A new kernel (3.11.5-1) entered Debian unstable, and we don't want to ship
a different kernel in 0.21 final than what we had in 0.21~rc1 (3.10.11-1).

Revert "Prevent some unwanted packages to be installed at all, rather than uninstalling them later."

This reverts commit 87a2c027.

Conflicts:
	config/chroot_apt/preferences

Setting the pin-priority of some packages to -1, make it impossible to
install them with a canonical `apt-get install $package` command.

Linux 3.9-1 isn't available anymore there.

The 3.8 kernel needs it.

The version from Squeeze does not detect at least Parallels for Mac v.8.

Namely: spice-vdagent, libregexp-common-perl, macchanger, service-wrapper,
libservice-wrapper-java and libservice-wrapper-jni.

Wheezy has the versions we've been installing for a while,
so let's avoid having unstable push a newer one to us uselessly at some point.

Note that at the time of my writing, the versions in sid and in Wheezy are the
same, so this commit is effectively a no-op as of today: it is merely
a safeguard for the future.

Wheezy has the version we've been installing in 0.18~rc1,
while a newer one was uploaded to sid.

Debian sid just got Linux 3.8, and we don't want to switch to a new kernel just
a few days before Tails 0.18 is released.

They were uploaded there, and accordingly removed from sid.

Their APT repository still thinks that stable == Squeeze.

This reverts commit 9852ff01.

This reverts commit 9852ff01.

It's needed for xulrunner 17.

The version in sid is not compatible with FF17.

It's not maintained in Debian anymore, so we now fetch it from our own APT repository.

The main use of iucode-tool in Debian is to only include in the initramfs the
CPU firmware for the currently running CPU. We want firmware for all CPUs, not
only the one we build on.

This much improved new version is effectively maintained, and is nice enough to
avoid displaying dozens of spurious error messages at boot time.

Closes: todo/upgrade_barry_to_fix_error_messages_on_boot

The version in Squeeze does not install in chroots, which breaks Tails ISO build
process (Debian bug #624211).

As decided on todo/monkeysphere_keyserver_policy, because: the implication of
the current settings are not well understood, Monkeysphere is little used in
Tails, and we're not sure anymore it would be our first bet for the web browser
profile with no CA.

Let's keep the various configuration bits (e.g. FoxyProxy, patching MSVA),
though, so that advanced users who are used to have Monkeysphere in Tails just
have to install the package.

This branch is about upgrading Tails to live-boot 3.0~b7-1 and live-config
3.0.12-1, and may not be compatible with any version pushed to sid after the
next Tails freeze.

Let's keep the >>stable pinning for unstable though, it's a sensible fallback
for branches of ours that don't ship custom live-* packages.

They have been removed from our feature-live-boot-3.x APT suite too,
but are still in the devel one,
that is used too for the topic branches builds,
so we need APT pinning to fetch them from sid.

This package is part of Squeeze, and not from testing/sid.
We have been shipping the version from Squeeze for a while.

Now that we've added this package to our APT repository (testing, devel and
experimental suites), our pinning fallback configuration would anyway fetch it
from there, and not from sid anymore. So, the pinning is not useful anymore.

We'll soon drop the package from our APT repository and add some pinning back
and fetch the package from squeeze-backports, but we're not there yet.

The general case is that we fetch live-* from sid.
Occasionally, and sometimes for longer periods,
we use custom packages.
When we drop one of these custom packages,
the build system should automatically revert to sane defaults,
that is fetching it from sid.
So, this pinning is needed.

The version currently in unstable is old and breaks at least YouTube and
Hotmail. This is also closer to what TBB currently ships.

This will bring the 3.x branch that contains many updated rules and also match
what TBB currently ships.

This is needed to support, to some extent, some OpenPGP SmartCard readers.