Merge remote-tracking branch 'origin/stable' into test/10381-fix-I-open-the-address-test-is-fragile

config/APT_snapshots.d/torproject/serial

-2017011202
+2017012403

config/base_branch

-testing
+stable

config/chroot_local-includes/usr/share/tails/browser-localization/descriptions

@@ -9,7 +9,7 @@ ja:JP:日本語:nihongo:nihongo
 ko:KR:한국어:hangul:hangul
 nl:NL:Nederlands:nederlands:nederlands
 pl:PL:Polski:polski:polski
-pt-PT:PT:Português:portugues:portugues
+pt-BR:BR:Português:portugues:portugues
 ru:RU:Русский:russian:
 tr:TR:Türkçe:turkce:turkce
 vi:VN:Việt Nam:vietnamese:

config/chroot_local-includes/usr/share/tails/tbb-dist-url.txt

-http://torbrowser-archive.tails.boum.org/6.0.8-build1/
+http://torbrowser-archive.tails.boum.org/6.5-build3/

config/chroot_local-includes/usr/share/tails/tbb-sha256sums.txt

-192833b7460ec13e1ea5a33831e9daf585064dbe6886941ee8af72ca8b7d666d  tor-browser-linux32-6.0.8_ar.tar.xz
-103352f3bab85c66f0f4bb38e819f6a02e154cc12c23ee4bb210d738d1024817  tor-browser-linux32-6.0.8_de.tar.xz
-89a465c5dae1860d444b1500ebfafff740e57a2e1202680e9653a5b3e5565565  tor-browser-linux32-6.0.8_en-US.tar.xz
-839a14e304bf60c5e5984e258bb6cb3c855fc8f65a1ac5b3d765c13daf1b2033  tor-browser-linux32-6.0.8_es-ES.tar.xz
-3358e75b740fc826b15a2da42f7422cb7332c37462b1b46745184e3e6bf5e56b  tor-browser-linux32-6.0.8_fa.tar.xz
-b1c6aab41af0061accb3643cf155e261711a692cce921bc11123fd95f7f53160  tor-browser-linux32-6.0.8_fr.tar.xz
-910e560a4c91d989db63a13a11a907791086025fcbe35a5489e676913bd389e7  tor-browser-linux32-6.0.8_it.tar.xz
-eb3ff57068419f68cc2981a0ea7282fca90c5950c901fcd493ea8c22aac5db00  tor-browser-linux32-6.0.8_ja.tar.xz
-ae24df81a79ca2e29e73737f137dd7359672ff3e9e6088f2315f64c8b771b393  tor-browser-linux32-6.0.8_ko.tar.xz
-f89729696b7acf3a892d03abe8ab319998ca3147a8538c00d657a49fd64aa7e6  tor-browser-linux32-6.0.8_nl.tar.xz
-2b0d5d498e5531e4e2e5b20489d1a2d7326a66bc893c25043207c47d8aa30da6  tor-browser-linux32-6.0.8_pl.tar.xz
-e68e45cc1be5bfabff259718c815d359f880ce4294e66a628b3ec85a30d4481e  tor-browser-linux32-6.0.8_pt-PT.tar.xz
-429c2f6ba8a38e487dce7f93f6b816792cd1ebc5de4ae2b9a4b832427f2ba4fe  tor-browser-linux32-6.0.8_ru.tar.xz
-d97e25f337814f7e3ef06c9238e896c08be09ffb686c84315f683349959bfbfb  tor-browser-linux32-6.0.8_tr.tar.xz
-aa6d9c5290fe9f5520f453a38447bb6bfd90d043ca5364b0416eaa8c4cd24438  tor-browser-linux32-6.0.8_vi.tar.xz
-102aa53f06a787f86879451764feec2c25ef0333712ebe545633207200dc7dbb  tor-browser-linux32-6.0.8_zh-CN.tar.xz
+5d5c4c9924f6f4df1da9c567640ce78d9401e18892e36f7689c30e7df1f42e6d  tor-browser-linux32-6.5_ar.tar.xz
+334600f4645b5dbabda519c6ce5e46520bb5c96a6c7f166b51190132f8c855d2  tor-browser-linux32-6.5_de.tar.xz
+6d00985eace478e099801b2e305133acff7c0f093a13a188206fbbed9d0a9f0d  tor-browser-linux32-6.5_en-US.tar.xz
+358db61cbc9bfba82da897ee4e76fa0e1e0bb3dd05e3e82c3edeb9421a1c6659  tor-browser-linux32-6.5_es-ES.tar.xz
+1424cef11103b7371a4f148190fb372182a962738bf11381d60602304b4b4b27  tor-browser-linux32-6.5_fa.tar.xz
+bd05d80ca7a933ea57cfe4137898e5855e703792b8393adf098ae7d484cec6ce  tor-browser-linux32-6.5_fr.tar.xz
+858e303abd1ddeb1262c5c65cd39f1709d73b3b5476c6634a27f6f204d1b0020  tor-browser-linux32-6.5_it.tar.xz
+36d2de8211e9824c45704853bb804ebfc3af314461e85d26054ca44e19e5e6ca  tor-browser-linux32-6.5_ja.tar.xz
+2de5c9234baf6de459a26b26146e30deb305df7b584ff872b66c61b42a4cd7d7  tor-browser-linux32-6.5_ko.tar.xz
+28ec4aabe007871e951eb90280ef88f1b3ed9b592cd67088af966ec267acd03d  tor-browser-linux32-6.5_nl.tar.xz
+63c8fbac6cd69ac0edb942d3eb576045a639d9c2a466d00f10e89a04d80afe39  tor-browser-linux32-6.5_pl.tar.xz
+0e3ebcdee2e8eb2bd101a73398a85ce8b7cd65a94806abbaf94b3e1ea87ecfe0  tor-browser-linux32-6.5_pt-BR.tar.xz
+47c9115c0fd963705e927f9023d4a6a31be4a92be35a14ff4c79e290688bc8e9  tor-browser-linux32-6.5_ru.tar.xz
+4d1ab1d96ad8976b4e1c37e26633e6d7c865e5325ac569946edf2456b2b7c6b4  tor-browser-linux32-6.5_tr.tar.xz
+fb105a3962154f0aa9e7fb583b27695b54a41011d86395db845f74bc25ccae4d  tor-browser-linux32-6.5_vi.tar.xz
+bc4668ba3f7c4b97d55d22d73a615f28fe0c5bba4fd5903e0c1db011bdca6101  tor-browser-linux32-6.5_zh-CN.tar.xz

debian/changelog

-tails (2.10) UNRELEASED; urgency=medium
+tails (2.11) UNRELEASED; urgency=medium
 
   * Dummy.
 
- -- anonym <anonym@riseup.net>  Fri, 13 Jan 2017 14:22:56 +0100
+ -- anonym <anonym@riseup.net>  Tue, 24 Jan 2017 14:01:50 +0100
 
-tails (2.10~rc1) unstable; urgency=medium
+tails (2.10) unstable; urgency=medium
 
   * Major new features and changes
     - Upgrade the Linux kernel to 4.8.0-0.bpo.2 (Closes: #11886).
@@ -26,11 +26,18 @@ tails (2.10~rc1) unstable; urgency=medium
         it possible to pass the listen port, and Tor control
         cookie/socket paths as arguments (Closes: #6742). We hear
         Whonix plan to use it! :)
-    - Upgrade Tor to 0.2.9.8-2~d80.jessie+1, the new stable series
+    - Upgrade Tor to 0.2.9.9-1~d80.jessie+1, the new stable series
       (Closes: #12012).
 
   * Security fixes
+    - Upgrade Tor Browser to 6.5 based on Firefox 45.7 (Closes: #12159)
     - Upgrade Icedove to 1:45.6.0-1~deb8u1+tail1s.
+    - Upgrade bind9-packages to 1:9.9.5.dfsg-9+deb8u9.
+    - Upgrade pcscd to 1.8.13-1+deb8u1.
+    - Upgrade libgd3 to 2.1.0-5+deb8u8.
+    - Upgrade libxml2 to 2.9.1+dfsg1-5+deb8u4.
+    - Upgrade tor to 0.2.9.9-1~d80.jessie+1.
+    - Upgrade samba-libs to 2:4.2.14+dfsg-0+deb8u2.
 
   * Minor improvements
     - Enable and use the Debian Jessie proposed-updates APT
@@ -74,6 +81,16 @@ tails (2.10~rc1) unstable; urgency=medium
     - Drop kernel.dmesg_restrict customization: it's enabled by
       default since 4.8.4-1~exp1 (Closes: #11886).
     - Upgrade Electrum to 2.7.9-1.
+    - Make the Electrum proxy configuration apply after upgrading to
+      2.7.9-1. These changes incidentally makes Electrum behave nicer:
+      users will now not be presented the network configuration part
+      of the setup wizard -- a server will be picked randomly, and
+      Electrum will auto-connect. The automated test suite is adjusted
+      accordingly (Closes: #12140).
+    - Remove unused Browser profile seed file localstore.rdf which was
+      made obsolete in Firefox 34.
+    - Tor Browser: switch from pt-PT to pt-BR langpack. The upstream
+      Tor Browser did this in version 6.5 (Refs: #12159).
 
   * Bugfixes
     - Tails Greeter:
@@ -92,6 +109,14 @@ tails (2.10~rc1) unstable; urgency=medium
     - Fix firewall startup during early boot, by referring to the
       "amnesia" user via its UID (Closes: #7018).
     - Include all amd64-microcodes.
+    - refresh-translations: ignore
+      config/chroot_local-includes/usr/share/doc/tails/website/.
+      Otherwise, if the website has been built already, PO tools
+      complain that there are files with translatable strings in
+      there, which are not listed in POTFILES.in.
+    - Make uBlock Origin's button appear on first run. Otherwise it
+      will only appear on browser runs after the first one. This bug
+      also affected Adblock Plus (Closes: #12145).
 
   * Build system
     - Be more careful when unmounting the tmpfs used as workspace
@@ -100,6 +125,13 @@ tails (2.10~rc1) unstable; urgency=medium
     - Upgrade the Vagrant basebox to 20170105. The only big change is
       that we now install the backported kernel in the builder VM, to
       make building possible on Debian Sid (Closes: #12081).
+    - Ensure the VirtualBox guest DKMS modules are built for the
+      kernel we want them for. In some situations, depending on the
+      version of the running kernel, the modules would not be built
+      for the 686 kernel, which is the one that needs the VirtualBox
+      guest modules.  This commit ensures the VirtualBox guest modules
+      are built and installed regardless of the how the build
+      environment looks like (Closes: #12139).
 
   * Test suite
     - Replace the filesystem shares support with a helper for easily
@@ -115,8 +147,28 @@ tails (2.10~rc1) unstable; urgency=medium
       the real Tor network (Refs: #11556).
     - Allow connections to Tor's control port during stream isolation
       tests, but only for those applications where we expect that.
-
- -- Tails Developers <tails@boum.org>  Thu, 12 Jan 2017 23:50:39 +0100
+    - Fix Electrum tests after upgrading to 2.7.9-1.
+    - Make encryption.feature pass for Tails 2.10~rc1.
+    - Adapt tests after the Donation campaign was disabled (Refs:
+      #12134).
+    - Fix 'The "Tails documentation" link on the Desktop works'
+      scenario. The TailsOfflineDocHomepage.png image doesn't match
+      what we see any more (I have no clue why), so let's use Dogtail
+      and solve this once and for all, hopefully.
+    - Work around Tails freezing during memory wiping. These
+      workarounds should be reverted once #11786 is fixed
+      properly. (Refs: #10776, #11786)
+    - Support both xtigervncviewer and xtightvncviewer for --view.
+      xtightvncviewer is a transitional package in Sid, which depends
+      on tigervnc-viewer (which ships xtigervncviewer), so by keeping
+      the dep and supporting both binaries, --view will work on both
+      Sid and Jessie (Closes: #12129).
+    - Test suite: bump image after upgrading to Tor Browser 6.5 (Refs:
+      #12159).
+    - Add debugging info for when PacketFu misbehaves, and be more
+      careful when to save pcap artifacts (Refs: #11508).
+
+ -- Tails developers <tails@boum.org>  Mon, 23 Jan 2017 11:38:37 +0100
 
 tails (2.9.1) unstable; urgency=medium
 

features/step_definitions/common_steps.rb

@@ -559,7 +559,7 @@ Then /^Tails eventually (shuts down|restarts)$/ do |mode|
       end
     else
       if mode == 'restarts'
-        @screen.find('TailsBootSplash.png')
+        @screen.find('TailsGreeter.png')
         true
       else
         ! $vm.is_running?

features/step_definitions/firewall_leaks.rb

 Then(/^the firewall leak detector has detected leaks$/) do
-  assert_raise(Test::Unit::AssertionFailedError) do
+  assert_raise(FirewallAssertionFailedError) do
     step 'all Internet traffic has only flowed through Tor'
   end
 end

features/step_definitions/pidgin.rb

@@ -35,7 +35,7 @@ def focus_pidgin_irc_conversation_window(account)
     # for a message from InfoServ first then default to looking for '#i2p'
     try_for(20) do
       begin
-        $vm.focus_window('InfoServ')
+        $vm.focus_window('irc.echelon.i2p')
       rescue ExecutionFailedInVM
         $vm.focus_window('#i2p')
       end

features/support/helpers/firewall_helper.rb

@@ -45,28 +45,40 @@ def pcap_connections_helper(pcap_file, opts = {})
       next if opts[:ignore_dhcp]
     end
 
-    connections << {
+    packet_info = {
       mac_saddr: eth_packet.eth_saddr,
       mac_daddr: eth_packet.eth_daddr,
       protocol: protocol,
-      saddr: ip_packet.ip_saddr,
-      daddr: ip_packet.ip_daddr,
       sport: sport,
       dport: dport,
     }
+    # It seems *Packet.parse can return nil despite *Packet.can_parse?
+    # returning true.
+    if ip_packet
+      packet_info[:saddr] = ip_packet.ip_saddr
+      packet_info[:daddr] = ip_packet.ip_daddr
+    else
+      puts "We were hit by #11508. PacketFu bug? Packet info: #{packet_info}"
+    end
+    connections << packet_info
   end
   connections.uniq.map { |p| OpenStruct.new(p) }
 end
 
+class FirewallAssertionFailedError < Test::Unit::AssertionFailedError
+end
+
 # These assertions are made from the perspective of the system under
 # testing when it comes to the concepts of "source" and "destination".
 def assert_all_connections(pcap_file, opts = {}, &block)
   all = pcap_connections_helper(pcap_file, opts)
   good = all.find_all(&block)
   bad = all - good
-  save_failure_artifact("Network capture", pcap_file) unless bad.empty?
-  assert(bad.empty?, "Unexpected connections were made:\n" +
-                     bad.map { |e| "  #{e}" } .join("\n"))
+  unless bad.empty?
+    raise FirewallAssertionFailedError.new(
+            "Unexpected connections were made:\n" +
+            bad.map { |e| "  #{e}" } .join("\n"))
+  end
 end
 
 def assert_no_connections(pcap_file, opts = {}, &block)

features/support/hooks.rb

@@ -244,6 +244,11 @@ After('@product') do |scenario|
     info_log("Scenario failed at time #{elapsed}")
     screen_capture = @screen.capture
     save_failure_artifact("Screenshot", screen_capture.getFilename)
+    if scenario.exception.kind_of?(FirewallAssertionFailedError)
+      Dir.glob("#{$config["TMPDIR"]}/*.pcap").each do |pcap_file|
+        save_failure_artifact("Network capture", pcap_file)
+      end
+    end
     $failure_artifacts.sort!
     $failure_artifacts.each do |type, file|
       artifact_name = sanitize_filename("#{elapsed}_#{scenario.name}#{File.extname(file)}")

po/POTFILES.skip

 wiki/src/
+config/chroot_local-includes/usr/share/doc/tails/website/

po/ar.po

@@ -19,7 +19,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: The Tor Project\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2016-11-30 13:55+0100\n"
+"POT-Creation-Date: 2017-01-12 19:30+0100\n"
 "PO-Revision-Date: 2014-12-05 17:21+0000\n"
 "Last-Translator: Osama M. Mneina <o.mneina@gmail.com>\n"
 "Language-Team: Arabic (http://www.transifex.com/projects/p/torproject/"

po/az.po

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: The Tor Project\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2016-11-30 13:55+0100\n"
+"POT-Creation-Date: 2017-01-12 19:30+0100\n"
 "PO-Revision-Date: 2014-12-30 17:30+0000\n"
 "Last-Translator: E <ehuseynzade@gmail.com>\n"
 "Language-Team: Azerbaijani (http://www.transifex.com/projects/p/torproject/"

po/bg.po

@@ -17,7 +17,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: The Tor Project\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2016-11-30 13:55+0100\n"
+"POT-Creation-Date: 2017-01-12 19:30+0100\n"
 "PO-Revision-Date: 2016-09-03 08:57+0000\n"
 "Last-Translator: carolyn <carolyn@anhalt.org>\n"
 "Language-Team: Bulgarian (http://www.transifex.com/otf/torproject/language/"

po/ca.po

@@ -13,7 +13,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: The Tor Project\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2016-11-30 13:55+0100\n"
+"POT-Creation-Date: 2017-01-12 19:30+0100\n"
 "PO-Revision-Date: 2016-09-03 08:57+0000\n"
 "Last-Translator: carolyn <carolyn@anhalt.org>\n"
 "Language-Team: Catalan (http://www.transifex.com/otf/torproject/language/"