changelog 382 KB
Newer Older
1
2
3
4
5
6
tails (3.15) UNRELEASED; urgency=medium

  * Dummy changelog entry for next release.

 -- Tails developers <tails@boum.org>  Thu, 23 May 2019 05:59:19 +0000

7
tails (3.14) unstable; urgency=medium
anonym's avatar
anonym committed
8

9
10
11
12
13
14
  * Security fixes
    - Upgrade Linux to 4.19.0-5 from sid (Closes: #16708).
    - Enable all available mitigations for the Microarchitectural Data
      Sampling (MDS) attacks and disable SMT on vulnerable CPUs
      (Closes: #16720).
    - Upgrade Tor Browser to 8.5 (Closes: #16337, #16706).
anonym's avatar
anonym committed
15

16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
  * Bugfixes
    - Install Electrum 3.2.3-1 from our custom APT repository (Closes: #16708).
      The version in sid now displays a warning and exits, while 3.2.3-1 is
      still usable, in the rare cases when it manages to connect to the
      network, despite being affected by problematic phishing attacks which
      will only be solved once the package in Debian is updated to a newer
      upstream version.

  * Build system
    - Bump APT snapshot of the 'debian' archive to 2019051601, needed for
      the MDS mitigations.
    - Don't install the firmware-linux and firmware-linux-nonfree
      metapackages, as packages they pulled are already listed explicitly
      and one might run into version-related issues (Closes: #16708).

  * Minor improvements and updates
    - Remove some packages from the Tails image as their use is not
      widespread while consuming space for everyone. They can still be
      installed and upgraded through Additional Software (Closes: #15291).
      This includes: monkeysphere and msva-perl, gobby, hopenpgp-tools,
      keyringer, libgfshare-bin, monkeysign, paperkey, pitivi,
      pdf-redact-tools, pwgen, traverso, and ssss.
    - Fix missing translations in the Greeter (Closes: #13438).
    - Fix missing newline in unlock-veracrypt-volumes (Closes: #16696).
    - Port fillram to Python 3 (Closes: #15845).
    - Enable localization for new locales introduced in Tor Browser 8.5
      (Closes: #16637).
    - Re-introduce TopIcons GNOME Shell extension (Closes: #16709).
    - Improve internationalization of the Unlock VeraCrypt Volumes
      component (Closes: #16602).

  * Test suite
     - Make tails-security-check's SOCKS port test work when there's a live
       security advisory (Closes: #16701).
     - Make terminology more consistent.

52
 -- Tails developers <tails@boum.org>  Mon, 20 May 2019 18:52:04 +0200
anonym's avatar
anonym committed
53

intrigeri's avatar
intrigeri committed
54
tails (3.13.2) unstable; urgency=medium
55

56
  * Major changes
intrigeri's avatar
intrigeri committed
57
    - Replace all locale-specific fonts and standard X.Org fonts with
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
      the Noto fonts collection (Closes: #9956).
    - Install localization support packages for all tier-1 supported languages,
      and only those (Closes: #15807). Current tier-1 supported languages are:
      Arabic, German, English, Spanish, Farsi, French, Italian, Portuguese
      (Brazil), Russian, Turkish, Simplified Chinese, Hindi, Indonesian.
    - Disable the TopIcons GNOME Shell extension (Closes: #16608).
      This extension causes crashes (#11188), does not work on Wayland
      (#8309, #12213) so long-term, we need to remove it anyway.
      In order to learn how much our users rely on this extension and
      on OpenPGP Applet, let's disable this extension for one Tails release.
      While TopIcons is disabled (by default):
      · Users can still use OpenPGP Applet via the system tray in the bottom
        left corner of the desktop.
      · Users who do need TopIcons for other reasons can enable it again
        with 1 command line.
73

74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
  * Security fixes
    - Upgrade Tor Browser to 8.0.9 (Closes: #16694).
    - Upgrade to Debian Stretch 9.9 (Closes: #16670).
    - Upgrade Thunderbird to 60.6.1 (Closes: #16641).

  * Bugfixes
    - Fix Thunderbird account setup wizard (Closes: #16573).
    - Display poweroff and reboot buttons even when locked (Closes: #15640).
    - Disable emergency shutdown during suspend (Closes: #11729).
    - Provide feedback while starting Onion Circuits (Closes: #16350).
    - Associate .key files with Seahorse (Closes: #15213).
      This partially fixes importing OpenPGP keys from GNOME Files.
    - Don't show spurious notification about "TailsData" while setting
      up a persistent volume (Closes: #16632).

  * Minor improvements and updates
    - Add a suspend button to status-menu-helper (Closes: #14556).
    - status-menu-helper: clean up and refactor.
    - Drop CSS hacks for the uBlock log window (Closes: #16206).
    - Polish 04-change-gids-and-uids code style (Closes: #16322).
    - Create persistence.conf backup in a more robust manner (Closes: #16568).
    - Make the WhisperBack .desktop file translatable in Transifex
      (Closes: #6486).

  * Build system
    - Don't fail the build if Tor Browser supports new locales that we don't ship
      a spellchecking dictionary for (#15807).
    - Fix apt-cacher-ng cache shrinking (Closes: #16020).
    - Remove obsolete usr.bin.onioncircuits AppArmor profile (Closes: #12170).
      All Tails current branches now install onioncircuits 0.6-0.0tails1,
      which ships a more current AppArmor profile than the one we
      have in our own Git tree.
    - Install Electrum from sid (Closes: #16642).
    - Avoid new "render" group stealing a GID we have already statically
      allocated to another group (Closes: #16649).

  * Test suite
    - Disable tests about notifications in case of MAC spoofing failure:
      we have a well-known bug here and these tests do nothing but confirm
      it again and again, which brings no value and has a cost (#10774).
    - Clarify what WebM scenarios are fragile (#10442).
    - Avoid zombies by waiting for killed child processes to exit (#14948).

intrigeri's avatar
intrigeri committed
117
 -- Tails developers <tails@boum.org>  Sun, 05 May 2019 19:32:22 +0000
118

intrigeri's avatar
intrigeri committed
119
tails (3.13.1) unstable; urgency=medium
anonym's avatar
anonym committed
120

intrigeri's avatar
intrigeri committed
121
  * Security fixes
intrigeri's avatar
intrigeri committed
122
    - Upgrade Tor Browser to 8.0.8 (Closes: #16606, MFSA-2019-10).
intrigeri's avatar
intrigeri committed
123
    - Upgrade NTFS-3G to 1:2016.2.22AR.1+dfsg-1+deb9u1 (DSA-4413-1).
anonym's avatar
anonym committed
124

intrigeri's avatar
intrigeri committed
125
 -- Tails developers <tails@boum.org>  Fri, 22 Mar 2019 20:54:03 +0000
anonym's avatar
anonym committed
126

127
tails (3.13) unstable; urgency=medium
128

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
129
130
131
132
  * Major changes
    - Upgrade Linux to 4.19.28-1 (Closes: #16390, #16469, #16552).
    - Upgrade Tor Browser to 8.0.7 (Closes: #16559).
    - Upgrade Thunderbird to 65.1.0 (Closes: #16422).
133

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
134
135
136
137
138
  * Security fixes
    - Upgrade LDB to 2:1.1.27-1+deb9u1 (DSA-4397-1).
    - Upgrade OpenJPEG to 2.1.2-1.1+deb9u3 (DSA-4405-1).
    - Upgrade OpenSSL 1.0 to 1.0.2r-1~deb9u1 (DSA-4400-1).
    - Upgrade OpenSSH to 1:7.4p1-10+deb9u6 (DSA-4387-2).
139

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
140
141
142
143
144
145
146
147
148
149
150
151
152
  * Bugfixes
    - Upgrade tor to 0.3.5.8-1~d90.stretch+1 (Closes: #16348).
    - Ensure Additional Software doesn't try to download packages that are
      in persistent cache (Closes: #15957).
    - Improve chances of recovering a lost persistence configuration
      (Closes: #10976).
    - Tor Launcher: add langpacks to enable localization again
      (Closes: #16338).
    - Migrate away from buggy Chinese input method: switch from ibus-pinyin
      to ibus-libpinyin + ibus-chewing (Closes: #11292).
    - Fix crash in Whisperback when additional persistent APT repositories
      are configured (Closes: #16563).
    - Give visual feedback while starting Whisperback (Closes: #16333).
153

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
154
155
156
157
158
159
160
161
162
163
164
  * Minor improvements and updates
    - Add feedback when opening VeraCrypt Mounter (Closes: #16334).
    - Improve consistency in Additional Software's accessibility
      (Closes: #16110).
    - Fix missing accessibility support when opening a browser from a
      notification (Closes: #16475).
    - Refresh ublock-origin patch to apply cleanly on top of 1.18.4+dfsg-1
      (Closes: #16451)
    - Upgrade intel-microcode to 3.20180807a.2~deb9u1.
      Fixes CVE-2018-3615, CVE-2018-3620, CVE-2018-3646, CVE-2018-3639,
      CVE-2018-3640, CVE-2017-5753, CVE-2017-5754.
165

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
166
167
168
169
170
171
172
173
174
175
  * Build system
    - Lower memory requirements when building Tails by limiting the memory
      used by mksquashfs to 512M (Closes: #16177).
    - Remove obsolete check on Thunderbird addons (Closes: #16045).
    - Update Tails' APT GnuPG key expiration (Closes: #16420).
    - Optimize Git operations (share resources, fetch only the needed
      objects).
    - Clone submodules from the host's local repositories (Closes: #16476).
    - Drop useless manual initramfs update (Closes: #16452).
    - Add a sanity check on the size of the initramfs (Closes: #16452).
176

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
177
178
179
180
181
182
  * Test suite
    - Add automated tests for Additional Software GUI (Closes: #14576,
      #14596).
    - Add automated tests on the backup persistence configuration
      (Closes: #16461).
    - Adjust test for Thunderbird 60.5.1 (Closes: #16555).
183

184
 -- Tails developers <tails@boum.org>  Mon, 18 Mar 2019 23:40:50 +0100
185

186
tails (3.12.1) unstable; urgency=medium
anonym's avatar
anonym committed
187

188
  * Security fixes
189
    - Upgrade Tor Browser to 8.0.6 (MFSA-2019-05; Closes: #16437).
190
191
192
193
    - Upgrade LibreOffice to 1:5.2.7-1+deb9u5 (DSA-4381).
    - Upgrade cURL to 7.52.1-5+deb9u9 (DSA-4386).
    - Upgrade Qt 5 to 5.7.1+dfsg-3+deb9u1 (DSA-4374).
    - Upgrade OpenSSH to 1:7.4p1-10+deb9u5 (DSA-4387).
anonym's avatar
anonym committed
194

195
 -- Tails developers <tails@boum.org>  Tue, 12 Feb 2019 21:25:14 +0100
anonym's avatar
anonym committed
196

anonym's avatar
anonym committed
197
tails (3.12) unstable; urgency=medium
anonym's avatar
anonym committed
198

199
200
201
202
203
  * Major changes
    - Make the USB image the main supported way to install Tails (refs: #15292).
      On first boot, grow the system partition to a size that's a factor
      of the size of the boot medium and randomize GUIDs (Closes: #15319).
    - Upgrade Linux to 4.19, version 4.19.13-1 (Closes: #16073, #16224).
intrigeri's avatar
intrigeri committed
204
205
206
      Fixes CVE-2018-19985, CVE-2018-19406, CVE-2018-16862, CVE-2018-18397,
      CVE-2018-18397, CVE-2018-18397, CVE-2018-18397, CVE-2018-19824,
      CVE-2018-14625.
207
208
209
210
    - Remove Liferea (Closes: #11082, #15776).
    - Upgrade to the Debian Stretch 9.6 point-release.

  * Security fixes
211
    - Upgrade Tor Browser to 8.0.5 (MFSA-2019-02; Closes: #16388).
212
213
214
215
216
217
218
219
220
221
    - Upgrade Thunderbird to 60.4.0 (DSA-4362-1; Closes: #16261).
    - Upgrade OpenSSL to 1.0.2q-1~deb9u1 (DSA-4355-1).
    - Upgrade libarchive to 3.2.2-2+deb9u1 (DSA-4360-1).
    - Upgrade GnuTLS to 3.5.8-5+deb9u4 (CVE-2018-10844, CVE-2018-10845).
    - Upgrade libgd3 to 2.2.4-2+deb9u3 (CVE-2018-1000222, CVE-2018-5711).
    - Upgrade libmspack to 0.5-1+deb9u3 (CVE-2018-18584, CVE-2018-18585).
    - Upgrade libopenmpt to 0.2.7386~beta20.3-3+deb9u3 (CVE-2018-10017).
    - Upgrade libx11 to 2:1.6.4-3+deb9u1 (CVE-2018-14598, CVE-2018-14599,
      CVE-2018-14600).
    - Upgrade libxcursor to 1:1.1.14-1+deb9u2 (CVE-2015-9262).
anonym's avatar
anonym committed
222
    - Upgrade NetworkManager to 1.6.2-3+deb9u2+0.tails1 (CVE-2018-15688).
223
224
    - Upgrade wpa to 2:2.4-1+deb9u2 (CVE-2018-14526).
    - Upgrade zeromq3 to 4.2.1-4+deb9u1 (CVE-2019-6250).
225
226
    - Upgrade APT to 1.4.9 (DSA-4371-1).
    - Upgrade GhostScript to 9.26a~dfsg-0+deb9u1 (DSA-4372-1).
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255

  * Bugfixes
    - Fix Totem's access to the Internet when it's started from the Applications
      menu.
    - Rename HTP pools to avoid confusion (Closes: #15428).
    - Fix memory erasure on shutdown with systemd v239+, by mounting
      a dedicated tmpfs on /run/initramfs instead of trying to remount /run
      with the "exec" option (Closes: #16097).
    - Make the KeePassX wrapper dialog translatable.
    - Fix detection of first Thunderbird run.

  * Minor improvements and updates
    - Upgrade tor to 0.3.4.9-1~d90.stretch+1.
    - Upgrade Mesa to 18.2.6-1~bpo9+1, libdrm to 2.4.95-1~bpo9+1,
      and libglvnd to 1.1.0-1~bpo9+1.
    - Upgrade firmware-linux and firmware-nonfree to 20190114-1.
    - Upgrade amd64-microcode to 3.20181128.1.
    - Upgrade intel-microcode to 3.20180807a.2~bpo9+1.
    - Remove the boot readahead feature (Closes: #15915).
      In most supported use cases, it did not improve boot time anymore,
      or even increases it.
    - Require TLS 1.2 in our Upgrader and tails-security-check (Closes: 11815).
    - Enable O_CREAT restriction in /tmp directories for FIFOs and regular
      files (Closes: #16072).
    - Upgrade systemd to 240-4~bpo9+0tails1 (Closes: #16352).
      Fixes CVE-2018-16864, CVE-2018-16865, and CVE-2018-16866.
    - Upgrade Enigmail to 2.0.8-5~deb9u1 (Closes: #15657).
    - Upgrade Torbirdy to 0.2.6-1~bpo9+1 (Closes: #15661).
    - Modify Torbirdy configuration in a way that's easier to maintain.
intrigeri's avatar
intrigeri committed
256
257
    - Tell the user they need to use sudo when they attempt to use su
      (Closes: #15583).
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284

  * Build system
    - Make the build of the USB image reproducible (Closes: #15985).
    - Allow specifying which set of APT snapshots shall be used during
      the build, with the APT_SNAPSHOTS_SERIALS build option (Closes: #15107).
    - Fix more GIDs and display more information when changing UIDs or GIDs
      fails (Closes: #16036).
    - Remove obsolete patches, refresh remaining ones to apply on top
      of currently installed packages version.
    - Disable irrelevant recurring jobs in Vagrant build box (refs: #16177)
      that increase the chance of FTBFS due to mksquashfs being reaped
      by the OOM killer.
    - Adjust for recent GnuPG error'ing out when it has no controlling terminal.

  * Test suite
    - Adjust test suite for USB image:
      - Add tests that exercise behavior on first boot from a device
        installed using the USB image (Closes: #16003).
      - Drop tests for use cases we don't support anymore with the introduction
        of the USB image (refs: #16004).
      - Adjust remaining tests to focus on main supported use cases,
        i.e. Tails installed from a USB image (refs: #16004.
    - In scenarios where we simulate MAC spoofing failure, test safety-critical
      properties even if the desktop notification is buggy (refs: #10774).
    - Update expected title for our Redmine (Closes: #16237).
    - Update expected image for OpenPGP key search.

anonym's avatar
anonym committed
285
 -- Tails developers <tails@boum.org>  Mon, 28 Jan 2019 13:26:26 +0100
286

287
tails (3.11) unstable; urgency=medium
288

289
290
291
292
293
294
295
296
  * Security fixes
    - Upgrade Tor Browser to 8.0.4-build2 (Closes: #16193).
    - Upgrade Thunderbird to 60.3.0-1~deb9u1.0tails1 (Closes: #16118).
    - Thunderbird: unconditionally disable Autocrypt, as it is not safe in
      its current state (See: #15923, Closes: #16186).
    - Upgrade Linux to 4.18.20 and aufs to 4.18.11+-20181119
      (Closes: #16145).
    - Upgrade cURL to 7.52.1-5+deb9u8 (DSA-4331).
297
    - Upgrade Ghostscript to 9.26~dfsg-0+deb9u1 (DSA-4336, DSA-4346).
298
299
300
301
302
303
304
    - Upgrade Perl to 5.24.1-3+deb9u5 (DSA-4347).
    - Upgrade Policykit to 0.105-18+deb9u1 (DSA-4350).
    - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u4 (DSA-4345).
    - Upgrade OpenSSL to 1.1.0j-1~deb9u1 (DSA-4348).
    - Upgrade libtiff to 4.0.8-2+deb9u4 (DSA-4349).

  * Bugfixes
305
306
307
308
309
310
311
    - Tails Upgrader:
      · Improve support for incremental upgrades to avoid issues with
        partially applied upgrades (Closes: #14754).
      · Add a prompt after the IUK has been downloaded so the user can
        control when the network will be disabled; previously this was
        done without users having a say, possibly leading to confusion and
        lost work (Closes: #15282).
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
    - Thunderbird: always set locale according to environment (Closes: #16113).

  * Minor improvements and updates
    - Remove packages which were needed for getTorBrowserUserAgent
      (Closes: #16024).
    - Fix persistence configuration window opening on full screen
      (Closes: #15894).
    - Time sync: don't temporarily increase tor's log level when using
      bridges/PTs (Closes: #15743).
    - Warn about non-free software depending on the host operating system
      and/or virtualization stack (Closes: #16195).

  * Build system
    - Create USB image after building the ISO, and include it in build
      artifacts (Closes: #15984, #15985, #15990).
    - Release process: adapt to IDF v2 (Closes: #16171).

  * Test suite
    - Add new Using "VeraCrypt encrypted volumes" feature, with scenarios
      split into two parts: "Unlock VeraCrypt Volumes" and "GNOME Disks"
      (Closes: #14469, #14471, #15238, #15239).
    - Reintroduce "Clock is one day in the future in bridge mode" test
      (Closes: #15743).
    - Make starting apps via GNOME Activities Overview more robust
      (Closes: #13469).
    - Check for "Upgrading the system" and adjust to "Upgrade successfully
      downloaded" new UI (See: #14754, #15282).
339

340
 -- Tails developers <tails@boum.org>  Mon, 10 Dec 2018 20:37:06 +0100
341

342
tails (3.10.1) unstable; urgency=medium
343

Cyril 'kibi' Brulebois's avatar
Cyril 'kibi' Brulebois committed
344
  * Declare that Enigmail is compatible with Thunderbird 60.*.
345

346
 -- Tails developers <tails@boum.org>  Tue, 23 Oct 2018 01:30:00 +0200
347

348
tails (3.10) unstable; urgency=medium
anonym's avatar
anonym committed
349

350
351
352
353
354
  * Security fixes
    - Harden sudo config to avoid potential future privilege escalation
      (Closes: #15829).
    - Upgrade Linux to 4.18 and aufs to 4.18-20181008 (Closes: #15936).
    - Upgrade the snapshot of the Debian archive to 2018100901 accordingly.
355
    - Upgrade Tor Browser to 8.0.3-build1 (Closes: #16067).
356
    - Upgrade Thunderbird to 60.2.1 (Closes: #16037).
357
358
359
360
361
362
363
364

  * Bugfixes
    - Fix installation of mesa/stretch-backports by installing libwayland*
      from stretch-backports (Closes: #15846).
    - Tor Browser AppArmor profile patch: update to apply cleanly on top
      of torbrowser-launcher 0.2.9-5.
    - Additional Software: fix issues spotted during the code review
      (Closes: #15838).
365
366
    - Additional Software: make sure to offer persistence only for newly
      installed packages, avoiding inconsistency (Closes: #15983).
367
368
369
370
371
372
373
    - Improve button labels in confirmation dialogs of the Tails installer
      (Closes: #11501).
    - Hardcode User Agent in htpdate.user-agent (Closes: #15912), as the
      Tor Browser doesn't expose it anymore.
    - Fix encoding-related crashes in Tails Installer (Closes: #15166).
    - Set the Firefox preferences to spoof English, to avoid leaking
      information about locale settings (Closes: #16029).
374
375
376
377
    - VeraCrypt: Hide PIM entries in GNOME Shell and Disks, since a newer
      cryptsetup would be needed (Closes: #16031).
    - VeraCrypt: Fix support for multiple encryption, by iterating over
      all children in the device-mapper tree (Closes: #15967).
378
379
380
    - Update translations.

  * Minor improvements and updates
381
382
    - Add dmsetup and losetup output in WhisperBack reports to help debug
      VeraCrypt-related issues (Closes: #15966).
383
384
385
386
387
    - Let AppArmor allow access to /usr/local/share/mime, reducing noise
      in logs due to many DENIED entries (Closes: #15965).
    - Use proper stem.connection module in onion-grater instead of trying
      to read the auth cookie manually: that's fragile and breaks some use
      cases (e.g. custom auth cookie).
388
    - Unlock VeraCrypt Volumes: Improve internationalization support.
389
390
391
392
393
394

  * Test suite
    - Ensure the test suite doesn't break when changing the headline of
      /home (Closes: #12156).
    - Update test suite for updated button labels in confirmation dialogs
      of the Tails installer (Closes: #11501).
anonym's avatar
anonym committed
395

396
 -- Tails developers <tails@boum.org>  Tue, 23 Oct 2018 01:30:00 +0200
anonym's avatar
anonym committed
397

anonym's avatar
anonym committed
398
tails (3.9.1) unstable; urgency=medium
399

400
401
  * Security fixes
    - Upgrade Tor Browser to 8.0.2, based on Firefox 60.2.1 (Closes: #16017).
anonym's avatar
anonym committed
402
403
    - Upgrade Thunderbird to 60.0-3~deb9u1.0tails2 (Closes: #15959). Also
      imported the same security fixes that caused Tor Browser 8.0.2.
404
405
406
407
408
409
410
411
412
    - Upgrade curl to 7.52.1-5+deb9u7 (DSA-4286).
    - Upgrade Ghostscript to 9.20~dfsg-3.2+deb9u5 (DSA-4294).
    - Upgrade libarchive-zip-perl to 1.59-1+deb9u1 (DSA-4300).
    - Upgrade libkpathsea6 to 2016.20160513.41080.dfsg-2+deb9u1 (DSA-4299).
    - Upgrade LittleCMS 2, aka. liblcms2-2, to 2.8-4+deb9u1 (DSA-4284).
    - Upgrade Python 2.7 to 2.7.13-2+deb9u3 (DSA-4306).
    - Upgrade Python 3.5 to 3.5.3-1+deb9u1 (DSA-4307).

  * Bugfixes
anonym's avatar
anonym committed
413
414
415
    - Make Thunderbird translated in non-English locales via
      intl.locale.requested, which works correctly since 60.0-3
      (Closes: #15942).
416
417
418
    - Totem: backport AppArmor profile fix to allow opening the help
      (Closes: #15841)
    - Remove mutt, that was accidentally installed in 3.9 (Closes: #15904).
sajolida's avatar
sajolida committed
419
    - Fix VeraCrypt volumes not being opened in GNOME Files (Closes: #15954).
420
421
422
423
424
425
426
    - Fix displaying the "General" section in the Tor Browser preferences
      (Closes: #15917).
    - Fix APT pinning at Tails runtime for our custom APT repository
      and for Debian backports (Closes: #15837, #15973).

  * Minor improvements and updates
    - Upgrade tor to 0.3.4.8-1~d90.stretch+1 (Closes: #15889).
427

anonym's avatar
anonym committed
428
 -- Tails developers <tails@boum.org>  Wed, 03 Oct 2018 12:12:33 +0200
429

intrigeri's avatar
intrigeri committed
430
tails (3.9) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
431

intrigeri's avatar
intrigeri committed
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
  * Major changes
    - Upgrade Tor Browser to 8.0 (Closes: #15803, #15907).
      Notable user-visible changes and relevant details:
      · Adjust to the fact Tor Browser 8.0a10 replaces firefox with a wrapper.
      · Don't use the bundled copy of libstdc++.so.6, ours is recent enough.
      · Drop obsolete Torbutton prefs (Closes: #15706).
      · Switch back to 128px icons (Closes: #15081).
      · AppArmor profile: take into account new Firefox binary path.
    - Upgrade Thunderbird to 60.0 (Closes: #15792).
      Notable user-visible changes and relevant details:
      · AppArmor profile: patch to avoid conflicting x modifiers for ps(1).
    - Upgrade tor to 0.3.4.7-rc (Closes: #15772).

  * Security fixes
    - Upgrade Linux to 4.17.17-1 and intel-microcode to 3.20180807a.1
      This fixes CVE-2018-3620 aka. Foreshadow aka. L1 Terminal Fault
      (Closes: #15796).
    - Upgrade OpenSSH to 1:7.4p1-10+deb9u4 (DSA-4280).

  * Bugfixes
    - Fix Totem on Intel graphics cards by inlining the backported mesa
      and dri-enumerate abstractions into its AppArmor profile: they are needed
      with recent Mesa and libdrm (Closes: #15821). Regression introduced
      in 3.9~rc1.
    - Fix unlocking "hidden" TrueCrypt/VeraCrypt volumes via GNOME Shell
      (Closes: #15843).
    - Fix confusing error message when unlocking TrueCrypt/VeraCrypt volumes
      (Closes: #15733).
    - Revert to Stretch's X.Org nouveau video driver (Closes: #15833).
      It seems that the regression brought by the upgraded one
      is worse than the improvements reported after our call for testing.
      Regression introduced in 3.9~rc1.
    - Use the intel X.Org driver for Intel Corporation UHD Graphics 620.
    - Fix regressions introduced in 3.9~rc1 in/by Additional Software Packages:
      · Don't break new empty persistence configuration files creation when
        permissions are incorrect (Closes: #15802).
      · Fix UX when the user has specified a distribution or version
        for a given package in their live-additional-software.conf
        (Closes: #15822).
      · Don't show installation notifications on upgrade (Closes: #15879).
    - Make more Additional Software Packages strings translatable in the
      configuration dialog and PolicyKit messages.

  * Minor improvements and updates
    - Upgrade firmware-nonfree to 20180825-1.
    - Update the deb.torproject.org APT repository signing key.
    - Unlock VeraCrypt Volumes: add disclaimer (Closes: #15849).

  * Test suite
    - Update Thunderbird test suite for 60.0 (Closes: #15791).
    - Fix various robustness issues.
    - Make the Chutney nodes use a higher V3AuthVotingInterval to make client
      bootstrap more robust (Closes: #15799).
    - Update the Tor Launcher binary path.
    - Adjust to the fact "New Circuit for this Site" is now in the site
      information and not under the Torbutton anymore.
    - Delete unused images.
intrigeri's avatar
intrigeri committed
489

intrigeri's avatar
intrigeri committed
490
 -- Tails developers <tails@boum.org>  Tue, 04 Sep 2018 12:15:43 +0000
intrigeri's avatar
intrigeri committed
491

intrigeri's avatar
intrigeri committed
492
tails (3.9~rc1) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
493

intrigeri's avatar
intrigeri committed
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
  * Major changes
    - Integrate the Additional Software Packages feature into the desktop
      and revamp the interface of "Configure Persistent Volume".
    - Support TrueCrypt/VeraCrypt encrypted volumes on the desktop.
    - Upgrade Tor Browser to 8.0a9, based on Firefox 60 ESR (Closes: #15023).
      Notable user-visible changes and relevant details:
      · Drop search engine customization and stick to Tor Browser's defaults.
      · Upgrade uBlock Origin to its WebExtension version and now rely
        on the filter lists shipped in the Debian package.
      · Tweak the number of web content processes to work better with 2 GiB
        of RAM (Closes: #15716).
      · Revamp how we're handling our custom prefs, drop obsolete ones,
        reduce our delta with pristine Tor Browser.
    - Upgrade Thunderbird to 60.0b10 (Closes: #15091). Notable details:
      · Install Torbirdy 0.2.5 from stretch-backports and drop our patches
        that were merged upstream.
      · Enable the optional part of the fixes for EFAIL (Closes: #15602).
    - Upgrade Linux to 4.17 (Closes: #15763).
    - Upgrade tor to 0.3.4.6-rc (Closes: #15770).
    - Upgrade to Debian Stretch 9.5.
bertagaz's avatar
bertagaz committed
514

intrigeri's avatar
intrigeri committed
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
  * Security fixes
    - Upgrade CUPS to 2.2.1-8+deb9u2 (DSA-4243).
    - Upgrade Exiv2 to 0.25-3.1+deb9u1 (DSA-4238).
    - Upgrade FUSE to 2.9.7-1+deb9u1 (DSA-4257).
    - Upgrade GDM to 3.22.3-3+deb9u2 (DSA-4270).
    - Upgrade libsoup to 2.56.0-2+deb9u2 (DSA-4241).
    - Upgrade Imagemagick to 8:6.9.7.4+dfsg-11+deb9u5 (DSA-4245).
    - Upgrade ffmpeg to 7:3.2.12-1~deb9u1 (DSA-4258, DSA-4249).
    - Upgrade libmspack to 0.5-1+deb9u2 (DSA-4260).
    - Upgrade Samba to 2:4.5.12+dfsg-2+deb9u3 (DSA-4271).
    - Upgrade the Apache XML Security for C++ library to 1.7.3-4+deb9u1
      (DSA-4265).

  * Bugfixes
    - Don't display the Enigmail configuration wizard in every Tails session
      (Closes: #15693, #15746). Fix against Tails 3.8.
    - Make the torstatus GNOME Shell extension actually translatable
      (Closes: #15715). Fix against the first Tails release that included
      this extension.
    - Drop Icedove → Thunderbird migration code which started causing trouble.
    - Tails Installer:
      · Link to upgrade documentation when upgrading (Closes: #7904).
      · Show the reinstall option only when the device is big enough to make
        a full reinstallation (Closes: #14810).
      · Make the main window fit in a 600px-high screen (Closes: #14849).
      · Show the correct device size in the reinstall confirmation dialog
        (Closes: #15590).
    - Tails Greeter: don't display file:/// URLs to users (Closes: #15582).

  * Minor improvements and updates
    - Install Mesa and libdrm* from stretch-backports and upgrade the Nouveau
      X.Org video driver to 1.0.15. This improves support for some graphics
      cards such as NVIDIA Pascal series (Closes: #14910)
    - htpdate: improve diagnostics output when the date header can't be fetched.
    - Onion Grater: support named AppArmor profiles.
    - Update Onion Grater's config for new Tor Browser AppArmor profile name.
    - Enable e10s in the Unsafe Browser.
    - Delete all search plugins for the Unsafe Browser (Closes: #15708).
    - Display a deprecation warning when starting Liferea (#11082).
    - Upgrade VirtualBox guest modules to 5.2.16-dfsg-3~bpo9+2.
    - Use Tor Browser for browsing the documentation even when offline
      (Closes: #15720).
    - Provide feedback while Tor Browser, "Tails documentation"
      or "Report an error" are starting (Closes: #15101).
    - WhisperBack: remove the right pane (Closes: #7180).
    - tails-debugging-info: return machine-readable, structured data.
      Adjust WhisperBack accordingly (Closes: #8514). This paves the way
      towards more usable bug reports (#8722).
    - Port lots of our Perl code to more lightweight libraries.
564
565
      This decreases the amount of memory used by the persistence
      configuration interface.
intrigeri's avatar
intrigeri committed
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
    - Do not hide applications that require an admin password (Closes: #11013).
    - Try unlocking every persistent volume when multiple ones are
      available (Closes: #15653).
    - Upgrade Electrum to 3.1.3-1~bpo9+1.
    - Upgrade most firmware to 20180518-1.
    - Upgrade Intel microcode to 3.20180703.2~bpo9+1.
    - Upgrade AMD microcode to 3.20180524.1.

  * Build system
    - Drop AppArmor feature set pinning: this is now done in Debian Stretch
      (Closes: #15341).
    - Remove the now unused deb.torproject.org sid APT source (Closes: #15638).
    - Install OnionShare from our custom APT repo instead of from sid.
      We've mistakenly tracked sid for a while and it has become a problem,
      so stick to the version that works for us until Tails 4.0.
    - Fix building the ISO on zfs by dropping the cache=none setting for
      vmproxy's storage (Closes: #14404).
    - Update the Vagrant basebox for any change under vagrant/.
      Previously, some relevant changes were not effective until something under
      vagrant/definitions/tails-builder/ was changed.
    - Make intltool ignore .py files: `intltool-update --maintain` seems to be
      buggy with .py files.
    - Refresh our CUPS AppArmor profile patch to apply on 2.2.1-8+deb9u2.
    - Make it more obvious that the .orig file check is fatal (Closes: #15727).
    - Delete baseboxes once they're 6 months old instead of 4.
      This is more in line with the delay between our major releases these days.
    - Rename /usr/share/amnesia to /usr/share/tails. It was about time.
    - Abort the build if /etc/{passwd,group} has changed (Closes: #15419).
      Such changes can break Tails after an automatic upgrade was applied
      so let's detect it ASAP. Consequently, ensure a few GIDs  that wanted
      to play musical chairs  are the same as in Tails 3.8 (Closes: #15695).
597
598
    - Don't fail the build if the APT lists don't include any package
      whose name matches ^geoclue.
intrigeri's avatar
intrigeri committed
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628

  * Test suite
    - Adjust to the new tails-persistence-setup API.
    - Update the Tor Browser's AppArmor profile name.
    - Re-enable the "I can print the current page […]" test.
    - Update tests wrt. the fact tails-upgrade-frontend-wrapper was ported
      to Python (Closes: #15379).
    - Make a test more robust by waiting for the page to have loaded.
    - Adjust to the fact the WhisperBack debugging info is now configured
      in a machine-readable file.
    - Remove test for tails-debugging-info, that has been a no-op for a while.
    - Adjust for Tor Browser 8.
    - Make the "I open the address" step more robust and accordingly
      stop marking the tests that use it in the Unsafe Browser
      as fragile (refs: #14771).
    - De-duplicate a number of images of standard GTK+ 3 widgets.
    - Make the audio and WebM tests more robust.
    - Make the "I start the Tor Browser in offline mode" step more robust.
    - Make the "AppArmor has (not )? denied" step more robust.
    - Don't try and use XVFB_PID if it's not set (Closes: #15730).
    - Adjust Pidgin test to use a certificate that's still in Debian
      (Closes: #15762).
    - Use a hopefully more reliable public GnuPG key and make tests
      more robust against new subkeys being added (Closes: #15771).
    - Stop hard-coding the list of RTL Tor Browser locales.
    - Fix the "Unsafe Browser can be used in all languages supported in Tails"
      test for locales that have a translated homepage (Closes: #11711).
    - Take into account that apt(8) won't return when run in the remote shell
      with the ASP hooks enabled.

intrigeri's avatar
intrigeri committed
629
 -- Tails developers <tails@boum.org>  Thu, 16 Aug 2018 18:37:47 +0000
intrigeri's avatar
intrigeri committed
630

intrigeri's avatar
intrigeri committed
631
tails (3.8) unstable; urgency=medium
intrigeri's avatar
intrigeri committed
632

intrigeri's avatar
intrigeri committed
633
  * Security fixes
intrigeri's avatar
intrigeri committed
634
    - Upgrade Tor Browser to 7.5.6 (MFSA 2018-17; Closes: #15683).
intrigeri's avatar
intrigeri committed
635
636
637
638
639
640
641
642
643
644
645
646
647
    - Upgrade Enigmail to 2.0.7 (partly fixes #15602 aka. EFAIL).
    - Upgrade libgcrypt to 1.7.6-2+deb9u3 (DSA-4231-1).
    - Upgrade perl to 5.24.1-3+deb9u4 (DSA-4226-1).

  * Bugfixes
    - Thunderbird: fix importing public OpenPGP keys from email attachments
      (Closes: #15610).
    - Make the Unsafe Browser home page translatable again (Closes: #15461).

  * Minor improvements
    - Don't display the "Know your rights" message on Thunderbird first run.
    - Move Thunderbird's default userChrome.css to /etc/thunderbird, just like
      we do for Tor Browser, for easier upgrade handling.
intrigeri's avatar
intrigeri committed
648

intrigeri's avatar
intrigeri committed
649
 -- Tails developers <tails@boum.org>  Mon, 25 Jun 2018 09:59:22 +0000
intrigeri's avatar
intrigeri committed
650

intrigeri's avatar
intrigeri committed
651
tails (3.7.1) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
652

intrigeri's avatar
intrigeri committed
653
  * Security fixes
intrigeri's avatar
intrigeri committed
654
    - Upgrade Tor Browser to 7.5.5 (MFSA 2018-14; closes: #15643).
intrigeri's avatar
intrigeri committed
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
    - Upgrade Thunderbird to 52.8.0 (DSA-4209-1; Closes: #15607).
      - Partially fixes EFAIL.
      - Fixes importing OpenPGP keys from keyservers with Enigmail.
      - Accordingly refresh our Thunderbird AppArmor profile patch.
    - Upgrade cURL to 7.52.1-5+deb9u6 (DSA-4202-1).
    - Upgrade GnuPG (modern) 2.1.18-8~deb9u2 (DSA-4222-1).
    - Upgrade GnuPG (legacy) to 1.4.21-4+deb9u1 (DSA-4223-1).
    - Upgrade Git to 1:2.11.0-3+deb9u3 (DSA-4212-1).
    - Upgrade PackageKit to 1.1.5-2+deb9u1 (DSA-4207-1).
    - Upgrade procps to 2:3.3.12-3+deb9u1 (DSA-4208-1).
    - Upgrade wavpack to 5.0.0-2+deb9u2 (DSA-4197-1).
    - Upgrade wget to 1.18-5+deb9u2 (DSA-4195-1).
    - Upgrade xdg-utils to 1.1.1-1+deb9u1 (DSA-4211-1).

  * Bugfixes
    - Fix setting a screen locker password with non-ASCII characters
      (Closes: #15636).
    - WhisperBack:
      - Rename the WhisperBack launcher to "WhisperBack Error Reporting"
        so that users have a better chance to understand what it does
        (Closes: #6432)
      - Ensure debugging info in Whisperback reports don't contain email
        signature markers so that email clients forward it in full
        (Closes: #15468).
      - Wrap text written by the user to 70 chars (Closes: #11689).

  * Minor improvements
    - The "Tails documentation" desktop launcher now opens /doc instead of
      the aging /getting_started that confused people during user testing
      (Closes: #15575).

  * Test suite
    - Update to match "Tails documentation" behaviour change.
bertagaz's avatar
bertagaz committed
688

intrigeri's avatar
intrigeri committed
689
 -- Tails developers <tails@boum.org>  Sat, 09 Jun 2018 19:53:51 +0000
bertagaz's avatar
bertagaz committed
690

bertagaz's avatar
bertagaz committed
691
tails (3.7) unstable; urgency=medium
anonym's avatar
anonym committed
692

bertagaz's avatar
bertagaz committed
693
  * Security fixes
bertagaz's avatar
bertagaz committed
694
    - Upgrade Tor Browser to 7.5.4 (MFSA 2018-12, Closes: #15588).
bertagaz's avatar
bertagaz committed
695
696
697
698
699
700
701
702
703
    - Upgrade OpenSSL to 1.1.0f-3+deb9u2 (DSA-4157).
    - Upgrade Perl to 5.24.1-3+deb9u3 (DSA-4172).
    - Upgrade Libre Office to 1:5.2.7-1+deb9u4 (DSA-4178).
    - Upgrade libmad to 0.15.1b-8+deb9u1 (DSA-4192).

  * Bugfixes
    - Enable the removal of OpenPGP keyblock in Whisperback (closes: #7797).
    - Show the logo in Whisperback's About menu (closes: #13198).
    - Use the same font in all the Whisperback report (Closes: #11272).
704
    - Update tails-bugs@tails.boum OpenPGP key (Closes: #15534).
bertagaz's avatar
bertagaz committed
705
706
707
708

  * Minor improvements
    - Stop installing python-qt4 and python-trezor (Closes: #15391).
    - Make WhisperBack easier to find in the GNOME Overview (Closes: #13299).
anonym's avatar
anonym committed
709

bertagaz's avatar
bertagaz committed
710
 -- Tails developers <tails@boum.org>  Tue, 08 May 2018 01:47:22 +0200
anonym's avatar
anonym committed
711

anonym's avatar
anonym committed
712
tails (3.6.2) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
713

anonym's avatar
anonym committed
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
  * Security fixes
    - Upgrade Tor Browser to 7.5.3 (MFSA 2018-10, Closes: #15459).
    - Upgrade Thunderbird to 1:52.7.0-1~deb9u1.0tails1 (DSA-4155,
      Closes: #15471).
    - Upgrade libicu to 57.1-6+deb9u2 (DSA-4150).
    - Upgrade intel-microcode to 3.20180312.1~bpo9+1. Implements
      IBRS/IBPB/STIPB support, Spectre-v2 mitigation for: Sandybridge,
      Ivy Bridge, Haswell, Broadwell, Skylake, Kaby Lake, Coffee Lake
      (Closes: #15173).

  * Bugfixes
    - Tor Browser AppArmor profile:
     * Grant the main Firefox process access to machine-id: needed for
       IBus support (Closes: #15437).
     * Allow access to extensions installed by the user such as Tails
       Verification (Closes: #15434).
    - Remove packages needed to support Video Acceleration API
      (VA-API) because they breaks opening GNOME Settings and Totem in
      Tails 3.6 on some computers (only NVIDIA for now but perhaps
      other hardware is affected). (Closes: #15433, #15449)
    - Upgrade Linux to 4.15.11-1 and bump the aufs submodule (Closes:
      #15456, #15457).
    - tails-documentation script:
      * open translated documentation page in Tor Browser when online
        (Closes: #15371).
      * use documented syntax for os.execv (Refs: #15332)
      * re-add support for passing a HTML anchor as the second
        argument.
    - Fix issue where the tails-persistence-setup user's guid would be
      changed when it was the uid that was intended (Closes: #15422).
bertagaz's avatar
bertagaz committed
744

anonym's avatar
anonym committed
745
 -- Tails developers <tails@boum.org>  Thu, 29 Mar 2018 17:49:42 +0200
bertagaz's avatar
bertagaz committed
746

intrigeri's avatar
intrigeri committed
747
tails (3.6.1) unstable; urgency=medium
748

intrigeri's avatar
intrigeri committed
749
750
751
752
753
754
755
756
  * Security fixes
    - Upgrade Tor Browser to 7.5.2 (MFSA 2018-08 i.e. CVE-2018-5146).
    - Upgrade libvorbis to 1.3.5-4+deb9u2 (DSA 4140-1 aka. CVE-2018-5146).
    - Upgrade curl to 7.52.1-5+deb9u5 (DSA 4136-1).
    - Upgrade samba to 2:4.5.12+dfsg-2+deb9u2 (DSA 4135-1).

  * Bugfixes
    - Fix ISO build reproducibility (Closes: #15400)
intrigeri's avatar
intrigeri committed
757
758
759
    - Disable Selfrando: Tor Browser upstream currently enables it only
      in non-release builds
      (https://trac.torproject.org/projects/tor/ticket/24912#comment:8).
760

intrigeri's avatar
intrigeri committed
761
 -- Tails developers <tails@boum.org>  Fri, 16 Mar 2018 22:42:00 +0000
762

bertagaz's avatar
bertagaz committed
763
tails (3.6) unstable; urgency=medium
bertagaz's avatar
bertagaz committed
764

root's avatar
root committed
765
  * Major changes
bertagaz's avatar
bertagaz committed
766
    - Upgrade Tor Browser to 7.5.1.
767
    - Upgrade Tor to 0.3.2.10. (Closes: #15158)
intrigeri's avatar
intrigeri committed
768
    - Add ability to lock the screen. (Closes: #5684)
769
    - Add initial support for Meek bridges. (Closes: #8243)
root's avatar
root committed
770
771
772
    - Upgrade to Thunderbird 52.6.0. (Closes: #15298)
    - Enable Thunderbird AppArmor profile. (Closes: 11973)
    - Upgrade Linux to 4.15.0-1. (Closes: #15309).
intrigeri's avatar
intrigeri committed
773
    - Upgrade systemd to 237.
root's avatar
root committed
774
    - Upgrade Electrum to 3.0.6. (Closes: #15022)
bertagaz's avatar
bertagaz committed
775
776
    - Upgrade the base system to the Debian Stretch 9.4 point-release
      (Closes: #15341)
777
    - Port a few shell scripts to Python thanks to GoodCrypto. (Closes: #11198)
anonym's avatar
anonym committed
778

root's avatar
root committed
779
780
781
  * Security fixes
    - Upgrade Intel processor microcode firmware. (Closes: #15173).
    - Upgrade poppler to 0.48.0-2+deb9u1. (CVE-2017-14929, CVE-2017-1000456)
bertagaz's avatar
bertagaz committed
782
    - Upgrade tiff to 4.0.8-2+deb9u2 (CVE-2017-9935, CVE-2017-11335,
root's avatar
root committed
783
784
785
786
      CVE-2017-12944, CVE-2017-13726, CVE-2017-13727, CVE-2017-18013)
    - Upgrade ffmpeg to 7:3.2.10-1~deb9u1. (CVE-2017-17081)
    - Upgrade libtasn1-6 to 4.10-1.1+deb9u1. (CVE-2017-10790, CVE-2018-6003)
    - Upgrade Libre Office to 1:5.2.7-1+deb9u2. (CVE-2018-6871)
bertagaz's avatar
bertagaz committed
787
    - Upgrade libvorbis to 1.3.5-4+deb9u1. (CVE-2017-14632, CVE-2017-14633)
root's avatar
root committed
788
    - Upgrade gcc to 6.3.0-18+deb9u1.
bertagaz's avatar
bertagaz committed
789
790
791
    - Upgrade util-linux to 2.29.2-1+deb9u1. (CVE-2018-7738)
    - Upgrade isc-dhcp to 4.3.5-3+deb9u1 (CVE-2017-3144, CVE-2018-5732,
      CVE-2018-5733)
root's avatar
root committed
792
793

  * Minor improvements
794
795
796
    - Avoid noisy warning at boot time by creating tails-upgrade-frontend's
      trusted GnuPG homedir with stricter permissions, then making it looser.
      (Closes: #7037)
root's avatar
root committed
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
    - Drop (broken) Thunderbird dedicated SocksPort. (Closes: #12460)
    - Drop customized update-ca-certificates.service. (Closes: #14756)
    - Update AppArmor cupsd profile. (Closes: #15029)
    - Improve UX when GDM does not start. (Closes: #14521)
    - Install packages needed to support Video Acceleration API.
      (Closes: #14580)
    - Upgrade aufs-dkms for Linux 4.15. (Closes: #15132).
    - Ship pdf-redact-tools, thanks to dachary <loic@dachary.org>.
      (Closes: #15052)
    - Additional Software Packages: convert to python3 and PEP-8.
      (Closes: #15198)
    - Additional Software Packages: do not check for updates every time the
      network gets reconnected. (Closes: #9819)
    - Revert to xorg-xserver from Stretch. (Closes: #15232)
    - Open Tails documentation in Tor Browser when online. (Closes: #15332)
    - Disable Enigmail's Memory Hole feature. (Closes: #15201)
    - Persistence Setup: stop depending on Synaptic. (Closes: #15263)

  * Bugfixes
    - Additional Software Packages: fix the "incomplete online upgrade
      process" bug in offline mode (Closes: #14570)
    - Additional Software Packages: do not block Desktop opening.
      (Closes: #9059)
    - Install OpenPGP Applet 1.1. (Closes: #6398).
    - Repair rng-tools using a real start-stop-daemon program.
      (Closes: #15344)
    - Tails installer: fix bug with unicode status messages. (Closes: #15254)
anonym's avatar
anonym committed
824

root's avatar
root committed
825
826
827
  * Build system
    - Abort if tails-custom-apt-sources failed.
    - Abort the ISO build when DKMS modules are not built. (Closes: #14789).
828
    - Improve how we track dependencies in build hooks. (Closes: #14818)
root's avatar
root committed
829
830
831
832
    - Fix (potential) rare race condition during build.
    - Ensure the SquashFS has /etc/hostname properly configured.
      (Closes: #15322)
    - Bump builder VM's RAM. (Closes: #15310)
anonym's avatar
anonym committed
833

root's avatar
root committed
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
  * Test suite
    - Log the list of systemd jobs when systemctl is-system-running fails.
      (Closes: #14772).
    - Allow more time for 'systemctl is-system-running' to succeed.
    - Only support SikuliX, not Sikuli.
    - Disable SPICE clipboard sharing.
    - Don't flood the debug logger with the journal contents.
    - Rescue exception.
    - Enter a name into the Thunderbird account configuration.
      (Closes: #11256)
    - Fix the "I do not see ..." step's case. (Closes: #14929)
    - Mark scenarios that use the "The Report an Error launcher will…" step
      as fragile (Closes: #15321)
    - Test that Tor Browser opens docs when online. (Closes: #15332)
    - Adapt test after warning moved to after Unsafe Browser verification
      dialog. (Closes: #8775)
    - Dogtailify electrum.feature.
    - Add additional software packages feature. (Closes: #14572)
intrigeri's avatar
intrigeri committed
852
    - Disable test that is broken due to a Tor Browser bug. (refs: #15336)
anonym's avatar
anonym committed
853

bertagaz's avatar
bertagaz committed
854
 -- Tails developers <tails@boum.org>  Mon, 12 Mar 2018 21:28:29 +0100
anonym's avatar
anonym committed
855

anonym's avatar
anonym committed
856
tails (3.5) unstable; urgency=medium
anonym's avatar
anonym committed
857

anonym's avatar
anonym committed
858
859
860
  * Security fixes
    - Upgrade amd64-microcode to 3.20171205.1, for the mitigation
      against Spectre (CVE-2017-5715) (Closes: #15148).
anonym's avatar
anonym committed
861
    - Upgrade Tor Browser to 7.5-build3 (Closes:  #15197).
anonym's avatar
anonym committed
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
    - Upgrade Thunderbird to 1:52.5.2-2~deb9u1.0tails1 (Closes: #15033)
    - Upgrade gdk-pixbuf to 2.36.5-2+deb9u2.0tails1 (Closes: #15177).
    - Upgrade bind9 to 1:9.10.3.dfsg.P4-12.3+deb9u4.
    - Upgrade libxml2 to 2.9.4+dfsg1-2.2+deb9u2.

  * Minor improvements
    - Upgrade Linux to 4.14.13, which is the first kernel that has the
      "[x86] microcode/AMD: Add support for fam17h microcode loading"
      commit, that's needed to load the AMD fam17h microcode for
      mitigating the Spectre vulnerability (CVE-2017-5715).

  * Bugfixes
    - Drop Claws Mail persistence setting migration. Whenever
      persistent Claws Mail setting is enabled, this creates an empty
      ~/.icedove/ directory, that prevents Thunderbird from starting
      (Closes: #12734).
intrigeri's avatar
intrigeri committed
878
    - Don't prevent the GNOME Applications button from opening its menu if
anonym's avatar
anonym committed
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
      time syncing resulted in a shift back in time (Closes: #14250).
    - Tails Installer: when cloning Tails to another USB drive, check
      if the target device has enough space *before* any destructive
      actions are made (Closes: #14622).
    - Tor Browser: make "Print to file" work again, for all locales
      (Closes: #13403, #15024).

  * Build system
    - Fix option passed to cmp: -q is not supported but --quiet is.
      Spotted on feature/buster that's the first branch that exercises
      this code, but there's no reason to fix it only there.

  * Test suite
    - Adapt tests for Tor Launcher 0.2.14.3, i.e. the one shipped with
      Tor Browser 7.5 in Tails 3.5 (Closes: #15064).
    - Add support for creating arbitrarily sized partitions.
    - Add a "Try cloning Tails to a too small partition" scenario
      (regression test for #14622).
anonym's avatar
anonym committed
897

anonym's avatar
anonym committed
898
 -- Tails developers <tails@boum.org>  Tue, 23 Jan 2018 00:57:58 +0100
anonym's avatar
anonym committed
899

anonym's avatar
anonym committed
900
tails (3.4) unstable; urgency=medium
anonym's avatar
anonym committed
901

anonym's avatar
anonym committed
902
  * Security fixes
903
    - Install Linux 4.14.0-3 from sid (Closes: #14976). This enables
904
      the kernel-side mitigations for Meltdown.
anonym's avatar
anonym committed
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
    - Upgrade curl to 7.52.1-5+deb9u3.
    - Upgrade enigmail to 2:1.9.9-1~deb9u1.
    - Upgrade gimp to 2.8.18-1+deb9u1.
    - Upgrade imagemagick to 8:6.9.7.4+dfsg-11+deb9u4.
    - Upgrade libav (ffmpeg) to 7:3.2.9-1~deb9u1.
    - Upgrade libxcursor to 1:1.1.14-1+deb9u1.
    - Upgrade libxml-libxml-perl to 2.0128+dfsg-1+deb9u1.
    - Upgrade poppler to 0.48.0-2+deb9u1.
    - Upgrade rsync to 3.1.2-1 3.1.2-1+deb9u1.
    - Upgrade samba to 2:4.5.12+dfsg-2+deb9u1.
    - Upgrade sensible-utils to 0.0.9+deb9u1.
    - Upgrade tor to 0.3.1.9-1~d90.stretch+1.

  * Minor improvements
    - Display TopIcons systray on the left of the system menu. This
      fixes #14796 (on Buster, it is displayed in the middle of the
      screen, on the left of the clock) and an annoying UX problem we
      have on Stretch: OpenPGP applet is in the middle of icons that
      share the exact same (modern, GNOME Shell-like) behaviour, which
      is disturbing when opening one of the modern menus and moving
      the mouse left/right to the others, because in the middle one
      icon won't react as expected, and the nice blue bottom border
      continuity is broken.
    - Use the "intel" X.Org driver for integrated graphics in Intel
      i5-7300HQ (Closes: #14990).
    - Enable HashKnownHosts in the OpenSSH client (Closes: #14995).
      Debian enables HashKnownHosts by default via /etc/ssh/ssh_config
      for good reasons, let's not revert to the upstream default.
    - Pin the AppArmor feature set to the Stretch's kernel one. Linux
      4.14 brings new AppArmor mediation features and the policy
      shipped in Stretch may not be ready for it. So let's disable
      these new features to avoid breaking stuff: it's too hard to
      check if all the policy for apps we ship (and that users install
      themselves) has the right rules to cope with these new mediation
      features.

  * Bugfixes
    - Don't delete downloaded debs after install (Closes: #10958).
    - Install xul-ext-ublock-origin from sid to make the dashboard
      work again(Closes: #14993). Thanks to cacahuatl
      <cacahuatl@autistici.org> for the patch!
    - Additional software feature: use debconf priority critical to
      prevent failure when installing packages otherwise requiring
      manual configuration (Closes: #6038)
    - Don't include anything under /lib/live/mount/medium/ in the
      readahead list (Closes: #14964). This fixes the boot time
      regression introduced in Tails 3.3.

  * Build system
    - Display a more helpful error message when the 'origin' remote
      does not point to the official Tails Git repository. This task
      calls git_base_branch_head() which relies on the fact 'origin'
      points to our official repo.
    - Vagrant: never build the wiki early. This has caused several
      issues throughout the years, the lastest instance being the
      reopening of #14933. (Closes: #14933)
    - Install libelf-dev during the time we need it for building DKMS modules.
    - Make the DKMS build hook verbose, and display DKMS modules build
      logs on failure. This hook is a recurring cause of headaches,
      let's simplify debugging.
    - Remove obsolete duplicate build of the virtualbox-guest DKMS
      module.

  * Test suite
    - Log the list of systemd jobs when systemctl is-system-running
      fails (Closes: #14772). Listing the units is not enough: in most
      cases I've seen, is-system-running returns "starting" which
      means the job queue is not empty, and to debug that we need the
      list of jobs.
    - Only support SikuliX; drop support for Sikuli.
    - Disable SPICE clipboard sharing in the guest. It could only mess
      things up, and in fact has confused me by suddenly setting my
      *host's* clipboard to "ATTACK AT DAWN"... :)
    - Decode Base64.decode64 return value appropriately; it returns
      strings encoded in ASCII-8bit.
    - Don't flood the debug logger with the journal contents.
    - Handle case where $vm is undefined during an extremely early
      scenario failure.
    - Allow more time for 'systemctl is-system-running' to
      succeed. (Refs: #14772)
    - Make Sikuli attempt to find replacements on FindFailed by
      employing fuzz, or "lowering the similarity factor". The
      replacements (if found) are saved among the artifacts, and
      serves as potential drop-in-replacements for outdated
      images. The main use case for this is when the font
      configuration in Tails changes, which normally invalidates a
      large part of our images given that our default high similarity
      factor. We also add the `--fuzzy-image-matching` where the
      replacements are used in case of FindFailed, so the tests can
      proceed beyond the first FindFailed. The idea is that a full
      test suite run will produce replacements for potentially *all*
      outdated images.
    - Fix our findAny() vs findfailed_hook. For findAny() it might be
      expected that some images won't be found, so we shouldn't use
      our findfailed_hook, which is about dealing with the situation
      where images need to be updated.
For faster browsing, not all history is shown. View entire blame