GitLab

This way tails-additional-software-notify will open a browser with
propoer "GNOME" environment no matter who calls it.

* Simplify by using subprocess.run() instead of low-level Popen().
* Drop unused functions.
* Refactor.

We lacked sufficient environment for AT-SPI to work for the browser
child processes started for browsing the docs.

Merge remote-tracking branch 'origin/bugfix/16462-16458-stretch-9.8-linux-4.19.20+force-all-tests' into stable

Fix-committed: #16462, #16458

Merge remote-tracking branch 'origin/feature/16334-feedback-when-opening-veracrypt' into stable (Fix-committed: #16334)

Merge remote-tracking branch 'origin/bugfix/16420-update-tails-apt-key' into stable (Fix-committed: #16420)

Refs: #16420

This reverts commit 404b474e.

MFSA-2019-04 is for Firefox 65.0.1 while MFSA-2019-05 is for Firefox ESR
60.5.1; the latter is what was meant to be referenced.

Following up on issues observed the first time someone did it
since my last updates.

Since #15583, if one merely follows what this test said, they would
*not* test /bin/su, nor input any of the potential default passwords
we want to check: instead they would see our "su" shell alias do its
job and tell that the administration password is disabled.

So let's make sure testers use /bin/su and actually test these passwords.

The previous command would yield "1.2G", which looks very similar to "1.2G" to
me, and could reflect any size increase < 100M, which does not achieve
what we're after here: a 50M size increase is already something we need
to investigate and possibly the symptom of a regression.

When one has a clone of our ISO history Git annex repository,
without this change the output has a very low signal/noise ratio.

For RCs (and alphas/betas) we ship /etc/os-release with
TAILS_CHANNEL="alpha" so the old instruction (simple append) would
result in two TAILS_CHANNEL entries. It happens to be the case that
Tails Upgrader will use only the first entry it encounters and ignore
any additional ones, so the old instructions will make us stay on the
"alpha" channel.

We only need to check that mirrors.kernel.org has them.

Fixes bug introduced in 9028a67f.

The `git` calls depend on that we're in the release checkout.