This will be needed to exercise AppArmor policy by trying to save to more
interesting places.

Test suite: make step for saving current page from the Tor Browser able to use an arbitrary directory.

This will be needed to exercise AppArmor policy by trying to save to more
interesting places.

Merge remote-tracking branch 'origin/test/9425-enable-spice-and-asbolute-pointing-device' into stable

Fix-committed: #9425

Fix-committed: #9402

Fix-committed: #9339

Fix-committed: #9416

Not only this introduces needless variations between ISO images built from the
same source (hence blocks deterministic builds), but there's a risk that some
package (either one we already ship, or one that we ship some day, or one that
users install themselves) actually use this pair of SSL keys on the Internet,
which is wrong since the private key material is public.

Note that:

 * We run update-ca-certificates after deleting the snakeoil SSL certificate,
   to ensure it's not included in /etc/ssl/certs/ca-certificates.crt.
 * We make sure we delete all symlinks pointing to the SSL snakeoil certificate
   or key, because it avoids having to understand what symlinks are created
   on current Debian, and to track any future changes in this area.

Will-fix: #9416

Fix-committed: #9341

Will-fix: #9339

Now that Linux 3.16.7-ckt9-3 has migrated to Debian Jessie (well,
jessie/updates), let's install the kernel from there instead of Debian
testing, so we won't get Linux 4.0 at some point, which will break
aufs.

This is a follow-up to #9340.

We'll want to install e.g. Jessie's Linux and we do not want to miss
out on security updates.

Fix-committed: #9419

Fix-committed: #9417

Fix-committed: #9332

Fix-committed: #9424

torbrowser-AppArmor-profile.patch: refresh to apply cleanly on top of the profile shipped with torbrowser-launcher 0.2.0-1.

The patch is modified because upstream has taken a change that was previously
part of our delta, and that I had submitted to them.

This ensures that the first (and biggest) `apt-get install' run is actually run
with eatmydata available and enabled.

Refs: #9419

At least when two "relative" pointing devices are present at the same
time, like a ps2 mouse and usb mouse, I've seen major breakage caused
by host mouse events being used for each such device in virt-viewer,
effectively doubling all mouse events inside the guest (i.e. one click
=> double click, mouse movements are doubled, etc). Hence it feels
safer to disable the ps2 mouse and only rely on the ("absolute")
tablet device (which has further improvements via Spice).

Unfortunately it seems impossible to remove the ps2 mouse since it's
part of all QEMU machine templates, including the one we use,
presumably with the exception of 'none', which should be an empty
machine. However, I've so far not been able to come up with a config
that works based on 'none' (generally I get alias errors with the PCI
controller). So we also have to blacklist the module.

Will-fix: #9425

This seems to help with the issues we have with lost mouse events, in
particular in combination with an absolute pointing device, like the
'tablet' we already have.

There are some interesting bits about this mentioned in the Spice
manual:

    https://elmarco.fedorapeople.org/manual.html

So currently we use mouse mode='client' which "is appropriate for
... a loaded server, since cursor has smooth motion and
responsiveness", which we have some data suggestion have been
affecting us (see discussion on #8928). However, it also says "the
cursor might lose synchronization (position and shape) for a while"
but it's not mentioned what may cause this (when there's high
load?). It could be interesting to test mouse mode='server' too, just
for comparison.

Will-fix: #9425

Tails developers authored Mar 02, 2015 and anonym committed May 18, 2015

So now we can use the cucumber formatters however we want.

Will-fix: #9424

Not only this directory needlessly takes room in ISO images, but it also makes
IUKs bigger than they could be: there are time-based variations in there.

Will-fix: #9417

Fix-committed: #8617

Will-fix: #9332

Fix-committed: #9377

Will-fix: #9402

Conflicts:
	wiki/src/doc/anonymous_internet/Tor_Browser.de.po
	wiki/src/doc/anonymous_internet/Tor_Browser.fr.po
	wiki/src/doc/anonymous_internet/Tor_Browser.pt.po
	wiki/src/support/known_issues.de.po
	wiki/src/support/known_issues.fr.po
	wiki/src/support/known_issues.mdwn
	wiki/src/support/known_issues.pt.po

Thanks to

    config/chroot_local-includes/lib/live/config/0001-sane-clock

these scenarios cannot happen, and since we test that it works they
can be safely removed.