Merge remote-tracking branch 'origin/stable' into web/14679-3.5-release-notes

config/chroot_local-hooks/10-tbb

@@ -128,9 +128,7 @@ apply_extension_code_signing_hacks () {
     tmp="$(mktemp -d)"
     (
         cd "${tmp}"
-        7z x -tzip "${TBB_INSTALL}/omni.ja" \
-           modules/addons/XPIProvider.jsm \
-           chrome/toolkit/content/mozapps/extensions/extensions.js
+        7z x -tzip "${TBB_INSTALL}/omni.ja"
         patch -p1 <<EOF
 diff -Naur a/chrome/toolkit/content/mozapps/extensions/extensions.js b/chrome/toolkit/content/mozapps/extensions/extensions.js
 --- a/chrome/toolkit/content/mozapps/extensions/extensions.js 2000-01-01 00:00:00.000000000 +0000
@@ -157,20 +155,31 @@ diff -Naur a/modules/addons/XPIProvider.jsm b/modules/addons/XPIProvider.jsm
 +      aAddon.id == "uBlock0@raymondhill.net") {
      return true;
    }
+ 
+@@ -3465,6 +3466,7 @@
+             addon.id != "tor-launcher@torproject.org" &&
+             addon.id != "https-everywhere-eff@eff.org" &&
+             addon.id != "meek-http-helper@bamsoftware.com" &&
++            addon.id != "uBlock0@raymondhill.net" &&
+             addon.signedState <= AddonManager.SIGNEDSTATE_MISSING) {
+           logger.warn("Refusing to install staged add-on " + id + " with signed state " + addon.signedState);
+           seenFiles.push(stageDirEntry.leafName);
 EOF
         touch --date="@${tbb_timestamp}" modules/addons/XPIProvider.jsm \
               chrome/toolkit/content/mozapps/extensions/extensions.js
-        7z u -mtc=off -tzip "${TBB_INSTALL}/omni.ja" \
-           modules/addons/XPIProvider.jsm \
-           chrome/toolkit/content/mozapps/extensions/extensions.js
-
-        7z x -tzip "${TBB_INSTALL}/browser/omni.ja" \
-           components/nsBrowserGlue.js
+        rm "${TBB_INSTALL}/omni.ja"
+        7z a -mtc=off -tzip "${TBB_INSTALL}/omni.ja" *
+    )
+    rm -r "${tmp}"
+    tmp="$(mktemp -d)"
+    (
+        cd "${tmp}"
+        7z x -tzip "${TBB_INSTALL}/browser/omni.ja"
         patch -p1 <<EOF
 diff -Naur x/components/nsBrowserGlue.js y/components/nsBrowserGlue.js
 --- a/components/nsBrowserGlue.js 2000-01-01 00:00:00.000000000 +0000
 +++ b/components/nsBrowserGlue.js 2000-01-01 00:00:00.000000000 +0000
-@@ -1122,7 +1122,8 @@
+@@ -1137,7 +1137,8 @@
            if ((addon.signedState <= AddonManager.SIGNEDSTATE_MISSING) &&
                !(addon.id == "torbutton@torproject.org" ||
                  addon.id == "tor-launcher@torproject.org" ||
@@ -182,22 +191,14 @@ diff -Naur x/components/nsBrowserGlue.js y/components/nsBrowserGlue.js
            }
 EOF
         touch --date="@${tbb_timestamp}" components/nsBrowserGlue.js
-        7z u -mtc=off -tzip "${TBB_INSTALL}/browser/omni.ja" \
-           components/nsBrowserGlue.js
-        # These binaries are generated from the above modified files
-        # so we have to remove them. This will have a performance
-        # impact that probably is unnoticeable for humans, but TBB 7.5
-        # won't ship any of these binaries any way, so we'll converge.
-        7z d -mtc=off -tzip "${TBB_INSTALL}/omni.ja" \
-           jsloader/resource/gre/modules/addons/XPIProvider.jsm
-        7z d -mtc=off -tzip "${TBB_INSTALL}/browser/omni.ja" \
-           jsloader/resource/app/components/nsBrowserGlue.js
-        for archive in "${TBB_INSTALL}/omni.ja" "${TBB_INSTALL}/browser/omni.ja"; do
-            strip_nondeterminism_wrapper --type zip --timestamp "${tbb_timestamp}" \
-                                         "${archive}" 2>/dev/null
-        done
+        rm "${TBB_INSTALL}/browser/omni.ja"
+        7z a -mtc=off -tzip "${TBB_INSTALL}/browser/omni.ja" *
     )
     rm -r "${tmp}"
+    for archive in "${TBB_INSTALL}/omni.ja" "${TBB_INSTALL}/browser/omni.ja"; do
+        strip_nondeterminism_wrapper --type zip --timestamp "${tbb_timestamp}" \
+                                     "${archive}" 2>/dev/null
+    done
 }
 
 # Modern Firefox doesn't apply browser.search.defaultenginename on

config/chroot_local-includes/etc/tor-browser/profile/preferences/0000tails.js

@@ -61,6 +61,7 @@ pref("noscript.untrusted", "google-analytics.com");
 // Other non-Torbutton, Tails-specific prefs
 pref("browser.download.dir", "/home/amnesia/Tor Browser");
 pref("dom.input.fallbackUploadDir", "/home/amnesia/Tor Browser");
+pref("print.print_to_filename", "/home/amnesia/Tor Browser/output.pdf");
 pref("browser.download.folderList", 2);
 pref("browser.download.manager.closeWhenDone", true);
 pref("extensions.update.enabled", false);

config/chroot_local-includes/usr/local/lib/tails-shell-library/tor-browser.sh

@@ -34,6 +34,7 @@ exec_firefox_helper() {
 
     # From start-tor-browser:
     unset SESSION_MANAGER
+    export SELFRANDO_write_layout_file=
 
     exec "${TBB_INSTALL}"/"${binary}" "${@}"
 }

config/chroot_local-includes/usr/share/tails/tbb-dist-url.txt

-http://torbrowser-archive.tails.boum.org/7.0.10-build2/
+http://torbrowser-archive.tails.boum.org/7.5-build3/

config/chroot_local-includes/usr/share/tails/tbb-sha256sums.txt

-8d385a202d88ebbdc2e9ee3a6251f2d02fa60c3ac197e0f558da90338d66774a  tor-browser-linux64-7.0.10_ar.tar.xz
-35a55237d0e74e8dd571e06a5781750d17f9ec1ca5162bcd7c8762867fb95bc2  tor-browser-linux64-7.0.10_de.tar.xz
-10eebffe22594d336441ed59e5edc97ba1d296eb7d94bca3ff94ebfac2da3e34  tor-browser-linux64-7.0.10_en-US.tar.xz
-0347af2ef038a6a350c7d900485884b1a0ceba73e617176c06d48e1aba297519  tor-browser-linux64-7.0.10_es-ES.tar.xz
-725f9f9d539b305994e08fd654832383d78961fad05048690f253c7945f5c0a2  tor-browser-linux64-7.0.10_fa.tar.xz
-3fa4e14977688cfd6f798d6b273e96a141ad693cf48c52c3f2678c26dac614ec  tor-browser-linux64-7.0.10_fr.tar.xz
-695dd603b948767943c673261a8c77f952dffe48c32ceef680589162e1697424  tor-browser-linux64-7.0.10_it.tar.xz
-8725e42e4db3b366156dff5de575cf4805f1178ce511f5fcf9d085a495a1326c  tor-browser-linux64-7.0.10_ja.tar.xz
-287b84523381f5bde854f27bdfed1e853998c006eccfc7e398d13f04c4a4d04e  tor-browser-linux64-7.0.10_ko.tar.xz
-f5650f8b12f1a0cbb4b188d9c0e1d3f188ecbe73052d22000b0ab821279de26d  tor-browser-linux64-7.0.10_nl.tar.xz
-e9df01fc1d71c5a288bcb51b17ddf3d59321f7e58b48cfbd80fe18399d4e6286  tor-browser-linux64-7.0.10_pl.tar.xz
-7dbdae678046b2e91501603eff3738f64de8ca803b9fcc67caa6bf334ef683d9  tor-browser-linux64-7.0.10_pt-BR.tar.xz
-dee5437e9dc73b7bad99ef4cd7637303154628475c072c918760cb8b5141f36a  tor-browser-linux64-7.0.10_ru.tar.xz
-2376e603424d847ed8ec94be528c2a10a802e3771ad27ffcfdfbfe9b2430d479  tor-browser-linux64-7.0.10_tr.tar.xz
-1b840320a9f6b1891371e39d2985ef886a489ade58d21f49548ad400761e8311  tor-browser-linux64-7.0.10_vi.tar.xz
-61b0c39d8801b6aedbd0b551c958fcdf7e6de52133a9f805d1fb4cd2545e22e2  tor-browser-linux64-7.0.10_zh-CN.tar.xz
+9a352648c3c14417f35204bea09892337e633011a0e5122689b57e1fb6811717  tor-browser-linux64-7.5_ar.tar.xz
+e912e496883d7b16ae352798942d57255ba9421039be203122ebb22e8d0d0ae0  tor-browser-linux64-7.5_de.tar.xz
+67735b807da20fc3a94978f40c39d034d33c74310ea75622cdf91f09cbc648c5  tor-browser-linux64-7.5_en-US.tar.xz
+e65905673adb771b8f41afa3dba08ff2cf48f602b4f879fb16e90ff5e5befe2b  tor-browser-linux64-7.5_es-ES.tar.xz
+e29c19684578a0c513893323d66e2a841a41c4f55014c0fa8cd5f673f5cd1504  tor-browser-linux64-7.5_fa.tar.xz
+426d2fc15e175e496a2691e268a14804a726354dacbe6ad72e9a3aa41e9c0344  tor-browser-linux64-7.5_fr.tar.xz
+f1a78c96a30dfc16b8384081c56d75cdfc82c2f760b70f599f98d294e69b278e  tor-browser-linux64-7.5_it.tar.xz
+da5949bcde576477f0d3c4a4b2dac1f6a6866598efb27c20cd2e3f30b7204b12  tor-browser-linux64-7.5_ja.tar.xz
+07e17268e846f6c8bfc4df904c32bb670822d819305e2f51affd25bf617c3bde  tor-browser-linux64-7.5_ko.tar.xz
+24d25555d25ebaeabfd83217dc6eddce3504a06b0576cb89689e0d1c86cd989a  tor-browser-linux64-7.5_nl.tar.xz
+f1f8fd6d4a27fb3f7101abfd72834b85c68a8b475091f186334e537d62b7348a  tor-browser-linux64-7.5_pl.tar.xz
+9990057d875f07d824528089a64282e49511714675edc3874781153bf86798eb  tor-browser-linux64-7.5_pt-BR.tar.xz
+79a56cf3049b00561c87c6b95edc2edc27b9743a4d30fbd8a56225e2552bc201  tor-browser-linux64-7.5_ru.tar.xz
+7b61708fbbdaa726019d6f2f10ba5e9e110b8b28a0a9e7a68a3e1214837f4104  tor-browser-linux64-7.5_tr.tar.xz
+57d972aeaf3b74002df69aa25c12da62b4bf5b53ac6189768e88bbed3375715f  tor-browser-linux64-7.5_vi.tar.xz
+6b82bf8bbb8a65e7142420c8625ad478635092efaa61f5a46c1e5eb42dd836c8  tor-browser-linux64-7.5_zh-CN.tar.xz

debian/changelog

-tails (3.5) UNRELEASED; urgency=medium
+tails (3.5.1) UNRELEASED; urgency=medium
 
-  * Dummy entry for next release.
+  * Dummy entry for potential emergency release.
 
- -- Tails developers <tails@boum.org>  Tue, 09 Jan 2018 21:27:49 +0100
+ -- Tails developers <tails@boum.org>  Tue, 23 Jan 2018 01:33:25 +0100
+
+tails (3.5) unstable; urgency=medium
+
+  * Security fixes
+    - Upgrade amd64-microcode to 3.20171205.1, for the mitigation
+      against Spectre (CVE-2017-5715) (Closes: #15148).
+    - Upgrade Tor Browser to 7.5-build1 (Closes:  #15197).
+    - Upgrade Thunderbird to 1:52.5.2-2~deb9u1.0tails1 (Closes: #15033)
+    - Upgrade gdk-pixbuf to 2.36.5-2+deb9u2.0tails1 (Closes: #15177).
+    - Upgrade bind9 to 1:9.10.3.dfsg.P4-12.3+deb9u4.
+    - Upgrade libxml2 to 2.9.4+dfsg1-2.2+deb9u2.
+
+  * Minor improvements
+    - Upgrade Linux to 4.14.13, which is the first kernel that has the
+      "[x86] microcode/AMD: Add support for fam17h microcode loading"
+      commit, that's needed to load the AMD fam17h microcode for
+      mitigating the Spectre vulnerability (CVE-2017-5715).
+
+  * Bugfixes
+    - Drop Claws Mail persistence setting migration. Whenever
+      persistent Claws Mail setting is enabled, this creates an empty
+      ~/.icedove/ directory, that prevents Thunderbird from starting
+      (Closes: #12734).
+    - Prevent the GNOME Applications button from opening its menu if
+      time syncing resulted in a shift back in time (Closes: #14250).
+    - Tails Installer: when cloning Tails to another USB drive, check
+      if the target device has enough space *before* any destructive
+      actions are made (Closes: #14622).
+    - Tor Browser: make "Print to file" work again, for all locales
+      (Closes: #13403, #15024).
+
+  * Build system
+    - Fix option passed to cmp: -q is not supported but --quiet is.
+      Spotted on feature/buster that's the first branch that exercises
+      this code, but there's no reason to fix it only there.
+
+  * Test suite
+    - Adapt tests for Tor Launcher 0.2.14.3, i.e. the one shipped with
+      Tor Browser 7.5 in Tails 3.5 (Closes: #15064).
+    - Add support for creating arbitrarily sized partitions.
+    - Add a "Try cloning Tails to a too small partition" scenario
+      (regression test for #14622).
+
+ -- Tails developers <tails@boum.org>  Tue, 23 Jan 2018 00:57:58 +0100
 
 tails (3.4) unstable; urgency=medium
 

features/step_definitions/tor.rb

@@ -348,9 +348,7 @@ end
 
 When /^I configure some (\w+) pluggable transports in Tor Launcher$/ do |bridge_type|
   @screen.wait_and_click('TorLauncherConfigureButton.png', 10)
-  @screen.wait('TorLauncherBridgePrompt.png', 10)
-  @screen.wait_and_click('TorLauncherYesRadioOption.png', 10)
-  @screen.wait_and_click('TorLauncherNextButton.png', 10)
+  @screen.wait_and_click('TorLauncherBridgeCheckbox.png', 10)
   @screen.wait_and_click('TorLauncherBridgeList.png', 10)
   @bridge_hosts = []
   chutney_src_dir = "#{GIT_DIR}/submodules/chutney"
@@ -390,7 +388,6 @@ When /^I configure some (\w+) pluggable transports in Tor Launcher$/ do |bridge_
     [fingerprint, extra].each { |e| bridge_line += " " + e.to_s if e }
     @screen.type(bridge_line + Sikuli::Key.ENTER)
   end
-  @screen.wait_and_click('TorLauncherNextButton.png', 10)
   @screen.hide_cursor
   @screen.wait_and_click('TorLauncherFinishButton.png', 10)
   @screen.wait('TorLauncherConnectingWindow.png', 10)

features/step_definitions/untrusted_partitions.rb

@@ -20,10 +20,12 @@ Then /^Tails has no disk swap enabled$/ do
              mem_info)
 end
 
-Given /^I create an? ([[:alnum:]]+) partition( labeled "([^"]+)")? with an? ([[:alnum:]]+) filesystem( encrypted with password "([^"]+)")? on disk "([^"]+)"$/ do |parttype, has_label, label, fstype, is_encrypted, luks_password, name|
+Given /^I create an?( (\d+) ([[:alpha:]]+))? ([[:alnum:]]+) partition( labeled "([^"]+)")? with an? ([[:alnum:]]+) filesystem( encrypted with password "([^"]+)")? on disk "([^"]+)"$/ do |with_size, size, unit, parttype, has_label, label, fstype, is_encrypted, luks_password, name|
   opts = {}
   opts.merge!(:label => label) if has_label
   opts.merge!(:luks_password => luks_password) if is_encrypted
+  opts.merge!(:size => size) if with_size
+  opts.merge!(:unit => unit) if with_size
   $vm.storage.disk_mkpartfs(name, parttype, fstype, opts)
 end
 

features/step_definitions/usb.rb

@@ -104,7 +104,7 @@ When /^I start Tails Installer$/ do
   $vm.focus_window('Tails Installer')
 end
 
-When /^I am told that the destination device (.*)$/ do |status|
+When /^I am told by Tails Installer that.*"([^"]+)".*$/ do |status|
   try_for(10) do
     tails_installer_match_status(status)
   end

features/support/helpers/storage_helper.rb

@@ -156,8 +156,22 @@ class VMStorage
   def disk_mkpartfs(name, parttype, fstype, opts = {})
     opts[:label] ||= nil
     opts[:luks_password] ||= nil
+    opts[:size] ||= nil
+    opts[:unit] ||= nil
     guestfs_disk_helper(name) do |g, disk_handle|
-      g.part_disk(disk_handle, parttype)
+      if ! opts[:size].nil? and ! opts[:unit].nil?
+        g.part_init(disk_handle, parttype)
+        size_in_bytes = convert_to_bytes(opts[:size].to_f, opts[:unit])
+        sector_size = g.blockdev_getss(disk_handle)
+        size_in_sectors = (size_in_bytes / sector_size).floor
+        # leave some room for the partition table
+        offset_in_sectors = (convert_to_bytes(4, 'MiB') / sector_size).floor
+        g.part_add(disk_handle, 'primary',
+                   offset_in_sectors,
+                   offset_in_sectors + size_in_sectors - 1)
+      else
+        g.part_disk(disk_handle, parttype)
+      end
       g.part_set_name(disk_handle, 1, opts[:label]) if opts[:label]
       primary_partition = g.list_partitions()[0]
       if opts[:luks_password]