Merge branch 'web/10312-debian-expert' (#10312)

I'm not closing the ticket because it needs more work after Tails
Installer is in Debian and Ubuntu.

wiki/src/contribute/release_process.mdwn

@@ -753,6 +753,13 @@ Update the size of the ISO image in `inc/*`:
           cut -f 5 -d ' ' | sed -r 's/(.+)([MG])/\1 \2iB/' | tr -d '\n')
 	echo "($MB/$MiB)" > "$RELEASE_CHECKOUT/wiki/src/inc/stable_i386_iso_size.html"
 
+Generate the expected signature verification output:
+
+        TAILS_ISO="${ISOS}/tails-i386-${VERSION}/tails-i386-${VERSION}.iso"
+        gpg --keyid-format long --verify "${TAILS_ISO}.sig" "${TAILS_ISO}" 2>&1 | \
+           sed 's/ /\&nbsp;/g;s/</\&lt;/;s/>/\&gt;/;s/$/<br\/>/g' >
+           "$RELEASE_CHECKOUT/wiki/src/inc/stable_i386_gpg_signature_output.html"
+
 Update the [[support/known_issues]] page:
 
 - Add regressions brought by the new release.

wiki/src/inc/stable_i386_gpg_signature_output.html

+gpg:&nbsp;Signature&nbsp;made&nbsp;Tue&nbsp;03&nbsp;Nov&nbsp;2015&nbsp;03:29:43&nbsp;AM&nbsp;UTC<br/>
+gpg:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;using&nbsp;RSA&nbsp;key&nbsp;0x98FEC6BC752A3DB6<br/>
+gpg:&nbsp;Good&nbsp;signature&nbsp;from&nbsp;"Tails&nbsp;developers&nbsp;(offline&nbsp;long-term&nbsp;identity&nbsp;key)&nbsp;&lt;tails@boum.org&gt;"&nbsp;[full]<br/>
+gpg:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;aka&nbsp;"Tails&nbsp;developers&nbsp;&lt;tails@boum.org&gt;"&nbsp;[full]<br/>
+Primary&nbsp;key&nbsp;fingerprint:&nbsp;A490&nbsp;D0F4&nbsp;D311&nbsp;A415&nbsp;3E2B&nbsp;&nbsp;B7CA&nbsp;DBB8&nbsp;02B2&nbsp;58AC&nbsp;D84F<br/>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Subkey&nbsp;fingerprint:&nbsp;BA2C&nbsp;222F&nbsp;44AC&nbsp;00ED&nbsp;9899&nbsp;&nbsp;3893&nbsp;98FE&nbsp;C6BC&nbsp;752A&nbsp;3DB6<br/>

wiki/src/inc/stable_i386_gpg_verify.html

-gpg --keyid-format long --verify tails-i386-1.7.iso.sig tails-i386-1.7.iso
+gpg --keyid-format 0xlong --verify tails-i386-1.7.iso.sig tails-i386-1.7.iso

wiki/src/install/debian/clone.mdwn

@@ -7,7 +7,7 @@
 
 [[!inline pages="install/inc/steps/switch.inline" raw="yes"]]
 
-[[!inline pages="install/inc/steps/restart_temporary.inline" raw="yes"]]
+[[!inline pages="install/inc/steps/restart_first_time.inline" raw="yes"]]
 
 [[!inline pages="install/inc/steps/verify_up-to-date.inline" raw="yes"]]
 

wiki/src/install/expert/usb.mdwn

 [[!meta robots="noindex"]]
-[[!meta stylesheet="bootstrap" rel="stylesheet"]]
+[[!meta title="Installing Tails on a USB stick from Debian or Ubuntu using the command line"]]
+[[!meta stylesheet="inc/stylesheets/steps" rel="stylesheet" title=""]]
+[[!meta stylesheet="inc/stylesheets/expert" rel="stylesheet" title=""]]
+[[!meta stylesheet="inc/stylesheets/expert-usb" rel="stylesheet" title=""]]
 
 [[Back|install/debian]]
 
-Expert to USB
+Verify the Tails signing key
+============================
+
+<div class="tip">
+
+<p>If you already certified the Tails signing key with your own key, you
+can skip this step and start [[downloading and verifying the ISO
+image|usb#download]].</p>
+
+</div>
+
+In this step, you will download and verify the <em>Tails signing
+key</em> which is the OpenPGP key that is used to cryptographically sign
+the Tails ISO image.
+
+<div class="note">
+
+<p>To follow these instructions you need to have your own OpenPGP
+key.</p>
+
+<p>To learn how to create yourself an OpenPGP key, see
+<a href="https://help.riseup.net/en/security/message-security/openpgp/gpg-keys">Managing
+OpenPGP Keys</a> by Riseup.</p>
+
+</div>
+
+1. Import the Tails signing key in your <span class="application">GnuPG</span> keyring:
+
+       wget https://tails.boum.org/tails-signing.key
+
+       gpg --import < tails-signing.key
+
+1. Install the Debian keyring. It contains the OpenPGP keys of all Debian developers:
+
+       sudo apt-get install debian-keyring/jessie
+
+1. Import the OpenPGP key of [[!wikipedia Stefano_Zacchiroli]], a former
+   Debian Project Leader, from the Debian keyring into your keyring:
+
+       gpg --keyring=/usr/share/keyrings/debian-keyring.gpg --export zack@upsilon.cc | gpg --import
+
+1. Verify the certifications made on the Tails signing key:
+
+       gpg --keyid-format 0xlong --check-sigs A490D0F4D311A4153E2BB7CADBB802B258ACD84F
+
+   In the output of this command, look for the following line:
+
+       sig! 0x9C31503C6D866396 2015-02-03  Stefano Zacchiroli <zack@upsilon.cc>
+
+   Here, <code>sig!</code>, with an exclamation mark, means that Stefano
+   Zacchiroli verified and certified the Tails signing key with his key.
+
+   It is also possible to verify the certifications made by other
+   people. Their name and email address appear in the list of
+   certification if you have their key in your keyring.
+
+   <div class="caution">
+   <p>If the verification of the certification failed, then you might
+   have downloaded a malicious version of the Tails signing key or our
+   instructions might be outdated.
+   Please [[get in touch with us|support/talk]].</p>
+   </div>
+
+1. Certify the Tails signing key with your own key:
+
+       gpg --sign-key A490D0F4D311A4153E2BB7CADBB802B258ACD84F
+
+   <div class="note">
+   <p>It is possible to publish your certification of the Tails signing
+   key on the public key servers. Doing so allows people who verified
+   your key to verify your certification and, as a consequence, build
+   more trust in the Tails signing key. To publish your certification,
+   execute the following command:</p>
+
+   <p class="pre">gpg --send-keys A490D0F4D311A4153E2BB7CADBB802B258ACD84F</p>
+   </div>
+
+<a id="download"></a>
+
+Download and verify the ISO image
+=================================
+
+In this step, you will download the latest Tails ISO image and verify it
+using the Tails signing key.
+
+1. Download the ISO image:
+
+   <p class="pre">wget --continue [[!inline pages="inc/stable_i386_iso_url" raw="yes"]]</p>
+
+1. Download the signature of the ISO image:
+
+   <p class="pre">wget [[!inline pages="inc/stable_i386_iso_sig_url" raw="yes"]]</p>
+
+1. Verify that the ISO image is signed by the Tails signing key:
+
+   <p class="pre">[[!inline pages="inc/stable_i386_gpg_verify" raw="yes"]]</p>
+
+   The output of this command should be the following:
+
+   <p class="pre">[[!inline pages="inc/stable_i386_gpg_signature_output" raw="yes"]]</p>
+
+   Verify in this output that:
+
+     - The date of the signature is the same.
+     - The signature is marked as <code>Good signature</code> since you
+       certified the Tails signing key with your own key.
+
+[[!inline pages="install/inc/steps/install_tails_installer.inline" raw="yes"]]
+
+[[!inline pages="install/inc/steps/install_final.inline" raw="yes"]]
+
+[[!inline pages="install/inc/steps/switch.inline" raw="yes"]]
+
+[[!inline pages="install/inc/steps/restart_first_time.inline" raw="yes"]]
+
+[[!inline pages="install/inc/steps/create_persistence.inline" raw="yes"]]

wiki/src/install/inc/steps/create_persistence.inline.mdwn

@@ -4,7 +4,7 @@ Create an encrypted persistent storage (optional)
 <div class="step-image">[[!img inc/infography/create-persistence.png link="no"]]</div>
 
 You can optionally create an *encrypted persistent storage* in the
-remaining free space on the <span class="usb">second</span><span class="clone">new</span> Tails USB stick to store any of the
+remaining free space on the <span class="windows-usb linux-usb mac-usb">second</span><span class="clone">new</span> Tails USB stick to store any of the
 following:
 
   - Your personal files and working documents
@@ -98,7 +98,7 @@ Passphrase</span> text boxes. Click on the <span class="guilabel">Create</span>
 
    <div class="step-image">[[!img inc/infography/restart-on-final-tails-with-persistence.png link="no"]]</div>
 
-1. Shut down the computer and restart on the <span class="usb">final</span><span class="clone">new</span> Tails<span class="dvd"> USB stick</span>.
+1. Shut down the computer and restart on <span class="windows-usb linux-usb mac-usb">the final</span><span class="clone">the new</span> Tails<span class="dvd"> USB stick</span>.
 
 1. In *Tails Greeter*:
 

wiki/src/install/inc/steps/install_final.inline.mdwn

-Install <span class="usb">the final</span> Tails<span class="dvd"> on a USB stick</span>
-========================================================================================
+Install <span class="windows-usb linux-usb mac-usb">the final</span> Tails<span class="dvd"> on a USB stick</span>
+==================================================================================================================
 
-In this step, you will install <span class="usb">the final</span> Tails on a <span class="usb">second</span><span class="clone">new</span> USB stick
+In this step, you will install <span class="windows-usb linux-usb mac-usb">the final</span> Tails
+on a <span class="windows-usb linux-usb mac-usb">second</span><span class="clone">new</span> USB stick
 using *Tails Installer*.
 
 <div class="caution">
@@ -17,17 +18,27 @@ using *Tails Installer*.
 
 1. Plug the <span class="usb">second</span><span class="clone">new</span> USB stick in the computer.
 
-1. Choose
+1. <div class="windows linux mac"><p>
+   Choose
    <span class="menuchoice">
      <span class="guimenu">Applications</span>&nbsp;▸
      <span class="guisubmenu">Tails</span>&nbsp;▸
      <span class="guimenuitem">Tails Installer</span>
    </span>
    to start <span class="application">Tails Installer</span>.
+   </p></div>
 
-1. Click on the <span class="button">Clone & Install</span> button.
+   <div class="debian expert"><p>
+   Start <span class="application">Tails Installer</span>.
+   </p></div>
 
-   [[!img inc/screenshots/tails_installer.png link=no]]
+1. Click on the
+   <span class="button windows linux mac">Clone & Install</span>
+   <span class="button debian expert">Install</span>
+   button.
+
+   [[!img inc/screenshots/tails_installer_in_tails.png link=no class="windows linux mac"]]
+   [[!img inc/screenshots/tails_installer_in_debian.png link=no class="debian expert"]]
 
    <div class="step-image">
    [[!img inc/infography/clone-temporary-tails.png link="no" class="usb clone"]]

wiki/src/install/inc/steps/install_tails_installer.inline.mdwn

+Install <span class="application">Tails Installer</span>
+========================================================
+
+In this step, you will install <span class="application">Tails
+Installer</span>, a program designed specifically for installing Tails.
+<span class="application">Tails Installer</span> is available in:
+
+  - Debian 8 (Jessie) or later
+  - Ubuntu 14.04 (Trusty) or later
+
+<div class="caution">
+
+<p>Any other installer than <span class="application">Tails
+Installer</span> might break the security properties of Tails. Only
+install Tails using <span class="application">Tails
+Installer</span>.</p>
+
+</div>
+
+<!--
+
+1. If you are running Debian, execute the following command to add the
+   [backports](http://backports.debian.org/) repository to your system:
+
+       echo 'deb http://http.debian.net/debian jessie-backports main' | \
+            sudo tee /etc/apt/sources.list.d/jessie-backports.list
+
+-->
+
+1. Execute the following command to add the
+   Tails APT repository to your system:
+
+       wget -q -O - https://labs.riseup.net/code/attachments/download/1052/tails-apt.key | sudo apt-key add -
+       echo "deb http://deb.tails.boum.org/ feature-jessie main" | \
+            sudo tee /etc/apt/sources.list.d/tails.list
+
+1. Installer the <span class="code">tails-installer</span> package:
+
+       sudo apt update
+       sudo apt install tails-installer

wiki/src/install/inc/steps/restart_temporary.inline.mdwn → wiki/src/install/inc/steps/restart_first_time.inline.mdwn

-Restart on the <span class="usb">temporary</span><span class="clone">other</span> Tails<span class="dvd"> DVD</span>
-====================================================================================================================
+Restart on <span class="windows-usb linux-usb win-usb">the temporary</span><span class="clone">the other</span> Tails<span class="dvd"> DVD</span>
+==================================================================================================================================================
 
 <div class="step-image">
 [[!img inc/infography/plug-source-usb.png link="no" class="clone"]]
@@ -17,7 +17,7 @@ in a similar way.</p>
 
 1. <p>
      <span class="dvd">Make sure that the DVD is inserted in the computer.</span>
-     <span class="usb">Shut down the computer while leaving the first USB stick plugged in.</span>
+     <span class="usb">Shut down the computer while leaving the <span class="windows linux mac">first</span> USB stick plugged in.</span>
    </p>
    <p class="dvd clone">Shut down the computer.</p>
    <p class="clone">Plug in the other Tails USB stick that you want to install from.</p>
@@ -73,7 +73,7 @@ in a similar way.</p>
    currently be impossible to start Tails on your Mac model.</p>
    </div>
 
-1. After 30&ndash;60 seconds, another screen called *Tails Greeter*, appears.
+1. After 30&ndash;60 seconds, another screen called *Tails Greeter* appears.
 
    [[!img doc/first_steps/startup_options/tails-greeter-welcome-to-tails.png link=no]]
 
@@ -92,13 +92,13 @@ in a similar way.</p>
    """]]
 
 1. In *Tails Greeter*, select your preferred language in the drop-down
-list on the bottom left of the screen. Click **Login**.
+list on the bottom left of the screen. Click <span class="button">Login</span>.
 
 1. After 15&ndash;30 seconds, the Tails desktop appears.
 
    [[!img inc/screenshots/desktop.png size=640x480 link=no]]
 
-<div class="trophy">
+<div class="trophy windows linux mac">
 
 <p>
 <span class="usb">The most difficult part is over! Now grab your second USB stick as it is time to

wiki/src/install/inc/steps/switch.inline.mdwn

@@ -14,6 +14,7 @@ the rest of the instructions afterwards, we recommend you either:
    [[!img inc/qrcodes/tails_boum_org_install_mac_clone.png class="mac-clone" link="no"]]
    [[!img inc/qrcodes/tails_boum_org_install_mac_dvd.png class="mac-dvd" link="no"]]
    [[!img inc/qrcodes/tails_boum_org_install_debian_clone.png class="debian-clone" link="no"]]
+   [[!img inc/qrcodes/tails_boum_org_install_expert_usb.png class="expert-usb" link="no"]]
    [[!img inc/qrcodes/tails_boum_org_install_linux_usb.png class="linux-usb" link="no"]]
    [[!img inc/qrcodes/tails_boum_org_install_linux_clone.png class="linux-clone" link="no"]]
 
@@ -27,5 +28,6 @@ the rest of the instructions afterwards, we recommend you either:
      <a class="mac-clone" href="https://tails.boum.org/install/mac/clone/">https://tails.boum.org/install/mac/clone/</a>
      <a class="mac-dvd" href="https://tails.boum.org/install/mac/dvd/">https://tails.boum.org/install/mac/dvd/</a>
      <a class="debian-clone" href="https://tails.boum.org/install/debian/clone/">https://tails.boum.org/install/debian/clone/</a>
+     <a class="expert-usb" href="https://tails.boum.org/install/expert/usb/">https://tails.boum.org/install/expert/usb/</a>
      <a class="linux-usb" href="https://tails.boum.org/install/linux/usb/">https://tails.boum.org/install/linux/usb/</a>
      <a class="linux-clone" href="https://tails.boum.org/install/linux/clone/">https://tails.boum.org/install/linux/clone/</a>

wiki/src/install/inc/stylesheets/expert-usb.css

+@import url("expert.css");
+@import url("usb.css");
+span.expert-usb, a.expert-usb {
+  display: inline;
+}
+div.expert-usb, img.expert-usb, p.expert-usb {
+  display: block;
+}
+li.expert-usb {
+  display: list-item;
+}

wiki/src/install/inc/stylesheets/expert.css

+span.expert, a.expert {
+  display: inline;
+}
+div.expert, img.expert, p.expert {
+  display: block;
+}
+li.expert {
+  display: list-item;
+}
+
+#content {
+  padding-left: 20px;
+}
+
+.step-image {
+  display: none;
+}
+
+.state-image {
+  display: none !important;
+}
+
+pre, p.pre {
+  max-width: 58em;
+  width: 58em;
+}
+
+div.note p.pre {
+  width: 34em;
+}

wiki/src/install/inc/stylesheets/steps.css

@@ -27,6 +27,7 @@
 .windows, .windows-clone, .windows-usb,
 .mac, .mac-usb, .mac-dvd, .mac-clone,
 .debian, .debian-clone, .debian-usb,
+.expert, .expert-usb,
 .linux, .linux-clone, .linux-usb {
   display: none;
 }

wiki/src/install/linux/clone.mdwn

@@ -7,7 +7,7 @@
 
 [[!inline pages="install/inc/steps/switch.inline" raw="yes"]]
 
-[[!inline pages="install/inc/steps/restart_temporary.inline" raw="yes"]]
+[[!inline pages="install/inc/steps/restart_first_time.inline" raw="yes"]]
 
 [[!inline pages="install/inc/steps/verify_up-to-date.inline" raw="yes"]]
 

wiki/src/install/linux/usb.mdwn

@@ -41,7 +41,7 @@
 
 [[!inline pages="install/inc/steps/switch.inline" raw="yes"]]
 
-[[!inline pages="install/inc/steps/restart_temporary.inline" raw="yes"]]
+[[!inline pages="install/inc/steps/restart_first_time.inline" raw="yes"]]
 
 [[!inline pages="install/inc/steps/install_final.inline" raw="yes"]]
 

wiki/src/install/mac/clone.mdwn

@@ -7,7 +7,7 @@
 
 [[!inline pages="install/inc/steps/switch.inline" raw="yes"]]
 
-[[!inline pages="install/inc/steps/restart_temporary.inline" raw="yes"]]
+[[!inline pages="install/inc/steps/restart_first_time.inline" raw="yes"]]
 
 [[!inline pages="install/inc/steps/verify_up-to-date.inline" raw="yes"]]