changelog 386 KB
Newer Older
anonym's avatar
anonym committed
1
tails (3.14.1) unstable; urgency=medium
2

anonym's avatar
anonym committed
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
  * Security fixes
    - Upgrade Tor Browser to 8.5.2-build1 (Closes: #16824).
    - Upgrade Thunderbird to 60.7.0 (Closes: #16742).
    - Upgraded Linux to 4.19.37-4 (Closes: #16823).

  * Bugfixes
    - Only probe for partitions on the boot device when setting up
      TailsData. Without arguments partprobe will scan all devices,
      and if it encounters a device it doesn't support (e.g. fake
      raid-0 arrays) it will return non-zero, thus aborting Tails'
      partitioning script, resulting in an unbootable install
      (Closes: #16389).

  * Minor improvements and updates
    - Upgrade tor to 0.4.0.5-1~d90.stretch+1, the first stable
      candidate in the 0.4.0.x series (Closes: #16687).
    - Completely disable IPv6 except for the loopback interface. We
      attempt to completely block it on the netfilter level but we
      have seen ICMPv6 "leaks" any way (related to Router
      Solicitation, see: #16148) so let's just disable it. We keep
      enabled on the loopback interface since some services depends on
      ::1 being up.
    - create-usb-image-from-iso: Use syslinux from chroot. We used the
      syslinux from the vagrant box before, which caused issues with
      when building Tails/Buster with a Stretch vagrant box and then
      cloning the image via Tails Installer with syslinux from Buster
      (Closes: #16748).
    - Set Tor Browser's homepage to https://tails.boum.org/home/testing/
      if building anything but a stable release. This page explains the
      dangers of using a non-stable release. (Closes: #12003)

  * Build system
    - auto/{build,config}:
      * consistently use fatal() to error out, and prefix its message
        with "E: " to help distinguish them from the noise produced by
        tools we call etc.
      * Similarly, also prefix informational message with "I: ".
      * drop support for GnuPG 1.x.
      * clone more build output to the log file.
      * Drop obsolete check for syslinux version. This version
        requirement is satisfied by Jessie and it is doubtful Tails
        would build in anything older.
      * auto/build: drop a few checks for conditions that are already
        satisfied in the supported build environments.
    - Revert "Build system: try to be smart again by fetching only the
      refs we need." This optimization overrides the trick we have on
      Jenkins (set_origin_base_branch_head in
      https://git.tails.boum.org/jenkins-jobs/tree/macros/builders.yaml),
      that ensures that a reproducibly_build_Tails_ISO_* job builds
      from the commit used by the first build. (Closes: #16730)

  * Test suite
    - Fix mistake with execute() vs spawn() when starting the upgrader.
    - Don't filter during pcap capture, instead let's just apply the
      same filtering when we are inspecting the pcap files. This way
      any pcap file saved on failure will include the full capture,
      and not just the packets sent by the system under testing, which
      sometimes makes it hard to understand what is going on.
    - Also include the content of /var/log/tor/log in $scenario.tor
      when tor failed to bootstrap (refs: #16793)
    - Don't flood the debug logger with tor@default's journal
      contents.
    - Power off system under testing after scenario. Until now we have
      relied on either one of the generated "snapshot restore" steps
      or the "[Given] a computer" step to implicitly stop the old VM
      when we move on to a new scenario. That meant the old VM was
      still running during the new scenarios @Before@ hooks. If the
      new scenario is tagged @check_tor_leaks that means we start its
      sniffer while the old VM is still running, possibly sending
      packets that then affect the new scenario. That would explain
      some myserious "Unexpected connections were made" failures we
      have seen (Closes: #11521).
    - Only accept IP(v6)/ARP during DHCP check.
76

anonym's avatar
anonym committed
77
 -- Tails developers <tails@boum.org>  Wed, 19 Jun 2019 15:29:07 +0200
78

79
tails (3.14) unstable; urgency=medium
anonym's avatar
anonym committed
80

81
82
83
84
85
86
  * Security fixes
    - Upgrade Linux to 4.19.0-5 from sid (Closes: #16708).
    - Enable all available mitigations for the Microarchitectural Data
      Sampling (MDS) attacks and disable SMT on vulnerable CPUs
      (Closes: #16720).
    - Upgrade Tor Browser to 8.5 (Closes: #16337, #16706).
anonym's avatar
anonym committed
87

88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
  * Bugfixes
    - Install Electrum 3.2.3-1 from our custom APT repository (Closes: #16708).
      The version in sid now displays a warning and exits, while 3.2.3-1 is
      still usable, in the rare cases when it manages to connect to the
      network, despite being affected by problematic phishing attacks which
      will only be solved once the package in Debian is updated to a newer
      upstream version.

  * Build system
    - Bump APT snapshot of the 'debian' archive to 2019051601, needed for
      the MDS mitigations.
    - Don't install the firmware-linux and firmware-linux-nonfree
      metapackages, as packages they pulled are already listed explicitly
      and one might run into version-related issues (Closes: #16708).

  * Minor improvements and updates
    - Remove some packages from the Tails image as their use is not
      widespread while consuming space for everyone. They can still be
      installed and upgraded through Additional Software (Closes: #15291).
      This includes: monkeysphere and msva-perl, gobby, hopenpgp-tools,
      keyringer, libgfshare-bin, monkeysign, paperkey, pitivi,
      pdf-redact-tools, pwgen, traverso, and ssss.
    - Fix missing translations in the Greeter (Closes: #13438).
    - Fix missing newline in unlock-veracrypt-volumes (Closes: #16696).
    - Port fillram to Python 3 (Closes: #15845).
    - Enable localization for new locales introduced in Tor Browser 8.5
      (Closes: #16637).
    - Re-introduce TopIcons GNOME Shell extension (Closes: #16709).
    - Improve internationalization of the Unlock VeraCrypt Volumes
      component (Closes: #16602).

  * Test suite
     - Make tails-security-check's SOCKS port test work when there's a live
       security advisory (Closes: #16701).
     - Make terminology more consistent.

124
 -- Tails developers <tails@boum.org>  Mon, 20 May 2019 18:52:04 +0200
anonym's avatar
anonym committed
125

intrigeri's avatar
intrigeri committed
126
tails (3.13.2) unstable; urgency=medium
127

128
  * Major changes
intrigeri's avatar
intrigeri committed
129
    - Replace all locale-specific fonts and standard X.Org fonts with
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
      the Noto fonts collection (Closes: #9956).
    - Install localization support packages for all tier-1 supported languages,
      and only those (Closes: #15807). Current tier-1 supported languages are:
      Arabic, German, English, Spanish, Farsi, French, Italian, Portuguese
      (Brazil), Russian, Turkish, Simplified Chinese, Hindi, Indonesian.
    - Disable the TopIcons GNOME Shell extension (Closes: #16608).
      This extension causes crashes (#11188), does not work on Wayland
      (#8309, #12213) so long-term, we need to remove it anyway.
      In order to learn how much our users rely on this extension and
      on OpenPGP Applet, let's disable this extension for one Tails release.
      While TopIcons is disabled (by default):
      · Users can still use OpenPGP Applet via the system tray in the bottom
        left corner of the desktop.
      · Users who do need TopIcons for other reasons can enable it again
        with 1 command line.
145

146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
  * Security fixes
    - Upgrade Tor Browser to 8.0.9 (Closes: #16694).
    - Upgrade to Debian Stretch 9.9 (Closes: #16670).
    - Upgrade Thunderbird to 60.6.1 (Closes: #16641).

  * Bugfixes
    - Fix Thunderbird account setup wizard (Closes: #16573).
    - Display poweroff and reboot buttons even when locked (Closes: #15640).
    - Disable emergency shutdown during suspend (Closes: #11729).
    - Provide feedback while starting Onion Circuits (Closes: #16350).
    - Associate .key files with Seahorse (Closes: #15213).
      This partially fixes importing OpenPGP keys from GNOME Files.
    - Don't show spurious notification about "TailsData" while setting
      up a persistent volume (Closes: #16632).

  * Minor improvements and updates
    - Add a suspend button to status-menu-helper (Closes: #14556).
    - status-menu-helper: clean up and refactor.
    - Drop CSS hacks for the uBlock log window (Closes: #16206).
    - Polish 04-change-gids-and-uids code style (Closes: #16322).
    - Create persistence.conf backup in a more robust manner (Closes: #16568).
    - Make the WhisperBack .desktop file translatable in Transifex
      (Closes: #6486).

  * Build system
    - Don't fail the build if Tor Browser supports new locales that we don't ship
      a spellchecking dictionary for (#15807).
    - Fix apt-cacher-ng cache shrinking (Closes: #16020).
    - Remove obsolete usr.bin.onioncircuits AppArmor profile (Closes: #12170).
      All Tails current branches now install onioncircuits 0.6-0.0tails1,
      which ships a more current AppArmor profile than the one we
      have in our own Git tree.
    - Install Electrum from sid (Closes: #16642).
    - Avoid new "render" group stealing a GID we have already statically
      allocated to another group (Closes: #16649).

  * Test suite
    - Disable tests about notifications in case of MAC spoofing failure:
      we have a well-known bug here and these tests do nothing but confirm
      it again and again, which brings no value and has a cost (#10774).
    - Clarify what WebM scenarios are fragile (#10442).
    - Avoid zombies by waiting for killed child processes to exit (#14948).

intrigeri's avatar
intrigeri committed
189
 -- Tails developers <tails@boum.org>  Sun, 05 May 2019 19:32:22 +0000
190

intrigeri's avatar
intrigeri committed
191
tails (3.13.1) unstable; urgency=medium
anonym's avatar
anonym committed
192

intrigeri's avatar
intrigeri committed
193
  * Security fixes
intrigeri's avatar
intrigeri committed
194
    - Upgrade Tor Browser to 8.0.8 (Closes: #16606, MFSA-2019-10).
intrigeri's avatar
intrigeri committed
195
    - Upgrade NTFS-3G to 1:2016.2.22AR.1+dfsg-1+deb9u1 (DSA-4413-1).
anonym's avatar
anonym committed
196

intrigeri's avatar
intrigeri committed
197
 -- Tails developers <tails@boum.org>  Fri, 22 Mar 2019 20:54:03 +0000
anonym's avatar
anonym committed
198

199
tails (3.13) unstable; urgency=medium
200

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
201
202
203
204
  * Major changes
    - Upgrade Linux to 4.19.28-1 (Closes: #16390, #16469, #16552).
    - Upgrade Tor Browser to 8.0.7 (Closes: #16559).
    - Upgrade Thunderbird to 65.1.0 (Closes: #16422).
205

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
206
207
208
209
210
  * Security fixes
    - Upgrade LDB to 2:1.1.27-1+deb9u1 (DSA-4397-1).
    - Upgrade OpenJPEG to 2.1.2-1.1+deb9u3 (DSA-4405-1).
    - Upgrade OpenSSL 1.0 to 1.0.2r-1~deb9u1 (DSA-4400-1).
    - Upgrade OpenSSH to 1:7.4p1-10+deb9u6 (DSA-4387-2).
211

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
212
213
214
215
216
217
218
219
220
221
222
223
224
  * Bugfixes
    - Upgrade tor to 0.3.5.8-1~d90.stretch+1 (Closes: #16348).
    - Ensure Additional Software doesn't try to download packages that are
      in persistent cache (Closes: #15957).
    - Improve chances of recovering a lost persistence configuration
      (Closes: #10976).
    - Tor Launcher: add langpacks to enable localization again
      (Closes: #16338).
    - Migrate away from buggy Chinese input method: switch from ibus-pinyin
      to ibus-libpinyin + ibus-chewing (Closes: #11292).
    - Fix crash in Whisperback when additional persistent APT repositories
      are configured (Closes: #16563).
    - Give visual feedback while starting Whisperback (Closes: #16333).
225

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
226
227
228
229
230
231
232
233
234
235
236
  * Minor improvements and updates
    - Add feedback when opening VeraCrypt Mounter (Closes: #16334).
    - Improve consistency in Additional Software's accessibility
      (Closes: #16110).
    - Fix missing accessibility support when opening a browser from a
      notification (Closes: #16475).
    - Refresh ublock-origin patch to apply cleanly on top of 1.18.4+dfsg-1
      (Closes: #16451)
    - Upgrade intel-microcode to 3.20180807a.2~deb9u1.
      Fixes CVE-2018-3615, CVE-2018-3620, CVE-2018-3646, CVE-2018-3639,
      CVE-2018-3640, CVE-2017-5753, CVE-2017-5754.
237

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
238
239
240
241
242
243
244
245
246
247
  * Build system
    - Lower memory requirements when building Tails by limiting the memory
      used by mksquashfs to 512M (Closes: #16177).
    - Remove obsolete check on Thunderbird addons (Closes: #16045).
    - Update Tails' APT GnuPG key expiration (Closes: #16420).
    - Optimize Git operations (share resources, fetch only the needed
      objects).
    - Clone submodules from the host's local repositories (Closes: #16476).
    - Drop useless manual initramfs update (Closes: #16452).
    - Add a sanity check on the size of the initramfs (Closes: #16452).
248

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
249
250
251
252
253
254
  * Test suite
    - Add automated tests for Additional Software GUI (Closes: #14576,
      #14596).
    - Add automated tests on the backup persistence configuration
      (Closes: #16461).
    - Adjust test for Thunderbird 60.5.1 (Closes: #16555).
255

256
 -- Tails developers <tails@boum.org>  Mon, 18 Mar 2019 23:40:50 +0100
257

258
tails (3.12.1) unstable; urgency=medium
anonym's avatar
anonym committed
259

260
  * Security fixes
261
    - Upgrade Tor Browser to 8.0.6 (MFSA-2019-05; Closes: #16437).
262
263
264
265
    - Upgrade LibreOffice to 1:5.2.7-1+deb9u5 (DSA-4381).
    - Upgrade cURL to 7.52.1-5+deb9u9 (DSA-4386).
    - Upgrade Qt 5 to 5.7.1+dfsg-3+deb9u1 (DSA-4374).
    - Upgrade OpenSSH to 1:7.4p1-10+deb9u5 (DSA-4387).
anonym's avatar
anonym committed
266

267
 -- Tails developers <tails@boum.org>  Tue, 12 Feb 2019 21:25:14 +0100
anonym's avatar
anonym committed
268

anonym's avatar
anonym committed
269
tails (3.12) unstable; urgency=medium
anonym's avatar
anonym committed
270

271
272
273
274
275
  * Major changes
    - Make the USB image the main supported way to install Tails (refs: #15292).
      On first boot, grow the system partition to a size that's a factor
      of the size of the boot medium and randomize GUIDs (Closes: #15319).
    - Upgrade Linux to 4.19, version 4.19.13-1 (Closes: #16073, #16224).
intrigeri's avatar
intrigeri committed
276
277
278
      Fixes CVE-2018-19985, CVE-2018-19406, CVE-2018-16862, CVE-2018-18397,
      CVE-2018-18397, CVE-2018-18397, CVE-2018-18397, CVE-2018-19824,
      CVE-2018-14625.
279
280
281
282
    - Remove Liferea (Closes: #11082, #15776).
    - Upgrade to the Debian Stretch 9.6 point-release.

  * Security fixes
283
    - Upgrade Tor Browser to 8.0.5 (MFSA-2019-02; Closes: #16388).
284
285
286
287
288
289
290
291
292
293
    - Upgrade Thunderbird to 60.4.0 (DSA-4362-1; Closes: #16261).
    - Upgrade OpenSSL to 1.0.2q-1~deb9u1 (DSA-4355-1).
    - Upgrade libarchive to 3.2.2-2+deb9u1 (DSA-4360-1).
    - Upgrade GnuTLS to 3.5.8-5+deb9u4 (CVE-2018-10844, CVE-2018-10845).
    - Upgrade libgd3 to 2.2.4-2+deb9u3 (CVE-2018-1000222, CVE-2018-5711).
    - Upgrade libmspack to 0.5-1+deb9u3 (CVE-2018-18584, CVE-2018-18585).
    - Upgrade libopenmpt to 0.2.7386~beta20.3-3+deb9u3 (CVE-2018-10017).
    - Upgrade libx11 to 2:1.6.4-3+deb9u1 (CVE-2018-14598, CVE-2018-14599,
      CVE-2018-14600).
    - Upgrade libxcursor to 1:1.1.14-1+deb9u2 (CVE-2015-9262).
anonym's avatar
anonym committed
294
    - Upgrade NetworkManager to 1.6.2-3+deb9u2+0.tails1 (CVE-2018-15688).
295
296
    - Upgrade wpa to 2:2.4-1+deb9u2 (CVE-2018-14526).
    - Upgrade zeromq3 to 4.2.1-4+deb9u1 (CVE-2019-6250).
297
298
    - Upgrade APT to 1.4.9 (DSA-4371-1).
    - Upgrade GhostScript to 9.26a~dfsg-0+deb9u1 (DSA-4372-1).
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327

  * Bugfixes
    - Fix Totem's access to the Internet when it's started from the Applications
      menu.
    - Rename HTP pools to avoid confusion (Closes: #15428).
    - Fix memory erasure on shutdown with systemd v239+, by mounting
      a dedicated tmpfs on /run/initramfs instead of trying to remount /run
      with the "exec" option (Closes: #16097).
    - Make the KeePassX wrapper dialog translatable.
    - Fix detection of first Thunderbird run.

  * Minor improvements and updates
    - Upgrade tor to 0.3.4.9-1~d90.stretch+1.
    - Upgrade Mesa to 18.2.6-1~bpo9+1, libdrm to 2.4.95-1~bpo9+1,
      and libglvnd to 1.1.0-1~bpo9+1.
    - Upgrade firmware-linux and firmware-nonfree to 20190114-1.
    - Upgrade amd64-microcode to 3.20181128.1.
    - Upgrade intel-microcode to 3.20180807a.2~bpo9+1.
    - Remove the boot readahead feature (Closes: #15915).
      In most supported use cases, it did not improve boot time anymore,
      or even increases it.
    - Require TLS 1.2 in our Upgrader and tails-security-check (Closes: 11815).
    - Enable O_CREAT restriction in /tmp directories for FIFOs and regular
      files (Closes: #16072).
    - Upgrade systemd to 240-4~bpo9+0tails1 (Closes: #16352).
      Fixes CVE-2018-16864, CVE-2018-16865, and CVE-2018-16866.
    - Upgrade Enigmail to 2.0.8-5~deb9u1 (Closes: #15657).
    - Upgrade Torbirdy to 0.2.6-1~bpo9+1 (Closes: #15661).
    - Modify Torbirdy configuration in a way that's easier to maintain.
intrigeri's avatar
intrigeri committed
328
329
    - Tell the user they need to use sudo when they attempt to use su
      (Closes: #15583).
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356

  * Build system
    - Make the build of the USB image reproducible (Closes: #15985).
    - Allow specifying which set of APT snapshots shall be used during
      the build, with the APT_SNAPSHOTS_SERIALS build option (Closes: #15107).
    - Fix more GIDs and display more information when changing UIDs or GIDs
      fails (Closes: #16036).
    - Remove obsolete patches, refresh remaining ones to apply on top
      of currently installed packages version.
    - Disable irrelevant recurring jobs in Vagrant build box (refs: #16177)
      that increase the chance of FTBFS due to mksquashfs being reaped
      by the OOM killer.
    - Adjust for recent GnuPG error'ing out when it has no controlling terminal.

  * Test suite
    - Adjust test suite for USB image:
      - Add tests that exercise behavior on first boot from a device
        installed using the USB image (Closes: #16003).
      - Drop tests for use cases we don't support anymore with the introduction
        of the USB image (refs: #16004).
      - Adjust remaining tests to focus on main supported use cases,
        i.e. Tails installed from a USB image (refs: #16004.
    - In scenarios where we simulate MAC spoofing failure, test safety-critical
      properties even if the desktop notification is buggy (refs: #10774).
    - Update expected title for our Redmine (Closes: #16237).
    - Update expected image for OpenPGP key search.

anonym's avatar
anonym committed
357
 -- Tails developers <tails@boum.org>  Mon, 28 Jan 2019 13:26:26 +0100
358

359
tails (3.11) unstable; urgency=medium
360

361
362
363
364
365
366
367
368
  * Security fixes
    - Upgrade Tor Browser to 8.0.4-build2 (Closes: #16193).
    - Upgrade Thunderbird to 60.3.0-1~deb9u1.0tails1 (Closes: #16118).
    - Thunderbird: unconditionally disable Autocrypt, as it is not safe in
      its current state (See: #15923, Closes: #16186).
    - Upgrade Linux to 4.18.20 and aufs to 4.18.11+-20181119
      (Closes: #16145).
    - Upgrade cURL to 7.52.1-5+deb9u8 (DSA-4331).
369
    - Upgrade Ghostscript to 9.26~dfsg-0+deb9u1 (DSA-4336, DSA-4346).
370
371
372
373
374
375
376
    - Upgrade Perl to 5.24.1-3+deb9u5 (DSA-4347).
    - Upgrade Policykit to 0.105-18+deb9u1 (DSA-4350).
    - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u4 (DSA-4345).
    - Upgrade OpenSSL to 1.1.0j-1~deb9u1 (DSA-4348).
    - Upgrade libtiff to 4.0.8-2+deb9u4 (DSA-4349).

  * Bugfixes
377
378
379
380
381
382
383
    - Tails Upgrader:
      · Improve support for incremental upgrades to avoid issues with
        partially applied upgrades (Closes: #14754).
      · Add a prompt after the IUK has been downloaded so the user can
        control when the network will be disabled; previously this was
        done without users having a say, possibly leading to confusion and
        lost work (Closes: #15282).
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
    - Thunderbird: always set locale according to environment (Closes: #16113).

  * Minor improvements and updates
    - Remove packages which were needed for getTorBrowserUserAgent
      (Closes: #16024).
    - Fix persistence configuration window opening on full screen
      (Closes: #15894).
    - Time sync: don't temporarily increase tor's log level when using
      bridges/PTs (Closes: #15743).
    - Warn about non-free software depending on the host operating system
      and/or virtualization stack (Closes: #16195).

  * Build system
    - Create USB image after building the ISO, and include it in build
      artifacts (Closes: #15984, #15985, #15990).
    - Release process: adapt to IDF v2 (Closes: #16171).

  * Test suite
    - Add new Using "VeraCrypt encrypted volumes" feature, with scenarios
      split into two parts: "Unlock VeraCrypt Volumes" and "GNOME Disks"
      (Closes: #14469, #14471, #15238, #15239).
    - Reintroduce "Clock is one day in the future in bridge mode" test
      (Closes: #15743).
    - Make starting apps via GNOME Activities Overview more robust
      (Closes: #13469).
    - Check for "Upgrading the system" and adjust to "Upgrade successfully
      downloaded" new UI (See: #14754, #15282).
411

412
 -- Tails developers <tails@boum.org>  Mon, 10 Dec 2018 20:37:06 +0100
413

414
tails (3.10.1) unstable; urgency=medium
415

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
416
  * Declare that Enigmail is compatible with Thunderbird 60.*.
417

418
 -- Tails developers <tails@boum.org>  Tue, 23 Oct 2018 01:30:00 +0200
419

420
tails (3.10) unstable; urgency=medium
anonym's avatar
anonym committed
421

422
423
424
425
426
  * Security fixes
    - Harden sudo config to avoid potential future privilege escalation
      (Closes: #15829).
    - Upgrade Linux to 4.18 and aufs to 4.18-20181008 (Closes: #15936).
    - Upgrade the snapshot of the Debian archive to 2018100901 accordingly.
427
    - Upgrade Tor Browser to 8.0.3-build1 (Closes: #16067).
428
    - Upgrade Thunderbird to 60.2.1 (Closes: #16037).
429
430
431
432
433
434
435
436

  * Bugfixes
    - Fix installation of mesa/stretch-backports by installing libwayland*
      from stretch-backports (Closes: #15846).
    - Tor Browser AppArmor profile patch: update to apply cleanly on top
      of torbrowser-launcher 0.2.9-5.
    - Additional Software: fix issues spotted during the code review
      (Closes: #15838).
437
438
    - Additional Software: make sure to offer persistence only for newly
      installed packages, avoiding inconsistency (Closes: #15983).
439
440
441
442
443
444
445
    - Improve button labels in confirmation dialogs of the Tails installer
      (Closes: #11501).
    - Hardcode User Agent in htpdate.user-agent (Closes: #15912), as the
      Tor Browser doesn't expose it anymore.
    - Fix encoding-related crashes in Tails Installer (Closes: #15166).
    - Set the Firefox preferences to spoof English, to avoid leaking
      information about locale settings (Closes: #16029).
446
447
448
449
    - VeraCrypt: Hide PIM entries in GNOME Shell and Disks, since a newer
      cryptsetup would be needed (Closes: #16031).
    - VeraCrypt: Fix support for multiple encryption, by iterating over
      all children in the device-mapper tree (Closes: #15967).
450
451
452
    - Update translations.

  * Minor improvements and updates
453
454
    - Add dmsetup and losetup output in WhisperBack reports to help debug
      VeraCrypt-related issues (Closes: #15966).
455
456
457
458
459
    - Let AppArmor allow access to /usr/local/share/mime, reducing noise
      in logs due to many DENIED entries (Closes: #15965).
    - Use proper stem.connection module in onion-grater instead of trying
      to read the auth cookie manually: that's fragile and breaks some use
      cases (e.g. custom auth cookie).
460
    - Unlock VeraCrypt Volumes: Improve internationalization support.
461
462
463
464
465
466

  * Test suite
    - Ensure the test suite doesn't break when changing the headline of
      /home (Closes: #12156).
    - Update test suite for updated button labels in confirmation dialogs
      of the Tails installer (Closes: #11501).
anonym's avatar
anonym committed
467

468
 -- Tails developers <tails@boum.org>  Tue, 23 Oct 2018 01:30:00 +0200
anonym's avatar
anonym committed
469

anonym's avatar
anonym committed
470
tails (3.9.1) unstable; urgency=medium
471

472
473
  * Security fixes
    - Upgrade Tor Browser to 8.0.2, based on Firefox 60.2.1 (Closes: #16017).
anonym's avatar
anonym committed
474
475
    - Upgrade Thunderbird to 60.0-3~deb9u1.0tails2 (Closes: #15959). Also
      imported the same security fixes that caused Tor Browser 8.0.2.
476
477
478
479
480
481
482
483
484
    - Upgrade curl to 7.52.1-5+deb9u7 (DSA-4286).
    - Upgrade Ghostscript to 9.20~dfsg-3.2+deb9u5 (DSA-4294).
    - Upgrade libarchive-zip-perl to 1.59-1+deb9u1 (DSA-4300).
    - Upgrade libkpathsea6 to 2016.20160513.41080.dfsg-2+deb9u1 (DSA-4299).
    - Upgrade LittleCMS 2, aka. liblcms2-2, to 2.8-4+deb9u1 (DSA-4284).
    - Upgrade Python 2.7 to 2.7.13-2+deb9u3 (DSA-4306).
    - Upgrade Python 3.5 to 3.5.3-1+deb9u1 (DSA-4307).

  * Bugfixes
anonym's avatar
anonym committed
485
486
487
    - Make Thunderbird translated in non-English locales via
      intl.locale.requested, which works correctly since 60.0-3
      (Closes: #15942).
488
489
490
    - Totem: backport AppArmor profile fix to allow opening the help
      (Closes: #15841)
    - Remove mutt, that was accidentally installed in 3.9 (Closes: #15904).
sajolida's avatar
sajolida committed
491
    - Fix VeraCrypt volumes not being opened in GNOME Files (Closes: #15954).
492
493
494
495
496
497
498
    - Fix displaying the "General" section in the Tor Browser preferences
      (Closes: #15917).
    - Fix APT pinning at Tails runtime for our custom APT repository
      and for Debian backports (Closes: #15837, #15973).

  * Minor improvements and updates
    - Upgrade tor to 0.3.4.8-1~d90.stretch+1 (Closes: #15889).
499

anonym's avatar
anonym committed
500
 -- Tails developers <tails@boum.org>  Wed, 03 Oct 2018 12:12:33 +0200
501

intrigeri's avatar
intrigeri committed
502
tails (3.9) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
503

intrigeri's avatar
intrigeri committed
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
  * Major changes
    - Upgrade Tor Browser to 8.0 (Closes: #15803, #15907).
      Notable user-visible changes and relevant details:
      · Adjust to the fact Tor Browser 8.0a10 replaces firefox with a wrapper.
      · Don't use the bundled copy of libstdc++.so.6, ours is recent enough.
      · Drop obsolete Torbutton prefs (Closes: #15706).
      · Switch back to 128px icons (Closes: #15081).
      · AppArmor profile: take into account new Firefox binary path.
    - Upgrade Thunderbird to 60.0 (Closes: #15792).
      Notable user-visible changes and relevant details:
      · AppArmor profile: patch to avoid conflicting x modifiers for ps(1).
    - Upgrade tor to 0.3.4.7-rc (Closes: #15772).

  * Security fixes
    - Upgrade Linux to 4.17.17-1 and intel-microcode to 3.20180807a.1
      This fixes CVE-2018-3620 aka. Foreshadow aka. L1 Terminal Fault
      (Closes: #15796).
    - Upgrade OpenSSH to 1:7.4p1-10+deb9u4 (DSA-4280).

  * Bugfixes
    - Fix Totem on Intel graphics cards by inlining the backported mesa
      and dri-enumerate abstractions into its AppArmor profile: they are needed
      with recent Mesa and libdrm (Closes: #15821). Regression introduced
      in 3.9~rc1.
    - Fix unlocking "hidden" TrueCrypt/VeraCrypt volumes via GNOME Shell
      (Closes: #15843).
    - Fix confusing error message when unlocking TrueCrypt/VeraCrypt volumes
      (Closes: #15733).
    - Revert to Stretch's X.Org nouveau video driver (Closes: #15833).
      It seems that the regression brought by the upgraded one
      is worse than the improvements reported after our call for testing.
      Regression introduced in 3.9~rc1.
    - Use the intel X.Org driver for Intel Corporation UHD Graphics 620.
    - Fix regressions introduced in 3.9~rc1 in/by Additional Software Packages:
      · Don't break new empty persistence configuration files creation when
        permissions are incorrect (Closes: #15802).
      · Fix UX when the user has specified a distribution or version
        for a given package in their live-additional-software.conf
        (Closes: #15822).
      · Don't show installation notifications on upgrade (Closes: #15879).
    - Make more Additional Software Packages strings translatable in the
      configuration dialog and PolicyKit messages.

  * Minor improvements and updates
    - Upgrade firmware-nonfree to 20180825-1.
    - Update the deb.torproject.org APT repository signing key.
    - Unlock VeraCrypt Volumes: add disclaimer (Closes: #15849).

  * Test suite
    - Update Thunderbird test suite for 60.0 (Closes: #15791).
    - Fix various robustness issues.
    - Make the Chutney nodes use a higher V3AuthVotingInterval to make client
      bootstrap more robust (Closes: #15799).
    - Update the Tor Launcher binary path.
    - Adjust to the fact "New Circuit for this Site" is now in the site
      information and not under the Torbutton anymore.
    - Delete unused images.
intrigeri's avatar
intrigeri committed
561

intrigeri's avatar
intrigeri committed
562
 -- Tails developers <tails@boum.org>  Tue, 04 Sep 2018 12:15:43 +0000
intrigeri's avatar
intrigeri committed
563

intrigeri's avatar
intrigeri committed
564
tails (3.9~rc1) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
565

intrigeri's avatar
intrigeri committed
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
  * Major changes
    - Integrate the Additional Software Packages feature into the desktop
      and revamp the interface of "Configure Persistent Volume".
    - Support TrueCrypt/VeraCrypt encrypted volumes on the desktop.
    - Upgrade Tor Browser to 8.0a9, based on Firefox 60 ESR (Closes: #15023).
      Notable user-visible changes and relevant details:
      · Drop search engine customization and stick to Tor Browser's defaults.
      · Upgrade uBlock Origin to its WebExtension version and now rely
        on the filter lists shipped in the Debian package.
      · Tweak the number of web content processes to work better with 2 GiB
        of RAM (Closes: #15716).
      · Revamp how we're handling our custom prefs, drop obsolete ones,
        reduce our delta with pristine Tor Browser.
    - Upgrade Thunderbird to 60.0b10 (Closes: #15091). Notable details:
      · Install Torbirdy 0.2.5 from stretch-backports and drop our patches
        that were merged upstream.
      · Enable the optional part of the fixes for EFAIL (Closes: #15602).
    - Upgrade Linux to 4.17 (Closes: #15763).
    - Upgrade tor to 0.3.4.6-rc (Closes: #15770).
    - Upgrade to Debian Stretch 9.5.
bertagaz's avatar
bertagaz committed
586

intrigeri's avatar
intrigeri committed
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
  * Security fixes
    - Upgrade CUPS to 2.2.1-8+deb9u2 (DSA-4243).
    - Upgrade Exiv2 to 0.25-3.1+deb9u1 (DSA-4238).
    - Upgrade FUSE to 2.9.7-1+deb9u1 (DSA-4257).
    - Upgrade GDM to 3.22.3-3+deb9u2 (DSA-4270).
    - Upgrade libsoup to 2.56.0-2+deb9u2 (DSA-4241).
    - Upgrade Imagemagick to 8:6.9.7.4+dfsg-11+deb9u5 (DSA-4245).
    - Upgrade ffmpeg to 7:3.2.12-1~deb9u1 (DSA-4258, DSA-4249).
    - Upgrade libmspack to 0.5-1+deb9u2 (DSA-4260).
    - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u3 (DSA-4271).
    - Upgrade the Apache XML Security for C++ library to 1.7.3-4+deb9u1
      (DSA-4265).

  * Bugfixes
    - Don't display the Enigmail configuration wizard in every Tails session
      (Closes: #15693, #15746). Fix against Tails 3.8.
    - Make the torstatus GNOME Shell extension actually translatable
      (Closes: #15715). Fix against the first Tails release that included
      this extension.
    - Drop Icedove → Thunderbird migration code which started causing trouble.
    - Tails Installer:
      · Link to upgrade documentation when upgrading (Closes: #7904).
      · Show the reinstall option only when the device is big enough to make
        a full reinstallation (Closes: #14810).
      · Make the main window fit in a 600px-high screen (Closes: #14849).
      · Show the correct device size in the reinstall confirmation dialog
        (Closes: #15590).
    - Tails Greeter: don't display file:/// URLs to users (Closes: #15582).

  * Minor improvements and updates
    - Install Mesa and libdrm* from stretch-backports and upgrade the Nouveau
      X.Org video driver to 1.0.15. This improves support for some graphics
      cards such as NVIDIA Pascal series (Closes: #14910)
    - htpdate: improve diagnostics output when the date header can't be fetched.
    - Onion Grater: support named AppArmor profiles.
    - Update Onion Grater's config for new Tor Browser AppArmor profile name.
    - Enable e10s in the Unsafe Browser.
    - Delete all search plugins for the Unsafe Browser (Closes: #15708).
    - Display a deprecation warning when starting Liferea (#11082).
    - Upgrade VirtualBox guest modules to 5.2.16-dfsg-3~bpo9+2.
    - Use Tor Browser for browsing the documentation even when offline
      (Closes: #15720).
    - Provide feedback while Tor Browser, "Tails documentation"
      or "Report an error" are starting (Closes: #15101).
    - WhisperBack: remove the right pane (Closes: #7180).
    - tails-debugging-info: return machine-readable, structured data.
      Adjust WhisperBack accordingly (Closes: #8514). This paves the way
      towards more usable bug reports (#8722).
    - Port lots of our Perl code to more lightweight libraries.
636
637
      This decreases the amount of memory used by the persistence
      configuration interface.
intrigeri's avatar
intrigeri committed
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
    - Do not hide applications that require an admin password (Closes: #11013).
    - Try unlocking every persistent volume when multiple ones are
      available (Closes: #15653).
    - Upgrade Electrum to 3.1.3-1~bpo9+1.
    - Upgrade most firmware to 20180518-1.
    - Upgrade Intel microcode to 3.20180703.2~bpo9+1.
    - Upgrade AMD microcode to 3.20180524.1.

  * Build system
    - Drop AppArmor feature set pinning: this is now done in Debian Stretch
      (Closes: #15341).
    - Remove the now unused deb.torproject.org sid APT source (Closes: #15638).
    - Install OnionShare from our custom APT repo instead of from sid.
      We've mistakenly tracked sid for a while and it has become a problem,
      so stick to the version that works for us until Tails 4.0.
    - Fix building the ISO on zfs by dropping the cache=none setting for
      vmproxy's storage (Closes: #14404).
    - Update the Vagrant basebox for any change under vagrant/.
      Previously, some relevant changes were not effective until something under
      vagrant/definitions/tails-builder/ was changed.
    - Make intltool ignore .py files: `intltool-update --maintain` seems to be
      buggy with .py files.
    - Refresh our CUPS AppArmor profile patch to apply on 2.2.1-8+deb9u2.
    - Make it more obvious that the .orig file check is fatal (Closes: #15727).
    - Delete baseboxes once they're 6 months old instead of 4.
      This is more in line with the delay between our major releases these days.
    - Rename /usr/share/amnesia to /usr/share/tails. It was about time.
    - Abort the build if /etc/{passwd,group} has changed (Closes: #15419).
      Such changes can break Tails after an automatic upgrade was applied
      so let's detect it ASAP. Consequently, ensure a few GIDs  that wanted
      to play musical chairs  are the same as in Tails 3.8 (Closes: #15695).
669
670
    - Don't fail the build if the APT lists don't include any package
      whose name matches ^geoclue.
intrigeri's avatar
intrigeri committed
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700

  * Test suite
    - Adjust to the new tails-persistence-setup API.
    - Update the Tor Browser's AppArmor profile name.
    - Re-enable the "I can print the current page […]" test.
    - Update tests wrt. the fact tails-upgrade-frontend-wrapper was ported
      to Python (Closes: #15379).
    - Make a test more robust by waiting for the page to have loaded.
    - Adjust to the fact the WhisperBack debugging info is now configured
      in a machine-readable file.
    - Remove test for tails-debugging-info, that has been a no-op for a while.
    - Adjust for Tor Browser 8.
    - Make the "I open the address" step more robust and accordingly
      stop marking the tests that use it in the Unsafe Browser
      as fragile (refs: #14771).
    - De-duplicate a number of images of standard GTK+ 3 widgets.
    - Make the audio and WebM tests more robust.
    - Make the "I start the Tor Browser in offline mode" step more robust.
    - Make the "AppArmor has (not )? denied" step more robust.
    - Don't try and use XVFB_PID if it's not set (Closes: #15730).
    - Adjust Pidgin test to use a certificate that's still in Debian
      (Closes: #15762).
    - Use a hopefully more reliable public GnuPG key and make tests
      more robust against new subkeys being added (Closes: #15771).
    - Stop hard-coding the list of RTL Tor Browser locales.
    - Fix the "Unsafe Browser can be used in all languages supported in Tails"
      test for locales that have a translated homepage (Closes: #11711).
    - Take into account that apt(8) won't return when run in the remote shell
      with the ASP hooks enabled.

intrigeri's avatar
intrigeri committed
701
 -- Tails developers <tails@boum.org>  Thu, 16 Aug 2018 18:37:47 +0000
intrigeri's avatar
intrigeri committed
702

intrigeri's avatar
intrigeri committed
703
tails (3.8) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
704

intrigeri's avatar
intrigeri committed
705
  * Security fixes
intrigeri's avatar
intrigeri committed
706
    - Upgrade Tor Browser to 7.5.6 (MFSA 2018-17; Closes: #15683).
intrigeri's avatar
intrigeri committed
707
708
709
710
711
712
713
714
715
716
717
718
719
    - Upgrade Enigmail to 2.0.7 (partly fixes #15602 aka. EFAIL).
    - Upgrade libgcrypt to 1.7.6-2+deb9u3 (DSA-4231-1).
    - Upgrade perl to 5.24.1-3+deb9u4 (DSA-4226-1).

  * Bugfixes
    - Thunderbird: fix importing public OpenPGP keys from email attachments
      (Closes: #15610).
    - Make the Unsafe Browser home page translatable again (Closes: #15461).

  * Minor improvements
    - Don't display the "Know your rights" message on Thunderbird first run.
    - Move Thunderbird's default userChrome.css to /etc/thunderbird, just like
      we do for Tor Browser, for easier upgrade handling.
intrigeri's avatar
intrigeri committed
720

intrigeri's avatar
intrigeri committed
721
 -- Tails developers <tails@boum.org>  Mon, 25 Jun 2018 09:59:22 +0000
intrigeri's avatar
intrigeri committed
722

intrigeri's avatar
intrigeri committed
723
tails (3.7.1) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
724

intrigeri's avatar
intrigeri committed
725
  * Security fixes
intrigeri's avatar
intrigeri committed
726
    - Upgrade Tor Browser to 7.5.5 (MFSA 2018-14; closes: #15643).
intrigeri's avatar
intrigeri committed
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
    - Upgrade Thunderbird to 52.8.0 (DSA-4209-1; Closes: #15607).
      - Partially fixes EFAIL.
      - Fixes importing OpenPGP keys from keyservers with Enigmail.
      - Accordingly refresh our Thunderbird AppArmor profile patch.
    - Upgrade cURL to 7.52.1-5+deb9u6 (DSA-4202-1).
    - Upgrade GnuPG (modern) 2.1.18-8~deb9u2 (DSA-4222-1).
    - Upgrade GnuPG (legacy) to 1.4.21-4+deb9u1 (DSA-4223-1).
    - Upgrade Git to 1:2.11.0-3+deb9u3 (DSA-4212-1).
    - Upgrade PackageKit to 1.1.5-2+deb9u1 (DSA-4207-1).
    - Upgrade procps to 2:3.3.12-3+deb9u1 (DSA-4208-1).
    - Upgrade wavpack to 5.0.0-2+deb9u2 (DSA-4197-1).
    - Upgrade wget to 1.18-5+deb9u2 (DSA-4195-1).
    - Upgrade xdg-utils to 1.1.1-1+deb9u1 (DSA-4211-1).

  * Bugfixes
    - Fix setting a screen locker password with non-ASCII characters
      (Closes: #15636).
    - WhisperBack:
      - Rename the WhisperBack launcher to "WhisperBack Error Reporting"
        so that users have a better chance to understand what it does
        (Closes: #6432)
      - Ensure debugging info in Whisperback reports don't contain email
        signature markers so that email clients forward it in full
        (Closes: #15468).
      - Wrap text written by the user to 70 chars (Closes: #11689).

  * Minor improvements
    - The "Tails documentation" desktop launcher now opens /doc instead of
      the aging /getting_started that confused people during user testing
      (Closes: #15575).

  * Test suite
    - Update to match "Tails documentation" behaviour change.
bertagaz's avatar
bertagaz committed
760

intrigeri's avatar
intrigeri committed
761
 -- Tails developers <tails@boum.org>  Sat, 09 Jun 2018 19:53:51 +0000
bertagaz's avatar
bertagaz committed
762

bertagaz's avatar
bertagaz committed
763
tails (3.7) unstable; urgency=medium
anonym's avatar
anonym committed
764

bertagaz's avatar
bertagaz committed
765
  * Security fixes
bertagaz's avatar
bertagaz committed
766
    - Upgrade Tor Browser to 7.5.4 (MFSA 2018-12, Closes: #15588).
bertagaz's avatar
bertagaz committed
767
768
769
770
771
772
773
774
775
    - Upgrade OpenSSL to 1.1.0f-3+deb9u2 (DSA-4157).
    - Upgrade Perl to 5.24.1-3+deb9u3 (DSA-4172).
    - Upgrade Libre Office to 1:5.2.7-1+deb9u4 (DSA-4178).
    - Upgrade libmad to 0.15.1b-8+deb9u1 (DSA-4192).

  * Bugfixes
    - Enable the removal of OpenPGP keyblock in Whisperback (closes: #7797).
    - Show the logo in Whisperback's About menu (closes: #13198).
    - Use the same font in all the Whisperback report (Closes: #11272).
776
    - Update tails-bugs@tails.boum OpenPGP key (Closes: #15534).
bertagaz's avatar
bertagaz committed
777
778
779
780

  * Minor improvements
    - Stop installing python-qt4 and python-trezor (Closes: #15391).
    - Make WhisperBack easier to find in the GNOME Overview (Closes: #13299).
anonym's avatar
anonym committed
781

bertagaz's avatar
bertagaz committed
782
 -- Tails developers <tails@boum.org>  Tue, 08 May 2018 01:47:22 +0200
anonym's avatar
anonym committed
783

anonym's avatar
anonym committed
784
tails (3.6.2) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
785

anonym's avatar
anonym committed
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
  * Security fixes
    - Upgrade Tor Browser to 7.5.3 (MFSA 2018-10, Closes: #15459).
    - Upgrade Thunderbird to 1:52.7.0-1~deb9u1.0tails1 (DSA-4155,
      Closes: #15471).
    - Upgrade libicu to 57.1-6+deb9u2 (DSA-4150).
    - Upgrade intel-microcode to 3.20180312.1~bpo9+1. Implements
      IBRS/IBPB/STIPB support, Spectre-v2 mitigation for: Sandybridge,
      Ivy Bridge, Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake
      (Closes: #15173).

  * Bugfixes
    - Tor Browser AppArmor profile:
     * Grant the main Firefox process access to machine-id: needed for
       IBus support (Closes: #15437).
     * Allow access to extensions installed by the user such as Tails
       Verification (Closes: #15434).
    - Remove packages needed to support Video Acceleration API
      (VA-API) because they breaks opening GNOME Settings and Totem in
      Tails 3.6 on some computers (only NVIDIA for now but perhaps
      other hardware is affected). (Closes: #15433, #15449)
    - Upgrade Linux to 4.15.11-1 and bump the aufs submodule (Closes:
      #15456, #15457).
    - tails-documentation script:
      * open translated documentation page in Tor Browser when online
        (Closes: #15371).
      * use documented syntax for os.execv (Refs: #15332)
      * re-add support for passing a HTML anchor as the second
        argument.
    - Fix issue where the tails-persistence-setup user's guid would be
      changed when it was the uid that was intended (Closes: #15422).
bertagaz's avatar
bertagaz committed
816

anonym's avatar
anonym committed
817
 -- Tails developers <tails@boum.org>  Thu, 29 Mar 2018 17:49:42 +0200
bertagaz's avatar
bertagaz committed
818

intrigeri's avatar
intrigeri committed
819
tails (3.6.1) unstable; urgency=medium
820

intrigeri's avatar
intrigeri committed
821
822
823
824
825
826
827
828
  * Security fixes
    - Upgrade Tor Browser to 7.5.2 (MFSA 2018-08 i.e. CVE-2018-5146).
    - Upgrade libvorbis to 1.3.5-4+deb9u2 (DSA 4140-1 aka. CVE-2018-5146).
    - Upgrade curl to 7.52.1-5+deb9u5 (DSA 4136-1).
    - Upgrade samba to 2:4.5.12+dfsg-2+deb9u2 (DSA 4135-1).

  * Bugfixes
    - Fix ISO build reproducibility (Closes: #15400)
intrigeri's avatar
intrigeri committed
829
830
831
    - Disable Selfrando: Tor Browser upstream currently enables it only
      in non-release builds
      (https://trac.torproject.org/projects/tor/ticket/24912#comment:8).
832

intrigeri's avatar
intrigeri committed
833
 -- Tails developers <tails@boum.org>  Fri, 16 Mar 2018 22:42:00 +0000
834

bertagaz's avatar
bertagaz committed
835
tails (3.6) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
836

root's avatar
root committed
837
  * Major changes
bertagaz's avatar
bertagaz committed
838
    - Upgrade Tor Browser to 7.5.1.
839
    - Upgrade Tor to 0.3.2.10. (Closes: #15158)
intrigeri's avatar
intrigeri committed
840
    - Add ability to lock the screen. (Closes: #5684)
841
    - Add initial support for Meek bridges. (Closes: #8243)
root's avatar
root committed
842
843
844
    - Upgrade to Thunderbird 52.6.0. (Closes: #15298)
    - Enable Thunderbird AppArmor profile. (Closes: 11973)
    - Upgrade Linux to 4.15.0-1. (Closes: #15309).
intrigeri's avatar
intrigeri committed
845
    - Upgrade systemd to 237.
root's avatar
root committed
846
    - Upgrade Electrum to 3.0.6. (Closes: #15022)
bertagaz's avatar
bertagaz committed
847
848
    - Upgrade the base system to the Debian Stretch 9.4 point-release
      (Closes: #15341)
849
    - Port a few shell scripts to Python thanks to GoodCrypto. (Closes: #11198)
anonym's avatar
anonym committed
850

root's avatar
root committed
851
852
853
  * Security fixes
    - Upgrade Intel processor microcode firmware. (Closes: #15173).
    - Upgrade poppler to 0.48.0-2+deb9u1. (CVE-2017-14929, CVE-2017-1000456)
bertagaz's avatar
bertagaz committed
854
    - Upgrade tiff to 4.0.8-2+deb9u2 (CVE-2017-9935, CVE-2017-11335,
root's avatar
root committed
855
856
857
858
      CVE-2017-12944, CVE-2017-13726, CVE-2017-13727, CVE-2017-18013)
    - Upgrade ffmpeg to 7:3.2.10-1~deb9u1. (CVE-2017-17081)
    - Upgrade libtasn1-6 to 4.10-1.1+deb9u1. (CVE-2017-10790, CVE-2018-6003)
    - Upgrade Libre Office to 1:5.2.7-1+deb9u2. (CVE-2018-6871)
bertagaz's avatar
bertagaz committed
859
    - Upgrade libvorbis to 1.3.5-4+deb9u1. (CVE-2017-14632, CVE-2017-14633)
root's avatar
root committed
860
    - Upgrade gcc to 6.3.0-18+deb9u1.
bertagaz's avatar
bertagaz committed
861
862
863
    - Upgrade util-linux to 2.29.2-1+deb9u1. (CVE-2018-7738)
    - Upgrade isc-dhcp to 4.3.5-3+deb9u1 (CVE-2017-3144, CVE-2018-5732,
      CVE-2018-5733)
root's avatar
root committed
864
865

  * Minor improvements
866
867
868
    - Avoid noisy warning at boot time by creating tails-upgrade-frontend's
      trusted GnuPG homedir with stricter permissions, then making it looser.
      (Closes: #7037)
root's avatar
root committed
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
    - Drop (broken) Thunderbird dedicated SocksPort. (Closes: #12460)
    - Drop customized update-ca-certificates.service. (Closes: #14756)
    - Update AppArmor cupsd profile. (Closes: #15029)
    - Improve UX when GDM does not start. (Closes: #14521)
    - Install packages needed to support Video Acceleration API.
      (Closes: #14580)
    - Upgrade aufs-dkms for Linux 4.15. (Closes: #15132).
    - Ship pdf-redact-tools, thanks to dachary <loic@dachary.org>.
      (Closes: #15052)
    - Additional Software Packages: convert to python3 and PEP-8.
      (Closes: #15198)
    - Additional Software Packages: do not check for updates every time the
      network gets reconnected. (Closes: #9819)
    - Revert to xorg-xserver from Stretch. (Closes: #15232)
    - Open Tails documentation in Tor Browser when online. (Closes: #15332)
    - Disable Enigmail's Memory Hole feature. (Closes: #15201)
    - Persistence Setup: stop depending on Synaptic. (Closes: #15263)

  * Bugfixes
    - Additional Software Packages: fix the "incomplete online upgrade
      process" bug in offline mode (Closes: #14570)
    - Additional Software Packages: do not block Desktop opening.
      (Closes: #9059)
    - Install OpenPGP Applet 1.1. (Closes: #6398).
    - Repair rng-tools using a real start-stop-daemon program.
      (Closes: #15344)
    - Tails installer: fix bug with unicode status messages. (Closes: #15254)
anonym's avatar
anonym committed
896

root's avatar
root committed
897
898
899
  * Build system
    - Abort if tails-custom-apt-sources failed.
    - Abort the ISO build when DKMS modules are not built. (Closes: #14789).
900
    - Improve how we track dependencies in build hooks. (Closes: #14818)
root's avatar
root committed
901
902
903
904
    - Fix (potential) rare race condition during build.
    - Ensure the SquashFS has /etc/hostname properly configured.
      (Closes: #15322)
    - Bump builder VM's RAM. (Closes: #15310)
anonym's avatar
anonym committed
905

root's avatar
root committed
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
  * Test suite
    - Log the list of systemd jobs when systemctl is-system-running fails.
      (Closes: #14772).
    - Allow more time for 'systemctl is-system-running' to succeed.
    - Only support SikuliX, not Sikuli.
    - Disable SPICE clipboard sharing.
    - Don't flood the debug logger with the journal contents.
    - Rescue exception.
    - Enter a name into the Thunderbird account configuration.
      (Closes: #11256)
    - Fix the "I do not see ..." step's case. (Closes: #14929)
    - Mark scenarios that use the "The Report an Error launcher will…" step
      as fragile (Closes: #15321)
    - Test that Tor Browser opens docs when online. (Closes: #15332)
    - Adapt test after warning moved to after Unsafe Browser verification
      dialog. (Closes: #8775)
    - Dogtailify electrum.feature.
    - Add additional software packages feature. (Closes: #14572)
intrigeri's avatar
intrigeri committed
924
    - Disable test that is broken due to a Tor Browser bug. (refs: #15336)
anonym's avatar
anonym committed
925

bertagaz's avatar
bertagaz committed
926
 -- Tails developers <tails@boum.org>  Mon, 12 Mar 2018 21:28:29 +0100
anonym's avatar
anonym committed
927

anonym's avatar
anonym committed
928
tails (3.5) unstable; urgency=medium
anonym's avatar
anonym committed
929

anonym's avatar
anonym committed
930
931
932
  * Security fixes
    - Upgrade amd64-microcode to 3.20171205.1, for the mitigation
      against Spectre (CVE-2017-5715) (Closes: #15148).
anonym's avatar
anonym committed
933
    - Upgrade Tor Browser to 7.5-build3 (Closes:  #15197).
anonym's avatar
anonym committed
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
    - Upgrade Thunderbird to 1:52.5.2-2~deb9u1.0tails1 (Closes: #15033)
    - Upgrade gdk-pixbuf to 2.36.5-2+deb9u2.0tails1 (Closes: #15177).
    - Upgrade bind9 to 1:9.10.3.dfsg.P4-12.3+deb9u4.
    - Upgrade libxml2 to 2.9.4+dfsg1-2.2+deb9u2.

  * Minor improvements
    - Upgrade Linux to 4.14.13, which is the first kernel that has the
      "[x86] microcode/AMD: Add support for fam17h microcode loading"
      commit, that's needed to load the AMD fam17h microcode for
      mitigating the Spectre vulnerability (CVE-2017-5715).

  * Bugfixes
    - Drop Claws Mail persistence setting migration. Whenever
      persistent Claws Mail setting is enabled, this creates an empty
      ~/.icedove/ directory, that prevents Thunderbird from starting
      (Closes: #12734).
intrigeri's avatar
intrigeri committed
950
    - Don't prevent the GNOME Applications button from opening its menu if
anonym's avatar
anonym committed
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
      time syncing resulted in a shift back in time (Closes: #14250).
    - Tails Installer: when cloning Tails to another USB drive, check
      if the target device has enough space *before* any destructive
      actions are made (Closes: #14622).
    - Tor Browser: make "Print to file" work again, for all locales
      (Closes: #13403, #15024).

  * Build system
    - Fix option passed to cmp: -q is not supported but --quiet is.
      Spotted on feature/buster that's the first branch that exercises
      this code, but there's no reason to fix it only there.

  * Test suite
    - Adapt tests for Tor Launcher 0.2.14.3, i.e. the one shipped with
      Tor Browser 7.5 in Tails 3.5 (Closes: #15064).
    - Add support for creating arbitrarily sized partitions.
    - Add a "Try cloning Tails to a too small partition" scenario
      (regression test for #14622).
anonym's avatar
anonym committed
969

anonym's avatar
anonym committed
970
 -- Tails developers <tails@boum.org>  Tue, 23 Jan 2018 00:57:58 +0100
anonym's avatar
anonym committed
971

anonym's avatar
anonym committed
972
tails (3.4) unstable; urgency=medium
anonym's avatar
anonym committed
973

anonym's avatar
anonym committed
974
  * Security fixes
975
    - Install Linux 4.14.0-3 from sid (Closes: #14976). This enables
976
      the kernel-side mitigations for Meltdown.
anonym's avatar
anonym committed
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
    - Upgrade curl to 7.52.1-5+deb9u3.
    - Upgrade enigmail to 2:1.9.9-1~deb9u1.
    - Upgrade gimp to 2.8.18-1+deb9u1.
    - Upgrade imagemagick to 8:6.9.7.4+dfsg-11+deb9u4.
    - Upgrade libav (ffmpeg) to 7:3.2.9-1~deb9u1.
    - Upgrade libxcursor to 1:1.1.14-1+deb9u1.
    - Upgrade libxml-libxml-perl to 2.0128+dfsg-1+deb9u1.
    - Upgrade poppler to 0.48.0-2+deb9u1.
    - Upgrade rsync to 3.1.2-1 3.1.2-1+deb9u1.
    - Upgrade samba to 2:4.5.12+dfsg-2+deb9u1.
    - Upgrade sensible-utils to 0.0.9+deb9u1.
    - Upgrade tor to 0.3.1.9-1~d90.stretch+1.

  * Minor improvements
    - Display TopIcons systray on the left of the system menu. This
      fixes #14796 (on Buster, it is displayed in the middle of the
      screen, on the left of the clock) and an annoying UX problem we
      have on Stretch: OpenPGP applet is in the middle of icons that
      share the exact same (modern, GNOME Shell-like) behaviour, which
      is disturbing when opening one of the modern menus and moving
      the mouse left/right to the others, because in the middle one
      icon won't react as expected, and the nice blue bottom border
      continuity is broken.
    - Use the "intel" X.Org driver for integrated graphics in Intel
For faster browsing, not all history is shown. View entire blame