Merge remote-tracking branch 'origin/master' into doc/6944-document-why-xyz-not-in-Debian

.gitignore

@@ -50,6 +50,8 @@
 /config/chroot_local-includes/usr/share/applications/org.boum.tails.additional-software-config.desktop
 /config/chroot_local-includes/usr/share/applications/root-terminal.desktop
 /config/chroot_local-includes/usr/share/applications/tails-documentation.desktop
+/config/chroot_local-includes/usr/share/applications/tails-persistence-delete.desktop
+/config/chroot_local-includes/usr/share/applications/tails-persistence-setup.desktop
 /config/chroot_local-includes/usr/share/applications/tails-reboot.desktop
 /config/chroot_local-includes/usr/share/applications/unsafe-browser.desktop
 /config/chroot_local-includes/usr/share/applications/tails-shutdown.desktop
@@ -66,3 +68,6 @@
 # The test suite's local configuration files
 /features/config/local.yml
 /features/config/*.d/
+
+# workarounds
+/config/chroot_local-includes/tmp/tails-workarounds

.gitmodules

 [submodule "submodules/jenkins-tools"]
 	path = submodules/jenkins-tools
-	url = https://git-tails.immerda.ch/jenkins-tools
+	url = https://gitlab.tails.boum.org/tails/jenkins-tools.git
 [submodule "submodules/chutney"]
 	path = submodules/chutney
-	url = https://git-tails.immerda.ch/chutney
+	url = https://gitlab.tails.boum.org/tails/chutney.git
 	branch = feature/tails_test_suite
 [submodule "submodules/mirror-pool-dispatcher"]
 	path = submodules/mirror-pool-dispatcher
-	url = https://git-tails.immerda.ch/mirror-pool-dispatcher
-[submodule "submodules/aufs-standalone"]
-	path = submodules/aufs-standalone
-	url = https://github.com/sfjro/aufs5-standalone.git
+	url = https://gitlab.tails.boum.org/tails/mirror-pool-dispatcher.git
+[submodule "submodules/tails-workarounds"]
+	path = submodules/tails-workarounds
+	url = https://gitlab.tails.boum.org/tails/workarounds.git

README

-doc/README
\ No newline at end of file

README.md

+## About Tails
+
+[**Tails**](https://tails.boum.org/) is a portable operating system that protects your privacy and helps you avoid censorship.
+
+[![Drawing of a Tails stick that is marked to be pluged into a labtop](https://tails.boum.org/index/laptop.svg)](https://tails.boum.org/)
+- Tails uses the Tor network to protect your privacy online and help you avoid censorship. Enjoy the Internet like it should be.
+- Shut down the computer and start on your Tails USB stick instead of starting on Windows, macOS, or Linux. Tails leaves no trace on the computer when shut down.
+- Tails includes a selection of applications to work on sensitive documents and communicate securely. Everything in Tails is ready-to-use and has safe defaults.
+- You can download Tails for free and independent security researchers can verify our work. Tails is based on Debian GNU/Linux.
+
+[Learn learn how Tails works](https://tails.boum.org/about)
+
+
+### How to contribute to Tails
+
+There are many ways [you can contribute to Tails](https://tails.boum.org/contribute/). No effort is too small and whatever you bring to this community will be appreciated.
+
+Find out how you can make a difference in Tails: https://tails.boum.org/contribute/.
+
+### How to get started with Gitlab
+
+https://tails.boum.org/contribute/working_together/GitLab/
+
+### How to transition to GitLab
+
+https://tails.boum.org/contribute/working_together/GitLab/transition/
+
+###  License and source code distribution
+**Tails** is [Free Software](https://www.gnu.org/philosophy/free-sw.html): you can download, use, and share it with no restrictions.
+
+ <a href="https://tails.boum.org/doc/about/license/"><img alt="Tails is Free Software" src="https://tails.boum.org/index/gift.svg" width="560"/>
+
+The Tails source code is released under the GNU/GPL (version 3 or above) and is Copyright (C) Tails developers tails@boum.org.
+Any exception to this rule is documented either [here](https://tails.boum.org/doc/about/license/) or in the affected source file.
+However, Tails includes non-free firmware in order to work on as much hardware as possible.
+
+
+### Contact
+
+email and mailing lists: https://tails.boum.org/about/contact
+
+XMPP: tails@conference.riseup.net and tails-dev@conference.riseup.net
+
+[![Tails](https://tails.boum.org/contribute/how/promote/material/logo/tails-logo-flat.svg)](https://tails.boum.org)

Rakefile

@@ -204,6 +204,8 @@ def system_cpus
   end
 end
 
+ENV['TAILS_WEBSITE_CACHE'] = is_release? ? '0' : '1'
+
 task :parse_build_options do
   options = []
 
@@ -247,12 +249,21 @@ task :parse_build_options do
       ENV['TAILS_PROXY_TYPE'] = 'noproxy'
     when 'offline'
       ENV['TAILS_OFFLINE_MODE'] = '1'
-    when 'cachewebsite'
+    when /cachewebsite(?:=([a-z]+))?/
+      value = $1
       if is_release?
         $stderr.puts "Building a release ⇒ ignoring #{opt} build option"
         ENV['TAILS_WEBSITE_CACHE'] = '0'
       else
-        ENV['TAILS_WEBSITE_CACHE'] = '1'
+        value = 'yes' if value.nil?
+        case value
+        when 'yes'
+          ENV['TAILS_WEBSITE_CACHE'] = '1'
+        when 'no'
+          ENV['TAILS_WEBSITE_CACHE'] = '0'
+        else
+          raise "Unsupported value for cachewebsite option: #{value}"
+        end
       end
     # SquashFS compression settings
     when 'fastcomp', 'gzipcomp'
@@ -420,7 +431,7 @@ task :ensure_correct_permissions do
       on every parent directory of #{ENV['PWD']} up to #{ENV['HOME']}
       (inclusive):
 
-        chmod g+x DIR && setfacl -m user:libvirt-qemu:x DIR
+        chmod g+rx DIR && setfacl -m user:libvirt-qemu:rx DIR
 
     END_OF_MESSAGE
   end

auto/build

@@ -146,6 +146,14 @@ BUILD_USB_IMAGE_FILENAME="${BUILD_BASENAME}.img"
    cat config/chroot_sources/*.chroot
 ) > "$BUILD_APT_SOURCES"
 
+# make workarounds available in the chroot, if any:
+WORKAROUNDS_SRC="submodules/tails-workarounds"
+WORKAROUNDS_DST="config/chroot_local-includes/tmp/"
+if [ -d "$WORKAROUNDS_SRC" ]; then
+  mkdir -p "$WORKAROUNDS_DST"
+  cp -a "$WORKAROUNDS_SRC" "$WORKAROUNDS_DST"
+fi
+
 echo "I: Building ISO image ${BUILD_ISO_FILENAME}..."
 time lb build noauto ${@}
 [ -e binary.iso ] || fatal "lb build failed ($?)."

auto/clean

@@ -38,3 +38,6 @@ rm -f config/chroot_local-includes/usr/share/tails/build/variables
 # static wiki
 rm -rf config/chroot_local-includes/usr/share/doc/tails/website wiki/src/.ikiwiki
 find wiki/src -name *.pot -exec rm {} \;
+
+# workarounds
+rm -rf config/chroot_local-includes/tmp/tails-workarounds

auto/config

@@ -183,6 +183,8 @@ TAILS_PRODUCT_NAME="Tails"
 TAILS_VERSION_ID="$AMNESIA_VERSION"
 TAILS_DISTRIBUTION="$TAILS_DISTRIBUTION"
 EOF
+# If you update the following regexp, also update it in
+# config/chroot_local-includes/usr/src/iuk/lib/Tails/IUK/UpgradeDescriptionFile/Generate.pm
 if echo "$AMNESIA_VERSION" | grep -qs -E '~(alpha|beta|rc)[0-9]*$' ; then
     echo 'TAILS_CHANNEL="alpha"' >> config/chroot_local-includes/etc/os-release
 fi
@@ -203,10 +205,6 @@ install -m 0755 \
    submodules/mirror-pool-dispatcher/lib/js/mirror-dispatcher.js \
    config/chroot_local-includes/usr/local/lib/nodejs/
 
-# aufs-standalone
-rm -rf config/chroot_local-includes/usr/src/aufs-standalone
-cp -a submodules/aufs-standalone config/chroot_local-includes/usr/src/
-
 # save the original file, shipped by the debootstrap package,
 # so we can always apply our debian-common.patch to the original
 # version

auto/scripts/website-cache

@@ -22,6 +22,9 @@ KEY_FILES = [
     # A new implementation of the caching mechanism should
     # invalidate older cached data
     'auto/scripts/website-cache',
+    # The website includes dates derived from the last entry
+    # found in debian/changelog
+    'debian/changelog',
     # ikiwiki configuration
     'ikiwiki.setup',
     # ikiwiki input directory

bin/copy-iuks-to-rsync-server-and-verify

@@ -8,7 +8,7 @@ import sys
 from typing import List
 from pathlib import Path
 
-JENKINS_IUKS_BASE_URL = "https://nightly.tails.boum.org/build_IUKs/builds"
+JENKINS_IUKS_BASE_URL = "https://nightly.tails.boum.org/parallel_collect_IUKs/builds"
 RSYNC_SERVER_HOSTNAME = "rsync.lizard"
 LOG_FORMAT = "%(asctime)-15s %(levelname)s %(message)s"
 log = logging.getLogger()
@@ -92,6 +92,41 @@ def download_iuks_from_jenkins(
         destdir: str,
         jenkins_iuks_base_url: str,
         jenkins_build_id: int) -> None:
+
+    # This assumes same basename for hashes, locally and in Jenkins:
+    log.info("Downloading IUK hashes (if available) from Jenkins to %s…" % (desthost))
+    try:
+        url = "%s/%s/archive/%s" % (
+            jenkins_iuks_base_url,
+            jenkins_build_id,
+            Path(hashes_file).name
+        )
+        jenkins_hashes = '%(d)s/%(f)s' % {
+            "d": destdir,
+            "f": '%s.jenkins' % Path(hashes_file).name
+        }
+        our_hashes = '%(d)s/%(f)s' % {
+            "d": destdir,
+            "f": Path(hashes_file).name,
+        }
+        subprocess.run(
+            ["ssh", desthost, "wget", "--quiet", "--no-clobber",
+             "-O", jenkins_hashes, url],
+            check=True
+        )
+        subprocess.run(
+            ["ssh", desthost,
+             "sh -c \"if ! cmp -s '%(j_h)s' '%(o_h)s'; then "
+             "echo 'WARNING: IUK hashes seem different'; else "
+             "echo 'OK: IUK hashes seem similar'; fi\"" % {
+                 "j_h": jenkins_hashes,
+                 "o_h": our_hashes,
+             }],
+            check=True
+        )
+    except subprocess.CalledProcessError:
+        log.error("Unable to download/validate IUK hashes from Jenkins")
+
     log.info("Downloading IUKs from Jenkins to %s…" % (desthost))
     iuks = iuks_listed_in(hashes_file)
     log.debug("IUKS: %s" % ', '.join(iuks))

bin/create-test-iuks

@@ -4,7 +4,7 @@ set -e
 set -u
 set -x
 
-VERSIONS="2.0~test 2.2~test 2.3~test"
+VERSIONS="2.0~testoverlayfs 2.2~testoverlayfs 2.3~testoverlayfs"
 export SOURCE_DATE_EPOCH=$(date --utc '+%s')
 
 [ -d "$TAILS_CHECKOUT" ] || exit 2
@@ -21,11 +21,16 @@ for version in $VERSIONS; do
    mkdir -p "$SQUASHFS_SRC"/etc/amnesia "$SQUASHFS_SRC"/usr/share
 
    cp -a /usr/share/common-licenses "$SQUASHFS_SRC"/usr/share/
-   if [ "$version" != '2.0~test' ]; then
+   mkdir -p "$SQUASHFS_SRC"/usr/share/doc
+   if [ "$version" = '2.0~testoverlayfs' ]; then
+      mkdir -p "$SQUASHFS_SRC"/usr/share/doc/tor
+      echo "Some content" > "$SQUASHFS_SRC"/usr/share/doc/tor/README.Debian
+   fi
+   if [ "$version" != '2.0~testoverlayfs' ]; then
       echo "Some content" > "$SQUASHFS_SRC"/some_new_file
       rm "$SQUASHFS_SRC"/usr/share/common-licenses/BSD
    fi
-   if [ "$version" = '2.3~test' ]; then
+   if [ "$version" = '2.3~testoverlayfs' ]; then
       echo "Some content 2.3" > "$SQUASHFS_SRC"/some_new_file_2.3
       rm "$SQUASHFS_SRC"/usr/share/common-licenses/MPL-1.1
    fi
@@ -43,17 +48,18 @@ EOF
    mksquashfs \
       "$SQUASHFS_SRC" \
       "$ISO_SRC"/live/filesystem.squashfs \
-      -no-progress -noappend -comp xz -Xbcj x86 -b 1024K -Xdict-size 1024K
+      -no-progress -noappend -comp xz -Xbcj x86 -b 1024K -Xdict-size 1024K \
+      -all-root
 
    echo vmlinuz > "$ISO_SRC"/live/vmlinuz
    echo initrd > "$ISO_SRC"/live/initrd.img
    echo isolinux > "$ISO_SRC"/isolinux/isolinux.cfg
    echo 'filesystem.squashfs' > "$ISO_SRC"/live/Tails.module
    cp /usr/lib/syslinux/mbr/gptmbr.bin "$ISO_SRC"/utils/mbr/mbr.bin
-   if [ "$version" = '2.0~test' ]; then
+   if [ "$version" = '2.0~testoverlayfs' ]; then
       cp /usr/bin/syslinux "$ISO_SRC"/utils/linux
    fi
-   if [ "$version" = '2.3~test' ]; then
+   if [ "$version" = '2.3~testoverlayfs' ]; then
       rm "$ISO_SRC"/utils/mbr/mbr.bin
    fi
    xorriso \
@@ -62,8 +68,8 @@ EOF
       -o "$WORKDIR/$version.iso" "$ISO_SRC"
 done
 
-for dest_version in 2.2~test 2.3~test; do
-   echo "Generating IUK file from 2.0~test to $dest_version"
+for dest_version in 2.2~testoverlayfs 2.3~testoverlayfs; do
+   echo "Generating IUK file from 2.0~testoverlayfs to $dest_version"
    sudo su -c \
          "SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH \
           LC_ALL=C \
@@ -71,9 +77,9 @@ for dest_version in 2.2~test 2.3~test; do
           PERL5LIB=\"${TAILS_CHECKOUT:?}/config/chroot_local-includes/usr/src/perl5lib/lib\" \
           ${TAILS_CHECKOUT:?}/config/chroot_local-includes/usr/src/iuk/bin/tails-create-iuk \
                --squashfs_diff_name \"${dest_version}.squashfs\"           \
-               --old_iso \"$WORKDIR/2.0~test.iso\" \
+               --old_iso \"$WORKDIR/2.0~testoverlayfs.iso\" \
                --new_iso \"$WORKDIR/${dest_version}.iso\" \
-               --outfile \"$WORKDIR/Tails_amd64_2.0~test_to_${dest_version}.iuk\""
+               --outfile \"$WORKDIR/Tails_amd64_2.0~testoverlayfs_to_${dest_version}.iuk\""
 done
 
 echo "Generated test IUKS:"

bin/iuk-source-versions

@@ -36,7 +36,7 @@ RELEASING_MAJOR_VERSION=$(major_version "$RELEASING_VERSION")
       major_version=$(major_version "$version")
       if [ "$major_version" = "$RELEASING_MAJOR_VERSION" ] && \
             dpkg --compare-versions "$version" lt "$RELEASING_VERSION" ; then
-	 echo -n "$version "
+	 echo "$version"
       fi
    done
-) | perl -p -E 's{\s*\z}{}'
+) | sort --version-sort | xargs | tr -d '\n'

config/APT_snapshots.d/debian/serial

-2020020902
+2020032503

config/APT_snapshots.d/torproject/serial

-2020020402
+2020032503

config/amnesia

@@ -17,13 +17,13 @@ export SOURCE_DATE_FAKETIME="$(date --utc --date="$(dpkg-parsechangelog --show-f
 # Base for the string that will be passed to "lb config --bootappend-live"
 # FIXME: see [[bugs/sdmem_on_eject_broken_for_CD]] for explanation why we
 # need to set block.events_dfl_poll_msecs
-AMNESIA_APPEND="live-media=removable nopersistence noprompt timezone=Etc/UTC block.events_dfl_poll_msecs=1000 splash noautologin module=Tails slab_nomerge slub_debug=FZP mce=0 vsyscall=none page_poison=1 init_on_alloc=1 init_on_free=1 mds=full,nosmt union=aufs"
+AMNESIA_APPEND="live-media=removable nopersistence noprompt timezone=Etc/UTC block.events_dfl_poll_msecs=1000 splash noautologin module=Tails slab_nomerge slub_debug=FZP mce=0 vsyscall=none page_poison=1 init_on_alloc=1 init_on_free=1 mds=full,nosmt"
 
 # Options passed to isohybrid
 AMNESIA_ISOHYBRID_OPTS="-h 255 -s 63 --id 42 --verbose"
 
 # Kernel version
-KERNEL_VERSION='5.4.0-3'
+KERNEL_VERSION='5.4.0-4'
 KERNEL_SOURCE_VERSION=$(
    echo "$KERNEL_VERSION" \
        | perl -p -E 's{\A (\d+ [.] \d+) [.] .*}{$1}xms'

config/binary_local-hooks/10-syslinux_customize

@@ -37,7 +37,7 @@ perl -pni -E 'exit if m{^label[[:blank:]]+help$}' "${CFG_FILE}"
 
 Echo_message "customize syslinux menu"
 
-sed -i -e "s/Boot menu//" "${CFG_FILE}"
+sed -i -e "s/Boot menu/SYSLINUX/" "${CFG_FILE}"
 sed -i -e "s/menu label Live/menu label Tails/" "${SYSLINUX_PATH}"/live*.cfg
 sed -i -r -e 's/(menu label .* )\(failsafe\)/\1(Troubleshooting Mode)/' \
     "${SYSLINUX_PATH}"/live*.cfg

config/binary_local-hooks/50-grub-efi-ia32 → config/binary_local-hooks/50-grub-efi

@@ -23,9 +23,44 @@
 set -e
 set -x
 
-platform="i386-efi"
-outdir="binary/EFI/BOOT/grub/$platform"
-efi_name="IA32"
+# Including common functions
+. "${LB_BASE:-/usr/share/live/build}"/scripts/build.sh
+
+# Setting static variables
+DESCRIPTION="$(Echo 'including GRUB EFI in the ISO filesystem')"
+HELP=""
+USAGE="${PROGRAM}"
+
+# Reading configuration files
+Read_conffiles config/all config/bootstrap config/common config/binary
+# Import AMNESIA_APPEND
+Read_conffiles config/amnesia
+Set_defaults
+
+# Safeguards
+[ "${LB_ARCHITECTURE}" = "amd64" ] || exit 0
+
+# Seems like we'll have work to do
+Echo_message 'including GRUB EFI in the ISO filesystem'
+
+grub_dir="binary/EFI/debian/grub"
+platforms="x86_64-efi i386-efi"
+
+efi_name () {
+   local platform="$1"
+   case "$platform" in
+      i386-efi)
+	 echo IA32
+	 ;;
+      x86_64-efi)
+	 echo X64
+	 ;;
+      *)
+	 echo "E: invalid GRUB platform: $platform" >&2
+	 exit 1
+	 ;;
+   esac
+}
 
 grub_cpmodules () {
 	if [ -z "$1" ] || [ -z "$2" ]; then
@@ -33,8 +68,8 @@ grub_cpmodules () {
 		return 1
 	fi
 
-	outdir="$1"
-	platform="$2"
+	local outdir="$1"
+	local platform="$2"
 
 	# Copy over GRUB modules, except for those already built in.
 	cp -a "chroot/usr/lib/grub/$platform"/*.lst "$outdir/"
@@ -58,30 +93,44 @@ grub_cpmodules () {
 	done
 }
 
-# Including common functions
-. "${LB_BASE:-/usr/share/live/build}"/scripts/build.sh
+for platform in $platforms ; do
+   echo "I: installing GRUB EFI for $platform"
+   efi_fallback_dir="binary/EFI/BOOT"
+   grub_module_dir="$grub_dir/$platform"
+   efi_name="$(efi_name "$platform")"
 
-# Setting static variables
-DESCRIPTION="$(Echo 'including GRUB EFI for ia32 in the ISO filesystem')"
-HELP=""
-USAGE="${PROGRAM}"
+   mkdir -p "$efi_fallback_dir"
+   signed_grub_src="chroot/usr/lib/grub/$platform-signed/grub$(echo "$efi_name" | tr '[:upper:]' '[:lower:]').efi.signed"
+   signed_shim_src="chroot/usr/lib/shim/shim$(echo "$efi_name" | tr '[:upper:]' '[:lower:]').efi.signed"
+   if [ -f "$signed_grub_src" ] && [ -f "$signed_shim_src" ]; then
+      echo "I: copying Debian-signed GRUB and shim EFI binaries for $efi_name"
+      cp "$signed_grub_src" "${efi_fallback_dir}/GRUB${efi_name}.EFI"
+      cp "$signed_shim_src" "${efi_fallback_dir}/BOOT${efi_name}.EFI"
+   else
+      if [ "$platform" = 'x86_64-efi' ]; then
+         echo "E: no signed GRUB or shim for ${efi_name}, aborting" >&2
+         exit 1
+      fi
+      echo "I: no signed GRUB or shim for ${efi_name}, generating an unsigned GRUB image"
+      Chroot chroot grub-mkimage -O "$platform" \
+             -o "/tmp/BOOT$efi_name.EFI" -p "/efi/debian/grub" \
+	     search configfile normal tar fat part_gpt linux \
+	     gzio
+      mv "chroot/tmp/BOOT$efi_name.EFI" "${efi_fallback_dir}/BOOT${efi_name}.EFI"
+   fi
 
-# Reading configuration files
-Read_conffiles config/all config/bootstrap config/common config/binary
-Set_defaults
+   cp chroot/usr/share/tails/bootx64.png "${efi_fallback_dir}/BOOT${efi_name}.PNG"
 
-# Safeguards
-[ "${LB_ARCHITECTURE}" = "amd64" ] || exit 0
+   mkdir -p "$grub_module_dir"
+   grub_cpmodules "$grub_module_dir" "$platform"
+done
 
-# Seems like we'll have work to do
-Echo_message 'including GRUB EFI for ia32 in the ISO filesystem'
+# Copy unicode fonts
+cp "chroot/boot/grub/unicode.pf2" "${grub_dir}"
 
-# Build the core image
-Chroot chroot grub-mkimage -O "$platform" \
-	-o "/tmp/BOOT$efi_name.EFI" -p "/efi/boot/grub" \
-	search configfile normal tar fat part_gpt linux \
-	gzio
-mv "chroot/tmp/BOOT$efi_name.EFI" "binary/EFI/BOOT/BOOT$efi_name.EFI"
+# Append our custom kernel command-line parameters
+sed -i -E "s#AMNESIA_APPEND#${AMNESIA_APPEND}#g" "binary/EFI/debian/grub.cfg"
 
-mkdir -p "$outdir"
-grub_cpmodules "$outdir" "$platform"
+# Copy the configuration for 32-bit EFI, which looks there
+# due to -p "/efi/debian/grub"
+cp -a "binary/EFI/debian/grub.cfg" "binary/EFI/debian/grub/grub.cfg"

config/binary_local-hooks/99-syslinux_uefi

-#!/bin/bash
-
-set -e
-
-# Including common functions
-. "${LB_BASE:-/usr/share/live/build}"/scripts/build.sh
-
-# Setting static variables
-DESCRIPTION="$(Echo 'installing syslinux UEFI bootloader')"
-HELP=""
-USAGE="${PROGRAM}"
-
-# Reading configuration files
-Read_conffiles config/all config/bootstrap config/common config/binary
-Set_defaults
-
-# Safeguards
-[ "${LB_BOOTLOADER}"   = "syslinux" ] || exit 0
-[ "${LB_ARCHITECTURE}" = "amd64"    ] || exit 0
-
-# Seems like we'll have work to do
-Echo_message "installing syslinux UEFI bootloader"
-
-# Setting boot method specific variables
-case "${LB_BINARY_IMAGES}" in
-	iso|iso-hybrid)
-		SYSLINUX_PATH="binary/isolinux"
-		;;
-	usb-hdd)
-		SYSLINUX_PATH="binary/syslinux"
-		;;
-esac
-
-# Main
-mkdir -p binary/EFI/BOOT
-cp chroot/usr/lib/SYSLINUX.EFI/efi64/syslinux.efi binary/EFI/BOOT/BOOTX64.EFI
-cp chroot/usr/share/tails/bootx64.png binary/EFI/BOOT/BOOTX64.PNG
-cp "$SYSLINUX_PATH"/* binary/EFI/BOOT/
-mv binary/EFI/BOOT/isolinux.cfg binary/EFI/BOOT/syslinux.cfg
-cp -f chroot/usr/lib/syslinux/modules/efi64/* binary/EFI/BOOT/
-sed -r -i -e 's,^(menu background splash\.png)$,\#\1,' binary/EFI/BOOT/stdmenu.cfg

config/binary_local-includes/EFI/BOOT/grub/grub.cfg

-function load_video {
-  if [ x$feature_all_video_module = xy ]; then
-    insmod all_video
-  else
-    insmod efi_gop
-    insmod efi_uga
-    insmod ieee1275_fb
-    insmod vbe
-    insmod vga
-    insmod video_bochs
-    insmod video_cirrus
-  fi
-}
-
-set linux_gfx_mode=
-export linux_gfx_mode
-load_video
-
-insmod syslinuxcfg
-insmod cpuid
-echo "Loading syslinux configuration..."
-syslinux_configfile /efi/boot/syslinux.cfg

config/binary_local-includes/EFI/debian/grub.cfg

+# The Debian-signed GRUB binaries have the path of this very configuration file
+# (/EFI/debian/grub.cfg) hardcoded. Let's use it instead of adding layers
+# of indirection.
+
+function load_video {
+  if [ x$feature_all_video_module = xy ]; then
+    insmod all_video
+  else
+    insmod efi_gop
+    insmod efi_uga
+    insmod ieee1275_fb
+    insmod vbe
+    insmod vga
+    insmod video_bochs
+    insmod video_cirrus
+  fi
+}
+
+set linux_gfx_mode=
+export linux_gfx_mode
+load_video
+
+set grub_dir="/EFI/debian/grub"
+
+# Load background image
+insmod gfxterm
+insmod png
+loadfont ${grub_dir}/unicode.pf2
+terminal_output gfxterm
+background_image ${grub_dir}/splash.png
+
+set timeout=4
+
+probe --set rootuuid --fs-uuid ($root)
+
+# Based on the output of `grub-syslinux2cfg /EFI/BOOT/syslinux.cfg`
+menuentry 'Tails' --id 'live' {
+	  echo "Loading the Linux kernel..."
+	  linux /live/vmlinuz initrd=/live/initrd.img boot=live config AMNESIA_APPEND FSUUID=${rootuuid} quiet
+	  echo "Loading the initramfs..."
+	  initrd /live/initrd.img
+	  echo "Booting..."
+	  boot
+}
+
+menuentry 'Tails (Troubleshooting Mode)' --id 'livefailsafe' {
+	  echo "Loading the Linux kernel..."
+	  linux /live/vmlinuz initrd=/live/initrd.img boot=live config AMNESIA_APPEND FSUUID=${rootuuid} noapic noapm nodma nomce nolapic nomodeset nosmp vga=normal
+	  echo "Loading the initramfs..."
+	  initrd /live/initrd.img
+	  echo "Booting..."
+	  boot
+}