME keyring's one. This is
      not enough on Wheezy, so let's disable the starting of the "gpg"
      component of GNOME keyring.
    - Make sure /etc/default/locale exists, with a sensible default
      value (Closes: #7333). Before Tails Greeter's PostLogin script
      are run, /etc/default/locale does not exist on Wheezy. Our
      tails-kexec initscript (and quite a few other scripts we run)
      depends on this file to exist. So, let's make sure it exists,
      with a sensible default value.
    - Create the tails-persistence-setup user with the same UID/GID it
      had on Tails/Squeeze. (Closes: #7343) Else, our various checks
      for safe access rights on persistence.conf fail.
    - Revert back to browsing the offline documentation using Iceweasel
      instead of Yelp (Closes: #7390, #7285).
    - Make the new NetworkManager configuration directory persistent,
      when the old one was, but disable the old one (Closes: #7338).
Tails developers's avatar
Tails developers committed
353
354
355
356
    - Before running tails-upgrade-frontend, chdir to a world-readable
      place (Closes: #7641). In particular, Archive::Tar::Wrapper,
      when called by tails-install-iuk, wants to chdir back to the
      original cwd after it has chdir'd elsewhere to do its job.
357
358
359

  * Minor improvements
    - Install seahorse-nautilus, replacing seahorse-plugins (Closes #5516).
360
    - Install hledger (custom backport, for now): our accountants need this.
361
362
363
364
365
366
367
368
369
370
371
372
    - Install stable Scribus instead of scribus-ng.
    - Install the printer driver for Epson Inkjet that use ESC/P-R.
    - Install the BookletImposer PDF imposition toolkit. It's tiny,
      and really helpful e.g. when producing booklets.
    - Install gtkhash and nautilus-gtkhash (Closes #6763).
    - Import new version of Tor Launcher:
      · Now based on upstream Tor Launcher 0.2.5.4.
      · Tor bug #11772: Proxy Type menu not set correctly
      · Tor bug #11699: Change &amp;#160 to &#160; in network-settings.dtd
      · Correctly handle startup paths that contain dot.
    - Upgrade to Torbutton 1.6.9.0.
    - Avoid shipping python2.6 in addition to python2.7.
373
374
    - Don't install Gobby 0.4 anymore. Gobby 0.5 has been available in
      Debian since Squeeze, now is a good time to drop the obsolete
375
376
377
378
379
380
381
382
383
384
385
386
387
      0.4 implementation.
    - Require a bit less free memory before checking for upgrades with
      Tails Upgrader. The general goal is to avoid displaying "Not
      enough memory available to check for upgrades" too often due to
      over-cautious memory requirements checked in the wrapper.
    - Make Tails Greeter's help window resolution-aware. Previously it
      used a static 800x600 which was problematic on lower resolutions,
      and sub-optimal on higher resolutions. Now it adapts itself
      according to the screen resolution.
    - Whisperback now sanitizes attached logs better with respect to
      DMI data, IPv6 addresses, and serial numbers (Closes #6797,
      #6798, #6804).
    - Integrate the new logo in Tails Installer (Closes #7095)
388
389
390
391
392
393
394
395
396
397
    - Also install linux-base and linux-compiler-gcc-4.8-x86 from
      sid. This way, we can get rid of our linux-compiler-gcc-4.8-x86
      3.12, and it makes things a bit more consistent.
    - Include the syslinux binary, and its MBR, in the ISO filesystem.
      This in turn allows Tails Installer to use this binary and MBR,
      which is critical for avoiding problems (such as #7345) on
      "Upgrade from ISO".
    - Include syslinux.exe for win32 in utils/win32/ on the ISO
      filesystem (Closes: #7425).
    - Tails Installer:
398
      * Add consistent margins in GUI.
399
400
401
402
403
404
405
406
407
      * Always reset the target drive's MBR, without asking for
        confirmation, after installing or upgrading.
      * Install the bootloader using the syslinux binary found on the
        target device, once the Live OS has been extracted/copied
        there.
    - Enable double-clicking to pick entries in the language or
      keyboard layout lists in Tails Greeter.
    - Install backport of shared-mime-info 1.3 (Closes: #7079).
    - Make sanity-check prompts closable in Tails Persistence Setup
Tails developers's avatar
Tails developers committed
408
      (Closes: #7119).
409
    - Fix quick search in Tails Greeter's Other languages window
Tails developers's avatar
Tails developers committed
410
      (Closes: #5387).
411
412
413
414
415
    - Install systemd. It is not enabled by default, but having it
      around will help doing the migration work.
    - Enable AppArmor on the kernel command-line. This is a no-op
      without the userspace tools and with no profile shipped, but it
      will make it easier to fix this part of the situation.
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437

  * Build system
    - Bump Vagrant builder's memory for RAM builds. Wheezy requires
      more space to build, and the resulting image is larger.
    - Fix Vagrant compatibility issue. Some classes' methods/fields
      have been renamed between Vagrant versions, so we need a simple
      compatibility layer to support all versions. Without this, it's
      not possible to issue e.g. a `build` command to an already
      running (i.e. `vm:up`:ed) Vagrant instance.
    - Move cpu and mem checks to the `build` task. Previously, when
      they were checked in `vm:up` *only* when issued while the VM
      already is up, so these checks weren't run if one issues a
      `build` when the VM is off. Now we'll fail earlier with a more
      informative error message, and it looks like a more logical home
      for them too.
    - Fix buggy memory checks for RAM building. We have to take into
      account which state the Vagrant VM is in for determining *where*
      we check if enough memory is available for a RAM build. If it's
      off, we check the host; if it's on we check the VM. Previously
      we always checked the host, which doesn't make sense when the VM
      is already started.

438
  * Automated test suite
439
440
441
    - Bump the tester VM's RAM by 256 MiB. There is not enough free
      RAM to run Tails Upgrader with just 1 GiB of RAM after the
      migration to Wheezy.
442
443
444
445
446
447
    - Always adjust OOM and memory overcommit settings. The kernel
      freezes seem to also happen for the amd64 kernel when filling
      the memory.
    - Add option to make Sikuli rety on FindFailed. This makes it
      possible to update manu images for Sikuli in just *one* test
      suite run, by continuously updating outdated pictures as we go.
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
    - Actually run "Upgrade from ISO" from a USB drive running the old
      version. That's what users do, and is buggy.
    - Automatically test persistent directories permissions (Closes: #7560).
    - Use read-write persistence when testing upgraded USB
      installations.  Otherwise e.g. the permission fixes won't get
      applied, and the subsequent steps testing the permissions will
      fail.
    - Actually check that the ISO's Tails is installed. The step
      "Tails is installed on USB drive $TARGET" only checks that the
      *running* Tails is installed on $TARGET, which obviously fails
      when doing an upgrade from ISO running an old Tails. That it
      worked for the same scenario running the current Tails is just
      coincidental.
    - Use OpenJDK 7 to run our test suite (Closes #7175).
    - Use qemu-system-x86_64 directly, instead of kvm, for running the
      automated test suite (Closes: #7605).

 -- Tails developers <tails@boum.org>  Sun, 20 Jul 2014 23:16:13 +0200

tails (1.0.1) unstable; urgency=medium
468

469
470
471
472
473
474
475
476
477
478
479
  * Security fixes
    - Upgrade the web browser to 24.6.0esr-0+tails1~bpo60+1
      (Firefox 24.6.0esr + Iceweasel patches + Torbrowser patches).
      Also import the Tor Browser profile at commit
      90ba8fbaf6f23494f1a0e38d63153b3b7e65d3d3 from
      ttp/tor-browser-24.6.0esr-3.x-1.
    - Install Linux 3.14 from Debian unstable (fixes CVE-2014-3153 and
      others).
    - Install openssl from Squeeze LTS (fixes CVE-2014-0076,
      CVE-2014-0195, CVE-2014-0221, CVE-2014-3470 and CVE-2014-0224).
    - Install GnuTLS from Squeeze LTS (fixes CVE-2014-3466.).
480

481
482
483
484
485
486
487
488
  * Minor improvements
    - Add Squeeze LTS APT sources. It has been given a low pinning
      priority so explicit pinning must be used to actually install
      anything from it.
    - Upgrade Tor to 0.2.4.22-1~d60.squeeze+1.
    - Upgrade I2P to 0.9.13-1~deb6u+1.

 -- Tails developers <tails@boum.org>  Sun, 08 Jun 2014 19:14:00 +0200
489

Tails developers's avatar
Tails developers committed
490
tails (1.0) unstable; urgency=medium
491

Tails developers's avatar
Tails developers committed
492
493
494
  * Security fixes
    - Upgrade the web browser to 24.5.0esr-0+tails1~bpo60+1
      (Firefox 24.5.0esr + Iceweasel patches + Torbrowser patches).
495
496
497
    - Upgrade Tor to 0.2.4.21-1+tails1~d60.squeeze+1:
      * Based on 0.2.4.21-1~d60.squeeze+1.
      * Backport the fix for Tor bug #11464. It adds client-side blacklists for
Tails developers's avatar
Tails developers committed
498
499
500
        all Tor directory authority keys that was vulnerable to Heartbleed.
        This protects clients in case attackers were able to compromise a
        majority of the authority signing and identity keys.
501

Tails developers's avatar
Tails developers committed
502
   * Bugfixes
Tails developers's avatar
Tails developers committed
503
    - Disable inbound I2P connections. Tails already restricts incoming
504
505
506
      connections, but this change tells I2P about it.
    - Fix link to the system requirements documentation page in the Tails
      Upgrader error shown when too little RAM is available.
507

508
509
510
511
512
513
514
515
516
517
518
519
520
  * Minor improvements
    - Upgrade I2P to 0.9.12-2~deb6u+1.
    - Import TorBrowser profile. This was forgotten in Tails 0.23 and even
      though we didn't explicitly set those preferences in that release
      they defaulted to the same values. This future-proofs us in case the
      defaults would ever change.
    - Import new custom version of tor-launcher:
      * Based on upstream Tor Launcher 0.2.5.3.
      * Improve how Tor Launcher handles incomplete translation.
        (Tor bug #11483; more future-proof fix for Tails bug #6885)
      * Remove the bridge settings prompt. (Tor bug #11482; closes Tails
        bug #6934,)
      * Always show bridge help button. (Tor bug #11484)
Tails developers's avatar
Tails developers committed
521
522
523
524
    - Integrate the new Tails logo into various places:
      * The website
      * The boot splash
      * The "About Tails" dialog
525
526
527
528
529
530
531
532

  * Build system
    - Use the stable APT suite when building from the stable Git branch
      (Closes: #7022).

  * Test suite
    - Add test for the #7022 fix.

Tails developers's avatar
Tails developers committed
533
 -- Tails developers <tails@boum.org>  Sun, 27 Apr 2014 19:34:01 +0200
534

Tails developers's avatar
Tails developers committed
535
tails (0.23) unstable; urgency=medium
536

537
538
539
540
  * Security fixes
    - Upgrade the web browser to 24.4.0esr-0+tails1~bpo60+1
      (Firefox 24.4.0esr + Iceweasel patches + Torbrowser patches).

541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
  * Major new features
    - Spoof the network interfaces' MAC address by default (Closes: #5421),
      as designed on https://tails.boum.org/contribute/design/MAC_address/.
    - Rework the way to configure how Tor connects to the network
      (bridges, proxy, fascist firewall): add an option to Tails Greeter,
      start Tor Launcher when needed (Closes: #5920, #5343).

  * Bugfixes
    - Additional software: do not crash when persistence is disabled
      (Closes: #6440).
    - Upgrade Pidgin to 2.10.9, that fixes some regressions introduced
      in the 2.10.8 security update (Closes: #6661).
    - Wait for Tor to have fully bootstrapped, plus a bit more time,
      before checking for upgrades (Closes: #6728) and unfixed known
      security issues.
    - Disable the Intel Management Engine Interface driver (Closes: #6460).
      We don't need it in Tails, it might be dangerous, and it causes bugs
      on various hardware such as systems that reboot when asked to shut down
    - Add a launcher for the Tails documentation. This makes it available
      in Windows Camouflage mode (Closes: #5374, #6767).
    - Remove the obsolete wikileaks.de account from Pidgin (Closes: #6807).

  * Minor improvements
    - Upgrade Tor to 0.2.4.21-1~d60.squeeze+1.
    - Upgrade obfsproxy to 0.2.6-2~~squeeze+1.
    - Upgrade I2P to 0.9.11-1deb6u1.
    - Install 64-bit kernel instead of the 686-pae one (Closes: #5456).
      This is a necessary first step towards UEFI boot support.
    - Install Monkeysign (in a not-so-functional shape yet).
    - Disable the autologin text consoles (Closes: #5588). This was one of
      the blockers before a screen saver can be installed
      in a meaningful way (#5684).
    - Don't localize the text consoles anymore: it is broken on Wheezy,
      the intended users can as well use loadkeys, and we now do not have
      to trust setupcon to be safe for being run as root by the desktop user.
    - Make it possible to manually start IBus.
    - Reintroduce the possibility to switch identities in the Tor Browser,
      using a filtering proxy in front of the Tor ControlPort to avoid giving
      full control over Tor to the desktop user (Closes: #6383).
    - Incremental upgrades improvements:
      · Drop the Tails Upgrader launcher, to limit users' confusion
        (Closes: #6513).
      · Lock down sudo credentials a bit.
584
      · Hide debugging information (Closes: #6505).
585
586
      · Include ~/.xsession-errors in WhisperBack bug reports.
        This captures the Tails Upgrader errors and debugging information.
587
588
589
      · Report more precisely why an incremental upgrade cannot be done
        (Closes: #6575).
      · Various user interface and phrasing improvements.
590
591
592
593
594
595
596
597
598
    - Don't install the Cookie Monster browser extension (Closes: #6790).
    - Add a browser bookmark pointing to Tor's Stack Exchange (Closes: #6632).
    - Remove the preconfigured #tor channel from the Pidgin: apparently,
      too many Tails users go ask Tails questions there, without making
      it clear that they are running Tails, hence creating a user-support
      nightmare (Closes: #6679).
    - Use (most of) Tor Browser's mozconfig (Closes: #6474).
    - Rebase the browser on top of iceweasel 24.3.0esr-1, to get
      the certificate authorities added by Debian back (Closes: #6704).
599
600
601
602
603
604
    - Give access to the relevant documentation pages from Tails Greeter.
    - Hide Tails Greeter's password mismatch warning when entry is changed.
    - Persistent Volume Assistant:
      · Take into account our installer is now called Tails Installer.
      · Optimize window height (Closes: #5458).
      · Display device paths in a more user-friendly way (Closes: #5311).
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631

  * Build system
    - Ease updating POT and PO files at release time, and importing translations
      from Transifex (Closes: #6288, #6207).
    - Drop custom poedit backport, install it from squeeze-backports-sloppy.
    - Make ISO and IUK smaller (Closes: #6390, #6425):
      · Exclude more files from being included in the ISO.
      · Remove *.pyc later so that they are not recreated.
      · Truncate log files later so that they are not filled again.
      · At ISO build time, set mtime to the epoch for large files whose content
        generally does not change between releases. This forces rsync
        to compare the actual content of these files, when preparing an IUK,
        instead of blindly adding it to the IUK merely because the mtime
        has changed, while the content is the same.
    - Make local hooks logging consistent.

  * Test suite
    - Migrate from JRuby to native Ruby + rjb.
    - The test suite can now be run on Debian Wheezy + backports.
    - Fix buggy "persistence is not enabled" step (Closes: #5465).
    - Use IPv6 private address as of RFC 4193 for the test suite's virtual
      network. Otherwise dnsmasq from Wheezy complains, as it is not capable
      of handling public IPv6 addresses.
    - Delete volumes after each scenario unless tagged @keep_volumes.
    - Add an anti-test to make sure the memory erasure test works fine.
    - A *lot* of bugfixes, simplifications and robustness improvements.

Tails developers's avatar
Tails developers committed
632
 -- Tails developers <tails@boum.org>  Tue, 18 Mar 2014 00:58:50 +0100
633

Tails developers's avatar
Tails developers committed
634
tails (0.22.1) unstable; urgency=medium
635

636
  * Security fixes
637
638
639
640
    - Upgrade the web browser to 24.3.0esr-0+tails1~bpo60+2
      (Firefox 24.3.0esr + Iceweasel patches + Torbrowser patches).
    - Upgrade NSS to 3.14.5-1~bpo60+1.
    - Upgrade Pidgin to 2.10.8.
641
642
643
644
    - Workaround browser size fingerprinting issue by using small icons
      in the web browser's navigation toolbar (Closes: #6377).
      We're actually hit by Tor#9268, and this is the best workaround gk
      and I were able to find when discussing this on Tor#10095.
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676

  * Major new features
    - Check for upgrades availability using Tails Upgrader, and propose
      to apply an incremental upgrade whenever possible (Closes: #6014).
      · Run tails-update-frontend at session login time.
      · Have tails-security-check only report unfixed security issues.
      · Greatly improve the Tails Upgrader UI and strings phrasing.
      · Enable startup notification for Tails Upgrader.
    - Install Linux 3.12 (3.12.6-2) from Debian testing. Unfortunately,
      this breaks the memory wipe feature on some hardware (#6460), but
      it fixes quite a few security issues, and improves hardware support.
    - Update the build system to be compatible with Vagrant 1.2 and 1.3,
      in addition to the already supported versions (Closes: #6221).
      Thanks to David Isaac Wolinsky <isaac.wolinsky@gmail.com>.

  * Bugfixes
    - Do not start IBus for languages that don't need it. This fixes
      the keybindings problems introduced in 0.22 (Closes: #6478).
      Thanks to WinterFairy.
    - Disable network.proxy.socks_remote_dns in the Unsafe Browser.
      Bugfix against 0.22 (Closes: #6479).
    - Fetch Tor Browser User-Agent from its own prefs, rather than from
      the obsolete Torbutton ones. Bugfix against 0.22 (Closes: #6477).
    - Upgrade Vagrant basebox to include up-to-date Debian archive keys
      (Closes: #6515, #6527).
    - Do not use a non-working proxy for downloading the Vagrant basebox
      (Closes: #6514).
    - Use IE's icon in Windows camouflage mode.
      Bugfix against 0.22 (Closes: #6536).
    - Support "upgrading" a partial Tails installation (Closes: #6438)
      and fix missing confirmation dialog in Tails Installer (Closes: #6437).
      Thanks to Andres Gomez Ramirez <andres.gomez@cern.ch>.
677
    - Fix browser homepage in Spanish locales (Closes: #6612).
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692

  * Minor improvements
    - Tor 0.2.4 is stable! Adapt APT sources accordingly.
    - Update Tor Browser to 24.2.0esr-1+tails1, that uses its own NSS
      library instead of the system one.
    - Update Torbutton to 1.6.5.3.
    - Do not start Tor Browser automatically, but notify when Tor is ready.
      Warn the user when they attempt to start Tor Browser before Tor is ready.
    - Import Tor Browser profile at
      3ed5d9511e783deb86835803a6f40e7d5a182a12 from ttp/tor-browser-24.2.0esr-1.
    - Use http.debian.net for Vagrant builds, instead of the mostly broken
      (and soon obsolete) cdn.debian.net.
    - Phrasing and UI improvements in tails-upgrade-frontend.
    - Style and robustness improvements in tails-security-check.
    - Make room for upcoming UEFI support in Tails Installer.
693

694
 -- Tails developers <tails@boum.org>  Wed, 29 Jan 2014 15:08:13 +0100
695

696
tails (0.22) unstable; urgency=medium
697

698
  [Tails developers]
699
  * Security fixes
700
    - Upgrade to Iceweasel 24.2.0esr that fixes a few serious security issues.
701
702
703
    - Stop migrating persistence configuration and access rights. Instead,
      disable all persistence configuration files if the mountpoint has wrong
      access rights (Closes: #6413).
704
705
    - Upgrade to NSS 3.15.3 that fixes a few serious security issues affecting
      the browser, such as CVE-2013-1741, CVE-2013-5605 and CVE-2013-5606.
706
707

  * Major improvements
708
709
710
    - Switch to Iceweasel 24 (Closes: #6370).
      · Resync' (most) Iceweasel prefs with TBB 3.0-beta-1 and get rid
        of many obsolete or default settings.
Tails developers's avatar
Tails developers committed
711
712
713
714
      · Disable WebRTC (Closes: #6468).
      · Import TorBrowser profile at commit
        51bf06502c46ee6c1f587459e8370aef11a3422d from the tor-browser-24.2.0esr-1
        branch at https://git.torproject.org/tor-browser.git.
715
    - Switch to Torbutton 1.6.5 (Closes: #6371).
716
717
718
719
720
721
722
723
724
725
726
      · Prevent Torbutton from asking users to "upgrade TBB".
      · Use the same Tor SOCKS port as the TBB (9151) for our web browser.
        This should be enough to avoid being affected by Tor#8511.
      · Disable Torbutton 1.6's check for Tor.
        Unfortunately, the new check.torproject.org breaks the remote Tor
        check. We cannot use the local Tor check with the control port. So,
        the shortest and sanest path to fixing the check issue, because the
        remote Tor check is broken" seems to simply disable this check.
        Patch submitted upstream as Tor#10216.
    - Prepare incremental upgrades to be the next default way to upgrade Tails,
      on point-releases at least.
727
728

  * Bugfixes
729
    - Deny X authentication only after Vidalia exits (Closes: #6389).
730
    - Disable DPMS screen blanking (Closes: #5617).
731
732
733
734
    - Fix checking of the persistent volume's ACL.
    - Sanitize more IP and MAC addresses in bug reports (Closes: #6391).
    - Do not fail USB upgrade when the "tmp" directory exists on the
      destination device.
Tails developers's avatar
Tails developers committed
735
736
    - Tails Installer: list devices with isohybrid Tails installed
      (Closes: #6462).
737
738

  * Minor improvements
739
740
741
742
743
744
745
746
747
748
    - Create a configuration file for additional software if needed
      (Closes: #6436).
    - Translations all over the place.
    - Enable favicons in Iceweasel.
    - Do not propose to make permanent NoScript exceptions.
      In Tails, every such thing is temporary, so better only display the menu
      entry that's about temporarily allowing something.
    - Clearer warning when deleting persistent volume (thanks to Andres Gomez
      Ramirez <andres.gomez@cern.ch> for the patch).
    - Make wording in Tails Installer more consistent.
749
750

  [ WinterFairy ]
751
  * Use IBus instead of SCIM (Closes: #5624, #6206).
752
753
    It makes it possible to input passwords in pinentry for at least Japanese,
    Chinese and Korean languages.
754
  * Add an import-translation script.
755
756
757
758
759
    This automates the importation process of completed translations
    from Transifex.
  * Always list optimal keyboard layout in the greeter (Closes: #5741).
  * Fix on-the-fly translation of the greeter in various languages
    (Closes: #5469).
760
761

  [ Kytv]
762
763
764
765
  * Update I2P to 0.9.8.1 (Closes: #6080, #5889).
  * Improve I2P configuration:
    - Disable IPv6 support in a nicer way.
    - Disable i2cp (allows java clients to communicate from outside the JVM). If
766
      this is unset an exception for port 7654 would need to be added to ferm.
767
768
769
770
771
772
773
774
    - Disable "in-network" updates (this is also done in the regular I2P
      packages).
    - Disable the outproxies. Access to the Internet is already routed through
      Tor so these are unnecessary. If end-users have a good reason to go
      through one of the I2P outproxies they can turn them back on.
  * Add a couple of default I2P IRC channels to Pidgin.
  * Allow access to the local 'eepsite' through FoxyProxy.
  * Add firewall exceptions for the standard I2P ports.
775

776
 -- Tails developers <tails@boum.org>  Sat, 30 Nov 2013 16:47:18 +0100
777

Tails developers's avatar
Tails developers committed
778
tails (0.21) unstable; urgency=low
779

780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
  * Security fixes
    - Don't grant access to the Tor control port for the desktop user
      (amnesia). Else, an attacker able to run arbitrary code as this user
      could obtain the public IP with a get_info command.
      · Vidalia is now run as a dedicated user.
      · Remove the amnesia user from the debian-tor group.
      · Remove the Vidalia launcher in the Applications menu.
        The Vidalia instance it starts is useless, since it can't connect
        to the Tor control port.
    - Don't allow the desktop user to directly change persistence settings.
      Else, an attacker able to run arbitrary code as this user could
      leverage this feature to gain persistent root access, as long as
      persistence is enabled.
      · Fully rework the persistent filesystem and files ownership
        and permissions.
      · Run the Persistent Volume Assistant as a dedicated user, that is
        granted the relevant udisks and filesystem -level credentials.
      · At persistence activation time, don't trust existing persistence
        configuration files, migrate to the new ownership and permissions,
        migrate every known-safe existing settings and backup what's left.
        Warn the user when not all persistence settings could be migrated.
      · Persistent Volume Assistant uses the new ownership and permissions
        scheme when initializing a new persistent volume, and refuses to
        read persistence.conf if it, or the parent directory, hasn't the
        expected permissions.
      · Make boot medium 'system internal' for udisks with bilibop.
        Once Tails is based on Wheezy, this will further complete the
        protection (see #6172 for details).
Tails developers's avatar
Tails developers committed
808
809
810
    - Update Iceweasel to 17.0.10esr-0+tails2~bpo60+1.
    - Update Torbutton to 1.5.2-2, including a patch cherry-picked from
      upstream to make window resizing closer to what the design says.
811

812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
  * Major new features
    - Add a persistence preset for printing settings (Closes: #5686).
      Reload CUPS configuration after persistence activation.
    - Support SD card connected through a SDIO host adapter (Closes: #6324).
      · Rebrand Tails USB installer to Tails installer.
      · Display devices brand, model and size in the Installer
        (Closes: #6292).
      · Ask for confirmation before installing Tails onto a device
        (Closes: #6293).
      · Add support for SDIO and MMC block devices to the Tails Installer
        (Closes: #5744) and the Persistent Volume Assistant (Closes: #6325).
      · Arm the udev watchdog when booted from SD (plugged in SDIO) too
        (Closes: #6327).

  * Minor improvements
Tails developers's avatar
Tails developers committed
827
828
    - Provide a consistent path to the persistent volume mountpoint
      (Closes: #5854).
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
    - Add a KeePassX launcher to the top GNOME panel (Closes: #6290).
    - Rework bug reporting workflow: point the desktop launcher to
      the troubleshooting page.
    - Make /home world-readable at build time, regardless of the Git
      working copy permissions. This makes the build process more robust
      against strict umasks.
    - Add signing capabilities to the tails-build script (Closes: #6267).
      This is in turn used to sign ISO images built by our Jenkins setup
      (Closes: #6193).
    - Simplify the ikiwiki setup and make more pages translatable.
    - Exclude the version string in GnuPG's ASCII armored output.
    - Prefer stronger ciphers (AES256,AES192,AES,CAST5) when encrypting
      data with GnuPG.
    - Use the same custom Startpage search URL than the TBB.
      This apparently disables the new broken "family" filter.
    - Update AdBlock Plus patterns.
Tails developers's avatar
Tails developers committed
845
846
    - Install Linux from Debian testing.
      (That is, the same version that was shipped in 0.20.1.)
847
848
849
850
851
852
853
854
855

  * Test suite
    - Look for "/tmp/.X11-unix/X${1#:}" too when detecting displays in use.
    - Adapt tests to match the Control Port access security fix:
      · Take into account that the amnesia user isn't part of the debian-tor
        group anymore.
      · Run as root the checks to see if a process is running: this
        is required to see other users' processes.

Tails developers's avatar
Tails developers committed
856
 -- Tails developers <tails@boum.org>  Sat, 26 Oct 2013 23:42:46 +0200
857

858
tails (0.20.1) unstable; urgency=low
859
860

  * Major new features
861
  - Install Tor 0.2.4.17-rc-1~d60.squeeze+1 from the Tor project's repository.
862
  - Install Iceweasel 17.0.9esr with Torbrowser patches.
863
  - Install Linux kernel 3.10-3 (version 3.10.11-1) from sid.
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882

  * Bugfixes
  - Remount persistence devices read-only at shutdown/reboot time
    (Closes: #6228).
  - Greeter: display a warning icon on admin password mismatch and on
    persistence unlocking failure. Thanks to Andres Gomez Ramirez
    <andres.gomez@cern.ch> for the fix!
  - Don't torsocksify Pidgin.
    Instead we disable Pidgin's GNOME integration to get the "Global proxy
    configuration", which we set to use Tor. This fixes the I2P IRC account.
  - Additional software: fix typo in notification.
  - Allow installing "Priority: standard" packages that we do not install
    by default: remove them late in the build process instead of assigning
    them a -1 APT pinning level.

  * Minor improvements
  - Update AdBlock Plus patterns.
  - Use more unique ISO file name when building from Jenkins.
  - Additional software: point to the system log on upgrade failure.
Tails developers's avatar
Tails developers committed
883
884
885
886
887
888
889
890
891
892
893
  - Set SOCKS5_USER and SOCKS5_PASSWORD in the connect-socks wrapper (used
    by Git). Else, Tor 0.2.4's IsolateSOCKSAuth and connect-proxy
    sometimes play together in some way that makes connect-proxy ask for
    a password to connect to the SocksPort. SOCKS5_USER and
    SOCKS5_PASSWORD are passed through unchanged if they were manually set
    by the user already.
  - Use our custom connect-socks wrapper for SSH. Else, Tor 0.2.4's
    IsolateSOCKSAuth and connect-proxy sometimes play together in some way
    that makes connect-proxy ask for a password to connect to the
    SocksPort. Note that connect-socks uses the default SocksPort too, so
    no change here wrt. our connection isolation design.
894
895
896
897
898
899
900
901
902

  * Localization
  - Import new translations from Transifex.

  * Test suite
  - Fix old ISO checking for consistent error reporting.
  - Remove custom persistence test from manual test suite.
    It was removed for the GUI in t-p-s 0.33.

903
 -- Tails developers <tails@boum.org>  Sun, 15 Sep 2013 15:49:36 +0200
904

905
tails (0.20) unstable; urgency=low
906

Tails developers's avatar
Tails developers committed
907
908
  * Major new features
  - Install Linux kernel 3.10.3-1 from Debian unstable.
909
  - Iceweasel 17.0.8esr + Torbrowser patches.
Tails developers's avatar
Tails developers committed
910
911
912
913

  * Bugfixes
  - Prevent Iceweasel from displaying a warning when leaving HTTPS web sites.
  - Make Iceweasel use the correct, localized search engine.
Tails developers's avatar
Tails developers committed
914
  - Fix Git access to https:// repositories.
Tails developers's avatar
Tails developers committed
915
916
917
918
919
920
921
922
923
924
925

  * Minor improvements
  - Install Dasher, a predictive text entry tool.
  - Add a wrapper around TrueCrypt which displays a warning about it soon
    being deprecated in Tails.
  - Remove Pidgin libraries for all protocols but IRC and Jabber/XMPP.
    Many of the other protocols Pidgin support are broken in Tails and
    haven't got any security auditting.
  - Disable the pre-defined Pidgin accounts so they do not auto-connect
    on Pidgin start.
  - Include information about Alsa in WhisperBack reports.
926
927
928
  - Explicitly restrict access to ptrace. While this setting was enabled
    by default in Debian's Linux 3.9.6-1, it will later disabled in 3.9.7-1.
    It's unclear what will happen next, so let's explicitly enable it ourselves.
Tails developers's avatar
Tails developers committed
929
  - Do not display dialog when a message is sent in Claws Mail.
930
  - Sync iceweasel preferences with the Torbrowser's.
Tails developers's avatar
Tails developers committed
931
932
933

  * Localization
  - Many translation updates all over the place.
934
  - Merge all Tails-related POT files into one, and make use of intltoolize
Tails developers's avatar
Tails developers committed
935
    for better integration with Transifex.
936

Tails developers's avatar
Tails developers committed
937
 -- Tails developers <tails@boum.org>  Tue, 30 Jul 2013 14:19:57 +0200
938

Tails developers's avatar
Tails developers committed
939
tails (0.19) unstable; urgency=low
940

941
942
943
944
945
  * Major new features
  - Install Linux kernel 3.9.5-1 from Debian unstable.
    Features of particular interest for Tails are the Yama LSM
    (ptrace scope restrictions) and improved hardware support.
    As a corollary, install initramfs-tools from there too.
Tails developers's avatar
Tails developers committed
946
  - Iceweasel 17.0.7esr + Torbrowser patches.
947
948
949
  - Unblock Bluetooth, Wi-Fi, WWAN and WiMAX; block every other type of
    wireless device. Next steps are described on the
    todo/protect_against_external_bus_memory_forensics ticket.
950

951
952
953
954
955
956
957
958
959
  * Bugfixes
  - Fix write access to boot medium at the block device level,
    by installing bilibop-udev. Thanks to quidame for his support.
  - tails-greeter l10n-related fixes, thanks to winterfairy:
    · Fix so translations is applied on password mismatch messages.
    · Separate forward and login buttons and make them translatable.
  - Fix link to documentation when no sudo password is set.
  - gpgApplet: partial fix for clipboard emptying after a wrong passphrase
    was entered.
Tails developers's avatar
Tails developers committed
960
  - Workaround aufs bug in Unsafe Browser script.
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980

  * Minor improvements
  - Drop GNOME proxy settings: we did not find any use of it we were keen
    to support, other than two programs (Seahorse, Pidgin) that are now run
    with torsocks.
  - Format newly created persistent volumes as ext4.
  - GnuPG: don't connect to the keyserver specified by the key owner.
    This feature opens the door to a variety of subtle attacks.
  - GnuPG: locate keys only from local keyrings.
    This is probably the default, but better safe than sorry.
  - Install virt-what from Wheezy.
    The version from Squeeze does not detect at least Parallels for Mac v.8.
  - Upgrade live-boot and live-config to the 3.0.x final version from Wheezy.
    · Remove /live and /lib/live/image compatibility symlinks.
    · Add /live/overlay -> /lib/live/mount/overlay symlink.
      The live-boot changes (commit d2b2a461) brought to fix Debian bug
      #696495 revert some of our previous changes (commit 77dab1cb), and as
      a result, at the time live-persist runs, no tmpfs is mounted on
      /live/overlay, which breaks the aufs mount. So, let's just ensure
      /live/overlay points to a tmpfs.
Tails developers's avatar
Tails developers committed
981
982
983
    · Really disable policykit and sudo live-config hooks.
      ... by making it believe they've already been run.
      This workarounds new live-config's default behavior.
984
985
986
987
988
989
990

  * Localization
  - Many translation updates all over the place.

  * Test suite
  - Re-enable previously disabled boot device permissions test.

Tails developers's avatar
Tails developers committed
991
 -- Tails developers <tails@boum.org>  Wed, 26 Jun 2013 12:36:20 +0200
992

Tails developers's avatar
Tails developers committed
993
tails (0.18) unstable; urgency=low
994

995
996
997
998
999
  * New features
  - Support obfs3 bridges.
  - Automatically install a custom list of additional packages chosen by
    the user at the beginning of every working session, and upgrade them
    once a network connection is established (technology preview).
1000