changelog 259 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443444444454446444744484449445044514452445344544455445644574458445944604461446244634464446544664467446844694470447144724473447444754476447744784479448044814482448344844485448644874488448944904491449244934494449544964497449844994500450145024503450445054506450745084509451045114512451345144515451645174518451945204521452245234524452545264527452845294530453145324533453445354536453745384539454045414542454345444545454645474548454945504551455245534554455545564557455845594560456145624563456445654566456745684569457045714572457345744575457645774578457945804581458245834584458545864587458845894590459145924593459445954596459745984599460046014602460346044605460646074608460946104611461246134614461546164617461846194620462146224623462446254626462746284629463046314632463346344635463646374638463946404641464246434644464546464647464846494650465146524653465446554656465746584659466046614662466346644665466646674668466946704671467246734674467546764677467846794680468146824683468446854686468746884689469046914692469346944695469646974698469947004701470247034704470547064707470847094710471147124713471447154716471747184719472047214722472347244725472647274728472947304731473247334734473547364737473847394740474147424743474447454746474747484749475047514752475347544755475647574758475947604761476247634764476547664767476847694770477147724773477447754776477747784779478047814782478347844785478647874788478947904791479247934794479547964797479847994800480148024803480448054806480748084809481048114812481348144815481648174818481948204821482248234824482548264827482848294830483148324833483448354836483748384839484048414842484348444845484648474848484948504851485248534854485548564857485848594860486148624863486448654866486748684869487048714872487348744875487648774878487948804881488248834884488548864887488848894890489148924893489448954896489748984899490049014902490349044905490649074908490949104911491249134914491549164917491849194920492149224923492449254926492749284929493049314932493349344935493649374938493949404941494249434944494549464947494849494950495149524953495449554956495749584959496049614962496349644965496649674968496949704971497249734974497549764977497849794980498149824983498449854986498749884989499049914992499349944995499649974998499950005001500250035004500550065007500850095010501150125013501450155016501750185019502050215022502350245025502650275028502950305031503250335034503550365037503850395040504150425043504450455046504750485049505050515052505350545055505650575058505950605061506250635064506550665067506850695070507150725073507450755076507750785079508050815082508350845085508650875088508950905091509250935094509550965097509850995100510151025103510451055106510751085109511051115112511351145115511651175118511951205121512251235124512551265127512851295130513151325133513451355136513751385139514051415142514351445145514651475148514951505151515251535154515551565157515851595160516151625163516451655166516751685169517051715172517351745175517651775178517951805181518251835184518551865187518851895190519151925193519451955196519751985199520052015202520352045205520652075208520952105211521252135214521552165217521852195220522152225223522452255226522752285229523052315232523352345235523652375238523952405241524252435244524552465247524852495250525152525253525452555256525752585259526052615262526352645265526652675268526952705271527252735274527552765277527852795280528152825283528452855286528752885289529052915292529352945295529652975298529953005301530253035304530553065307530853095310531153125313531453155316531753185319532053215322532353245325532653275328532953305331533253335334533553365337533853395340534153425343534453455346534753485349535053515352535353545355535653575358535953605361536253635364536553665367536853695370537153725373537453755376537753785379538053815382538353845385538653875388538953905391539253935394539553965397539853995400540154025403540454055406540754085409541054115412541354145415541654175418541954205421542254235424542554265427542854295430543154325433543454355436
  1. tails (2.9.1) unstable; urgency=medium
  2. * Security fixes
  3. - Upgrade Tor Browser to 6.0.8 based on Firefox 45.6. If you pay
  4. close attention you'll see that we import -build1 but there was
  5. a -build2. The only change is Tor Button 1.9.5.13 which makes
  6. some changes to the donation campaign banner in `about:tor`,
  7. which we safely can skip. (Closes: #12028)
  8. - Upgrade Icedove to 45.5.1-1~deb8u1+tails1. (Closes: #12029)
  9. - Upgrade APT-related packages to 1.0.9.8.4.
  10. * Minor improvements
  11. - Switch to DuckDuckGo as the default search engine in the tor
  12. Browser. This is what Tor Browser has, and Disconnect.me (the
  13. previous default) has been re-directing to DDG for some time,
  14. which has been confusing users. In addition, we localize the DDG
  15. user interface for the locales with availablelangpacks. (Closes:
  16. #11913)
  17. - Improve the display name for the Wikipedia search plugin.
  18. - Enable contrib and non-free for our own APT repos.
  19. - Upgrade Tor to 0.2.8.10. (Closes: #12015)
  20. - Upgrade obfs4proxy to 0.0.7-1~tpo1.
  21. * Bugfixes
  22. - AppArmor Totem profile: add permissions needed to avoid warning
  23. on startup. (Closes: #11984)
  24. - Upgrade the VirtualBox Guest additions and modules to version
  25. 5.1.8. This should prevent Xorg from crashing unless the video
  26. memory for the VMs are significantly bumped. (Closes: #11965)
  27. Users will still have to enable I/O APIC due to a bug in Linux.
  28. - Drop unwanted search plugins from the Tor Browser langpacks.
  29. Otherwise they are only removed from English locales. Note that
  30. the langpacks contain copies of the English plugins, not
  31. localized versions, so we actually lose nothing.
  32. * Test suite
  33. - Add support for SikuliX, which recently hit Debian Unstable,
  34. while still supporting Sikuli for Jessie users. (Closes: #11991)
  35. - Fix some instances where we were trying to use the mouse outside
  36. of the Sikuli screen.
  37. - Use "TorBirdy" instead of "amnesia branding" as the "anchor"
  38. addon. I.e. the addon that we use to find the other ones. The
  39. "amnesia branding" addon has been removed, so we must use
  40. something else. (Fixup: #11906)
  41. - Dogtailify "the support documentation page opens in Tor Browser"
  42. step. We previously relied on Sikuli, and the image was made
  43. outdated thanks to our donation campaign. No more! (Closes:
  44. #11911)
  45. - Resolve dl.amnesia.boum.org instead of picking a static address.
  46. Just hours after updating the dustri.org IP address, its web
  47. server went down => test suite failures. Let's make this test as
  48. robust as actually downloading the Tails ISO image -- if that
  49. fails, we probably have more serious problems on our hands than
  50. a failing test suite. (Closes: #11960)
  51. - Switch MAT scenario from testing PDFs to PNGs. Also add
  52. anti-test and test using using a tool *different* from MAT, the
  53. tool being tested here. (Closes: #11901)
  54. -- Tails Developers <tails@boum.org> Wed, 14 Dec 2016 13:19:16 +0100
  55. tails (2.7.1) unstable; urgency=medium
  56. * Security fixes
  57. - Upgrade Tor Browser to 6.0.7 (build3) based on Firefox 45.5.1.
  58. - Upgrade gstreamer0.10-based packages to 0.10.31-3+nmu4+deb8u2.
  59. - Upgrade imagemagick-based packages to 8:6.8.9.9-5+deb8u6.
  60. - Upgrade libicu52 to 52.1-8+deb8u4.
  61. - Upgrade vim-based packages to 2:7.4.488-7+deb8u1.
  62. * Minor improvements
  63. - Reserve 64 MiB for the kernel and 128 MiB for privileged
  64. processes before the memory is wiped. We hope that this might
  65. help (but not solve, sadly) some crashes experienced while
  66. wiping the memory.
  67. * Build system
  68. - Make the wiki shipped inside Tails build deterministically
  69. (Closes: #11966):
  70. * Enable ikiwiki's "deterministic" option, and require it when
  71. building.
  72. * Use our custom backport of discount (2.2.1-1~bpo8+1~0.tails1),
  73. to fix reproducibility issues (Debian#782315). This can be
  74. dropped once our ISO builders use Stretch.
  75. * Install ikiwiki from our builder-jessie APT suite, to make the
  76. pagestats plugin output deterministic.
  77. - refresh-translations: don't update PO files unless something
  78. other than POT-Creation-Date was changed. (Closes: #11967)
  79. - Fix Vagrant's is_release? check. Per auto/build, we consider it
  80. a release when we build from detached head, and HEAD is tagged.
  81. - Enforce `cleanall` when building a release. I.e. don't allow the
  82. user supplied options to override this behaviour. This is
  83. important since Vagrant caches wiki builds, and we do not want
  84. leftovers from a previous builds ending up in a release. Also,
  85. this is required for making Tails images build reproducibly.
  86. - Make the build system's `cleanall` option really clean
  87. everything. At the moment it doesn't clean the cached wiki
  88. build (which basically was its only job).
  89. - import-package: support contrib and non-free sections.
  90. * Test suite
  91. - Wait a bit between opening the shutdown applet menu, and
  92. clicking one of its widgets. (Closes: #11616).
  93. - Adapt Icedove test after removing the amnesia branding add-on.
  94. (Closes: #11906)
  95. - Replace --pause-on-fail with --interactive-debugging. It does
  96. the same thing, but also offers an interactive Ruby shell, via
  97. pry, with the Cucumber world context.
  98. -- Tails developers <tails@boum.org> Wed, 30 Nov 2016 17:27:37 +0100
  99. tails (2.7) unstable; urgency=medium
  100. * Security fixes
  101. - Upgrade to Linux 4.7. (Closes: #11885, #11818)
  102. - Upgrade to Tor 0.2.8.9. (Closes: #11832, #11891)
  103. - Upgrade Tor Browser to 6.0.6 based on Firefox 45.5. (Closes: #11910)
  104. - Upgrade Icedove to 1:45.4.0-1~deb8u1+tails1. (Closes: #11854,
  105. #11860)
  106. - Upgrade imagemagick to 8:6.8.9.9-5+deb8u5.
  107. - Upgrade openssl to 1.0.1t-1+deb8u5.
  108. - Upgrade libarchive to 3.1.2-11+deb8u3.
  109. - Upgrade bind9 to 1:9.9.5.dfsg-9+deb8u8.
  110. - Upgrade libav to 6:11.8-1~deb8u1.
  111. - Upgrade ghostscript to 9.06~dfsg-2+deb8u3.
  112. - Upgrade c-ares to 1.10.0-2+deb8u1.
  113. - Upgrade nspr to 2:4.12-1+debu8u1.
  114. - Upgrade nss to 2:3.26-1+debu8u1.
  115. - Upgrade tar to 1.27.1-2+deb8u1.
  116. - Upgrade curl to 7.38.0-4+deb8u5.
  117. - Upgrade libgd3 to 2.1.0-5+deb8u7.
  118. - Upgrade opendjk-7 to 7u111-2.6.7-2~deb8u1.
  119. - Upgrade mat to 0.5.2-3+deb8u1.
  120. - Upgrade libxslt to 1.1.28-2+deb8u2.
  121. - Upgrade pillow to 2.6.1-2+deb8u3.
  122. * Minor improvements
  123. - Ship Let's encrypt intermediate certificate to prepare the
  124. the next certificate renewal of our website. Also unify the
  125. way our upgrades and security checkers verify this SSL
  126. certificate using our dedicated perl lib code. (Closes: #11810)
  127. * Bugfixes
  128. - Fix multiarch support in Synaptic. (Closes: #11820)
  129. - Set default spelling language to en_US in Icedove. (Closes: #11037)
  130. * Build system
  131. - Disable debootstrap merged-usr option. (Closes: #11903)
  132. * Test suite
  133. - Add test for incremental upgrades. (Closes: #6309)
  134. - Add tests for Icedove. (Closes: #6304)
  135. - Decrease timeout to Tails Greeter to speed up testing of branches
  136. where it is broken. (Closes: #11449)
  137. - Add a ID field to the remote shell responses to filter out
  138. unrelated ones. (Closes: #11846)
  139. - Reliabily wait for the Greeter PostLogin script. (Closes: #5666)
  140. - Reliabily type the kernel command line in the prompt at the boot
  141. menu to ensure the remote shell is started. (Closes: #10777)
  142. - Remove DVDROM device when not used, to workaround QEMU/Libvirt
  143. compatibility issue. (Closes: #11874)
  144. -- Tails developers <tails@boum.org> Sun, 13 Nov 2016 14:46:04 +0100
  145. tails (2.6) unstable; urgency=medium
  146. * Major new features and changes
  147. - Install Tor 0.2.8.7. (Closes: #11351)
  148. - Enable kASLR in the Linux kernel. (Closes: #11281)
  149. - Upgrade Icedove to 1:45.2.0-1~deb8u1+tails1: (Closes: #11714)
  150. · Drop auto-fetched configurations using Oauth2. They do not
  151. work together with Torbirdy since it disables needed
  152. functionality (like JavaScript and cookies) in the embedded
  153. browser. This should make auto-configuration work for GMail
  154. again, for instance. (Closes: ##11536)
  155. · Pin Icedove to be installed from our APT repo. Debian's
  156. Icedove packages still do not have our secure Icedove
  157. autoconfig wizard patches applied, so installing them would be
  158. a serious security regression. (Closes: #11613)
  159. · Add missing icedove-l10n-* packages to our custom APT
  160. repository (Closes: #11550)
  161. - Upgrade to Linux 4.6: (Closes: #10298)
  162. · Install the 686 kernel flavour instead of the obsolete 586
  163. one.
  164. · APT, dpkg: add amd64 architecture. The amd64 kernel flavour is
  165. not built anymore for the i386 architecture, so we need to use
  166. multiarch now.
  167. · Build and install the out-of-tree aufs4 module. (Closes: #10298)
  168. · Disable kernel modesetting for QXL: it's not compatible with
  169. Jessie's QXL X.Org driver.
  170. * Security fixes
  171. - Hopefully fixed an issue which would sometimes make the Greeter
  172. ignore the "disable networking" or "bridge mode"
  173. options. (Closes: #11593)
  174. * Minor improvements
  175. - Install firmware-intel-sound and firmware-ti-connectivity. This
  176. adds support for some sound cards and Wi-Fi adapters. (Closes:
  177. #11502)
  178. - Install OpenPGP Applet from Debian. (Closes: #10190)
  179. - Port the "About Tails" dialog to python3.
  180. - Run our initramfs memory erasure hook earlier (Closes:
  181. #10733). The goal here is to:
  182. · save a few seconds on shutdown (it might matter especially for
  183. the emergency one);
  184. · work in a less heavily multitasking / event-driven
  185. environment, for more robust operation.
  186. - Install rngd, and make rng-tools initscript return success when
  187. it can't find any hardware RNG device. Most Tails systems around
  188. probably have no such device, and we don't want systemd to
  189. believe they failed to boot properly. (Closes: #5650)
  190. - Don't force using the vboxvideo X.Org driver. According to our
  191. tests, this forced setting is:
  192. · harmful: it breaks X startup when the vboxvideo *kernel*
  193. driver is loaded;
  194. · useless: X.Org now autodetects the vboxvideo X.Org driver and
  195. uses it when running in VirtualBox and the vboxvideo kernel
  196. is not present.
  197. - Port boot-profile to python3 (Closes: #10083). Thanks to
  198. heartsucker <heartsucker@autistici.org> for the patch!
  199. - Include /proc/cmdline and the content of persistent APT sources
  200. in WhisperBack bug reports. (Closes: #11675, #11635)
  201. - Disable non-free APT sources at boot time. (Closes: #10130)
  202. - Have a dedicated page for the homepage of Tor Browser in
  203. Tails. (Closes: # 11725)
  204. - Only build the VirtualBox kernel modules for the 32-bit kernel.
  205. It's both hard and useless to build it for 64-bit in the current
  206. state of things, as long as we're shipping a 32-bit userspace.
  207. Also, install virtualbox-* from jessie-backports, since the
  208. version in Jessie is not compatible with Linux 4.x.
  209. * Build system
  210. - Don't install+remove dpatch during the build. It's not been
  211. needed in this hook for ages.
  212. - Bump BUILD_SPACE_REQUIREMENT: at least one of us needed that to
  213. build feature/10298-linux-4.x-aufs with the gzipcomp option.
  214. * Test suite
  215. - Send Tails Installer's debug log to the Cucumber debug log on
  216. failure. This is meant to debug #10720 since I can't
  217. reproduce it locally.
  218. - Give the system under testing 2 vCPUs. (Closes: #6729)
  219. - Split scenarios from checks.feature. (Closes: #5707)
  220. - Add retry-logic to the Synaptic tests. (Closes: #10412, #10441,
  221. #10991)
  222. - Run usb_upgrade.feature earlier, when there is enough free disk
  223. space left. (Closes: #11582)
  224. - Use more recent virtual hardware in the system under test,
  225. i.e. USB 3.0 (nec-xhci) on a pc-i440fx-2.5 machine. Switching
  226. USB controllers has helped with problems we see on Jenkins when
  227. booting from USB (#11588). Also, there are chances that more
  228. recent virtual hardware sees more testing these days, so it
  229. sounds potentially useful to "upgrade".
  230. - Add support for Cucumber 2.4. (Closes: #11690)
  231. - Always write {pretty,debug} logs and JSON output to the artifact
  232. directory.
  233. - Disable info level logging on Chutney nodes to save disk
  234. space. For our network all these add up to > 1 GiB and we didn't
  235. take this into account when budgeting RAM to the isotesters on
  236. Jenkins.
  237. -- Tails developers <tails@boum.org> Tue, 20 Sep 2016 04:16:33 +0200
  238. tails (2.5) unstable; urgency=medium
  239. * Major new features and changes
  240. - Upgrade Icedove to 1:45.1.0-1~deb8u1+tails2. (Closes: #11530)
  241. · Fix long delay causing bad UX in the autoconfig wizard,
  242. when it does not manage to guess proper settings on some domains.
  243. (Closes: #11486)
  244. · Better support sending email through some ISPs, such as Riseup.
  245. (Closes: #10933)
  246. · Fix spurious error message when creating an account and providing
  247. its password. (Closes: #11550)
  248. * Security fixes
  249. - Upgrade Tor Browser to 6.0.3 based on Firefox 45.3. (Closes: #11611)
  250. - Upgrade GIMP to 2.8.14-1+deb8u1.
  251. - Upgrade libav to 6:11.7-1~deb8u1.
  252. - Upgrade expat to 2.1.0-6+deb8u3.
  253. - Upgrade libgd3 to 2.1.0-5+deb8u6.
  254. - Upgrade libmodule-build-perl to 0.421000-2+deb8u1.
  255. - Upgrade perl to 5.20.2-3+deb8u6.
  256. - Upgrade Pidgin to 2.11.0-0+deb8u1.
  257. - Upgrade LibreOffice to 1:4.3.3-2+deb8u5.
  258. - Upgrade libxslt1.1 to 1.1.28-2+deb8u1.
  259. - Upgrade Linux to 3.16.7-ckt25-2+deb8u3.
  260. - Upgrade OpenSSH to 1:6.7p1-5+deb8u3.
  261. - Upgrade p7zip to 9.20.1~dfsg.1-4.1+deb8u2.
  262. * Minor improvements
  263. - htpdate: replace obsolete and unreliable URIs in HTP pools, and decrease
  264. timeout for HTTP operations for more robust time synchronization.
  265. (Closes: #11577)
  266. - Hide settings panel for the Online Accounts component of GNOME,
  267. that we don't support. (Closes: #11545)
  268. - Vastly improve graphics performance in KVM guest with QXL driver.
  269. (Closes: #11500)
  270. - Fix graphics artifacts in Tor Browser in KVM guest with QXL driver.
  271. (Closes: #11489)
  272. * Build system
  273. - Wrap Pidgin in a more maintainable way. (Closes: #11567)
  274. * Test suite
  275. - Add a test scenario for the persistence "dotfiles" feature.
  276. (Closes: #10840)
  277. - Improve robustness of most APT, Git, SFTP and SSH scenarios,
  278. enough to enable them on Jenkins. (Closes: #10444, #10496, #10498)
  279. - Improve robustness of checking for persistence partition. (Closes: #11558)
  280. - Treat Tails booting from /dev/sda as OK, to support all cases
  281. including a weird one caused by hybrid ISO images. (Closes: #10504)
  282. - Bump a bunch of timeouts to cope with the occasional slowness on Jenkins.
  283. - Only query A records when exercising DNS lookups, to improve robustness.
  284. -- Tails developers <tails@boum.org> Sun, 31 Jul 2016 16:50:35 +0000
  285. tails (2.4) unstable; urgency=medium
  286. * Major new features and changes
  287. - Upgrade Tor Browser to 6.0.1 based on Firefox 45.2. (Closes:
  288. #11403, #11513).
  289. - Enable Icedove's automatic configuration wizard. We patch the
  290. wizard to only use secure protocols when probing, and only
  291. accept secure protocols, while keeping the improvements done by
  292. TorBirdy in its own non-automatic configuration wizard. (Closes:
  293. #6158, #11204)
  294. * Security fixes
  295. - Upgrade bsdtar and libarchive13 to 3.1.2-11+deb8u1.
  296. - Upgrade icedove to 38.8.0-1~deb8u1+tails3.
  297. - Upgrade imagemagick to 8:6.8.9.9-5+deb8u3.
  298. - Upgrade libexpat1 to 2.1.0-6+deb8u2.
  299. - Upgrade libgd3 to 2.1.0-5+deb8u3.
  300. - Upgrade gdk-pixbuf-based packages to 2.31.1-2+deb8u5.
  301. - Upgrade libidn11 to 1.29-1+deb8u1.
  302. - Upgrade libndp0 to 1.4-2+deb8u1.
  303. - Upgrade poppler-based packages to 0.26.5-2+deb8u1.
  304. - Upgrade librsvg2-2 to 2.40.5-1+deb8u2.
  305. - Upgrade libsmbclient to 2:4.2.10+dfsg-0+deb8u3.
  306. - Upgrade OpenSSL to 1.0.1k-3+deb8u5.
  307. - Upgrade libtasn1-6 to 4.2-3+deb8u2.
  308. - Upgrade libxml2 to 2.9.1+dfsg1-5+deb8u2.
  309. - Upgrade openjdk-7-jre to 7u101-2.6.6-1~deb8u1.
  310. * Bugfixes
  311. - Enable Packetization Layer Path MTU Discovery for IPv4. If any
  312. system on the path to the remote host has a MTU smaller than the
  313. standard Ethernet one, then Tails will receive an ICMP packet
  314. asking it to send smaller packets. Our firewall will drop such
  315. ICMP packets to the floor, and then the TCP connection won't
  316. work properly. This can happen to any TCP connection, but so far
  317. it's been reported as breaking obfs4 for actual users. Thanks to
  318. Yawning for the help! (Closes: #9268)
  319. - Make Tails Upgrader ship other locales than English. (Closes:
  320. #10221)
  321. - Make it possible to add local USB printers again. Bugfix on
  322. Tails 2.0. (Closes #10965).
  323. * Minor improvements
  324. - Remove custom SSH ciphers and MACs settings. (Closes: #7315)
  325. - Bring back "minimize" and "maximize" buttons in titlebars by
  326. default. (Closes: #11270)
  327. - Icedove improvements:
  328. * Stop patching in our default into Torbirdy. We've upstreamed
  329. some parts, and the rest we set with pref branch overrides in
  330. /etc/xul-ext/torbirdy.js. (Closes: #10905)
  331. * Use hkps keyserver in Enigmail. (Closes: #10906)
  332. * Default to POP if persistence is enabled, IMAP is
  333. not. (Closes: #10574)
  334. * Disable remote email account creation in Icedove. (Closes:
  335. #10464)
  336. - Firewall hardening (Closes: #11391):
  337. * Don't accept RELATED packets. This enables quite a lot of code
  338. in the kernel that we don't need. Let's reduce the attack
  339. surface a bit.
  340. * Restrict debian-tor user to NEW TCP syn packets. It doesn't
  341. need to do more, so let's do a little bit of security in
  342. depth.
  343. * Disable netfilter's nf_conntrack_helper.
  344. * Fix disabling of automatic conntrack helper assignment.
  345. - Kernel hardening:
  346. * Set various kernel boot options: slab_nomerge slub_debug=FZ
  347. mce=0 vsyscall=none. (Closes: #11143)
  348. * Remove the kernel .map files. These are only useful for kernel
  349. debugging and slightly make things easier for malware, perhaps
  350. and otherwise just occupy disk space. Also stop exposing
  351. kernel memory addresses through /proc etc. (Closes: #10951)
  352. - Drop zenity hacks to "focus" the negative answer. Jessie's
  353. zenity introduced the --default-cancel option, finally!
  354. (Closes: #11229)
  355. - Drop useless APT pinning for Linux.
  356. - Remove gnome-tweak-tool. (Closes: #11237)
  357. - Install python-dogtail, to enable accessibility technologies in
  358. our automated test suite (see below). (Part of: #10721)
  359. - Install libdrm and mesa from jessie-backports. (Closes: #11303)
  360. - Remove hledger. (Closes: #11346)
  361. - Don't pre-configure the #tails chan on the default OFTC account.
  362. (Part of: #11306)
  363. - Install onioncircuits from jessie-backports. (Closes: #11443)
  364. - Remove nmh. (Closes: #10477)
  365. - Drop Debian experimental APT source: we don't use it.
  366. - Use APT codenames (e.g. "stretch") instead of suites, to be
  367. compatible with our tagged APT snapshots.
  368. - Drop module-assistant hook and its cleanup. We've not been using
  369. it since 2010.
  370. - Remove 'Reboot' and 'Power Off' entries from Applications →
  371. System Tools. (Closes: #11075)
  372. - Pin our custom APT repo to the same level as Debian ones, and
  373. explicitly pin higher the packages we want to pull from our custom
  374. APT repo, when needed.
  375. - config/chroot_local-hooks/59-libdvd-pkg: verify libdvdcss
  376. package installation. (Closes: #11420)
  377. - Make Tails Upgrader use our new mirror pool design. (Closes:
  378. #11123)
  379. - Drop custom OpenSSH client ciphers and MACs settings. We did a
  380. pretty bad job at maintaining them compared to the Debian
  381. upstream. (Closes: #7315)
  382. - Install jessie-backports version of all binary packages built
  383. from src:hplip. This adds support for quite a few new
  384. printers.
  385. - Install printer-driver-postscript-hp, which adds support for
  386. some more printers.
  387. * Build system
  388. - Use a freezable APT repo when building Tails. This is a first
  389. step towards reproducible builds, and improves our QA and
  390. development processes by making our builds more predictable. For
  391. details, see: https://tails.boum.org/contribute/APT_repository/
  392. - There has been a massive amount of improvements to the
  393. Vagrant-based build system, and now it could be considered the
  394. de-facto build system for Tails! Improvements and fixes include:
  395. * Migrate Vagrant to use libvirt/KVM instead of
  396. Virtualbox. (Closes: #6354)
  397. * Make apt-get stuff non-interactive while provisioning.
  398. Because there is no interaction, so that will results in
  399. errors.
  400. * Bump disk space (=> RAM for RAM builds) needed to build with
  401. Vagrant. Since the Jessie migration it seems impossible to
  402. keep this low enough to fit in 8 GiB or RAM. For this reason
  403. we also drop the space optimization where we build inside a
  404. crazy aufs stack; now we just build in a tmpfs.
  405. * Clean up apt-cacher-ng cache on vm:provision to save disk
  406. space on the builder.
  407. * Add convenient Rake task for SSH:ing into the builder VM:
  408. `rake vm:ssh`.
  409. * Add rake task for generating a new Vagrant base box.
  410. * Automatically provision the VM on build to keep things up-to-date.
  411. * Don't enable extproxy unless explicitly given as an
  412. option. Previously it would automatically be enabled when
  413. `http_proxy` is set in the environment, unlike what is
  414. documented. This will hopefully lead to fewer surprises for users
  415. who e.g. point http_proxy to a torified polipo, or similar.
  416. * Re-fetch tags when running build-tails with Vagrant. That
  417. should fix an annoyance related to #7182 that I frequently
  418. encounter: when I, as the RM, rebuild the release image the
  419. second time from the force-updated tag, the build system would
  420. not have the force-updated tag. (Closes: #7182)
  421. * Make sure we use the intended locale in the Tails builder VM.
  422. Since we communicate via SSH, and e.g. Debian forward the
  423. locale env vars by default, we have to take some steps
  424. ensuring we do not do that.
  425. - Pull monkeysphere from stretch to avoid failing to install under
  426. eatmydata. Patch submitted by Cyril Brulebois <cyril@debamax.com>.
  427. * Test suite
  428. - Add wrapper around dogtail (inside Tails) for "remote" usage in
  429. the automated test suite. This provides a simple interface for
  430. generating dogtail python code, sending it to the guest, and
  431. executing it, and should allow us to write more robust tests
  432. leveraging assistive technologies. (Closes: #10721)
  433. - A few previously sikuli-based tests has been migrated to use
  434. dogtail instead, e.g. GNOME Applications menu interaction.
  435. - Add a test for re-configuring an existing persistent volume.
  436. This is a regression test for #10809. (Closes: #10834)
  437. - Use a simulated Tor network provided by Chutney in the automated
  438. test suite. The main motivation here is improved robustness --
  439. since the "Tor network" we now use will exit from the host
  440. running the automated test suite, we won't have to deal with Tor
  441. network blocking, or unreliable circuits. Performance should
  442. also be improved. (Closes: #9521)
  443. - Drop the usage of Tor Check in our tests. It doesn't make sense
  444. now when we use Chutney since that always means it will report
  445. that Tor is not being used.
  446. - Stop testing obsolete pluggable transports.
  447. - Completely rewrite the firewall leak detector to something more
  448. flexible and expressive.
  449. - Run tcpdump with --immediate-mode for the network sniffer. With
  450. this option, "packets are delivered to tcpdump as soon as they
  451. arrive, rather than being buffered for efficiency" which is
  452. required to make the sniffing work reliable the way we use it.
  453. - Remove most scenarios testing "tordate". It just isn't working
  454. well in Tails, so we shouldn't expect the tests to actually work
  455. all of the time. (Closes: #10440)
  456. - Close Pidgin before we inspect or persist its accounts.xml.
  457. I've seen a case when that file is _not_ saved (and thus, not
  458. persisted) if we shut down the system while Pidgin is still
  459. running. (Closes: #11413)
  460. - Close the GNOME Notification bar by pressing ESC, instead of
  461. opening the Applications menu. The Applications menu often
  462. covers other elements that we're looking for on the
  463. screen. (Closes #11401)
  464. - Hide Florence keyboard window when it doesn't vanish by itself
  465. (Closes: #11398) and wait a bit less for Florence to disappear
  466. (Closes: #11464).
  467. -- Tails developers <tails@boum.org> Mon, 06 Jun 2016 20:10:56 +0200
  468. tails (2.3) unstable; urgency=medium
  469. * Security fixes
  470. - Upgrade Tor Browser to 5.5.5. (Fixes: #11362)
  471. - Upgrade icedove to 38.7.0-1~deb8u1
  472. - Upgrade git to 1:2.1.4-2.1+deb8u2
  473. - Upgrade libgd3 to 2.1.0-5+deb8u1
  474. - Upgrade pidgin-otr to 4.0.1-1+deb8u1
  475. - Upgrade srtp to 1.4.5~20130609~dfsg-1.1+deb8u1
  476. - Upgrade imagemagick to 8:6.8.9.9-5+deb8u1
  477. - Upgrade samba to 2:4.2.10+dfsg-0+deb8u2
  478. - Upgrade openssh to 1:6.7p1-5+deb8u2
  479. * Bugfixes
  480. - Refresh Tor Browser's AppArmor profile patch against the one from
  481. torbrowser-launcher 0.2.4-1. (Fixes: #11264)
  482. - Pull monkeysphere from stretch to avoid failing to install under
  483. eatmydata. (Fixes: #11170)
  484. - Start gpg-agent with no-grab option due to issues with pinentry and
  485. GNOME's top bar. (Fixes: #11038)
  486. - Tails Installer: Update error message to match new name of 'Clone
  487. & Install'. (Fixes: #11238)
  488. - Onion Circuits:
  489. * Cope with a missing geoipdb. (Fixes: #11203)
  490. * Make both panes of the window scrollable. (Fixes #11192)
  491. - WhisperBack: Workaround socks bug. When the Tor fails to connect to
  492. the host, WisperBack used to display a ValueError. This is caused by
  493. a socks bug that is solved in upstream's master but not in Tails.
  494. This commit workarounds this bug Unclear error message in WhisperBack
  495. when failing to connect to the server. (Fixes: #11136)
  496. * Minor improvements
  497. - Upgrade to Debian 8.4, a Debian point release with many minor upgrades
  498. and fixes to various packages . (Fixes: #11232)
  499. - Upgrade I2P to 0.9.25. (Fixes: #11363)
  500. - Pin pinentry-gtk2 to jessie-backports. The new version allows pasting
  501. passwords from the clipboard. (Fixes: #11239)
  502. - config/chroot_local-hooks/59-libdvd-pkg: cleanup /usr/src/libdvd-pkg.
  503. (Fixes: #11273)
  504. - Make the Tor Status "disconnected" icon more contrasted with the
  505. "connected" one. (Fixes: #11199)
  506. * Test suite
  507. - Add UTF-8 support to OTR Bot. (Fixes: #10866)
  508. - Don't explicitly depend on openjdk-7-jre or any JRE for that
  509. matter. Sikuli will pull in a suitable one, so depending on one
  510. ourselves is only risks causing trouble. (Fixes: #11335)
  511. -- Tails developers <tails@boum.org> Mon, 25 Apr 2016 14:12:22 +0200
  512. tails (2.2.1) unstable; urgency=medium
  513. * Security fixes
  514. - Upgrade Tor Browser to 5.5.4. (Closes: #11254)
  515. - Upgrade bind9-related packages to 1:9.9.5.dfsg-9+deb8u6
  516. - Upgrade libotr to 4.1.0-2+deb8u1
  517. - Upgrade samba-related packages to 2:4.1.17+dfsg-2+deb8u2.
  518. - Upgrade libgraphite2 to 1.3.6-1~deb8u1.
  519. -- Tails developers <tails@boum.org> Thu, 17 Mar 2016 15:03:52 +0100
  520. tails (2.2) unstable; urgency=medium
  521. * Major new features and changes
  522. - Replace Vidalia (which has been unmaintained for years) with:
  523. (Closes: #6841)
  524. * the Tor Status GNOME Shell extension, which adds a System Status
  525. icon indicating whether Tor is ready or not.
  526. * Onion Circuits, a simple Tor circuit monitoring tool.
  527. * Security fixes
  528. - Upgrade Tor Browser to 5.5.3 (Closes: #11189).
  529. - Upgrade Linux to 3.16.7-ckt20-1+deb8u4.
  530. - Upgrade cpio to 2.11+dfsg-4.1+deb8u1.
  531. - Upgrade glibc to 2.19-18+deb8u3.
  532. - Upgrade libav to 6:11.6-1~deb8u1.
  533. - Upgrade libgraphite2 to 1.3.5-1~deb8u1.
  534. - Upgrade libjasper1 to 1.900.1-debian1-2.4+deb8u1.
  535. - Upgrade libreoffice to 4.3.3-2+deb8u3.
  536. - Upgrade libssh2 to 1.4.3-4.1+deb8u1.
  537. - Upgrade openssl to 1.0.1k-3+deb8u4.
  538. - Upgrade perl to 5.20.2-3+deb8u4.
  539. - Upgrade python-imaging, python-pil to 2.6.1-2 2.6.1-2+deb8u2.
  540. * Bugfixes
  541. - Hide "Laptop Mode Tools Configuration" menu entry. We don't
  542. support configuring l-m-t in Tails, and it doesn't work out of
  543. the box. (Closes: #11074)
  544. - WhisperBack:
  545. * Actually write a string when saving bug report to
  546. disk. (Closes: #11133)
  547. * Add missing argument to OpenPGP dialog so the optional OpenPGP
  548. key can be added again. (Closes: #11033)
  549. * Minor improvements
  550. - Upgrade I2P to 0.9.24-1~deb8u+1.
  551. - Add support for viewing DRM protected DVD videos using
  552. libdvdcss2. Patch series submitted by Austin English
  553. <austinenglish@gmail.com>. (Closes: #7674)
  554. - Automatically save KeePassX database after every change by default.
  555. (Closes: #11147)
  556. - Implement Tor stream isolation for WhisperBack
  557. - Delete unused tor-tsocks-mua.conf previously used by Claws
  558. Mail. (Closes: #10904)
  559. - Add set -u to all gettext:ized shell scripts. In gettext-base <
  560. 1.8.2, like the one we had in Wheezy, gettext.sh references the
  561. environment variable ZSH_VERSION, which we do not set. This has
  562. prevented us from doing `set -u` without various hacks. (Closes:
  563. #9371)
  564. - Also set -e in some shell scripts which lacked it for no good
  565. reason.
  566. - Make Git verify the integrity of transferred objects. (Closes:
  567. #11107)
  568. - Remove LAlt+Shift and LShift+RShift keyboard layout toggling
  569. shortcuts. (Closes: #10913, #11042)
  570. * Test suite
  571. - Reorder the execution of feature to decrease peak disk
  572. usage. (Closes: #10503)
  573. - Paste into the GTK file chooser, instead of typing. (Closes:
  574. #10775)
  575. - Pidgin: wait a bit for text to have stopped scrolling before we
  576. click on it. (Closes: #10783)
  577. - Fix step that runs commands in GNOME Terminal, that was broken
  578. on Jessie when a Terminal is running already. (Closes: #11176)
  579. - Let ruby-rjb guess JAVA_HOME instead fixing on one jvm
  580. version. (Closes: #11190)
  581. * Build system
  582. - Upgrade build system to Debian Jessie. This includes migrating to a
  583. new Vagrant basebox based on Debian Jessie.
  584. - Rakefile: print git status when there are uncommitted
  585. changes. Patch submitted by Austin English
  586. <austinenglish@gmail.com>. (Closes: #11108)
  587. - .gitignore: add .rake_tasks~. Patch submitted by Austin English
  588. <austinenglish@gmail.com>. (Closes: #11134)
  589. - config/amnesia: use --show-field over sed filtering. Patch
  590. submitted by Chris Lamb <lamby@debian.org>.
  591. - Umount and clean up leftover temporary directories from old
  592. builds. (Closes: #10772)
  593. -- Tails developers <tails@boum.org> Mon, 07 Mar 2016 18:09:50 +0100
  594. tails (2.0.1) unstable; urgency=medium
  595. * Major new features and changes
  596. - Enable the Tor Browser's font fingerprinting protection
  597. (Closes: #11000). We do it for all browsers (including
  598. the Unsafe Browser and I2P Browser mainly to avoid making our
  599. automated test suite overly complex. This implied to set an appropriate
  600. working directory when launching the Tor Browser, to accommodate for
  601. the assumptions it makes about this.
  602. * Security fixes
  603. - Upgrade Tor Browser to 5.5.2 (Closes: #11105).
  604. * Bugfixes
  605. - Repair 32-bit UEFI support (Closes: #11007); bugfix on 2.0.
  606. - Add libgnome2-bin to installed packages list to provide gnome-open,
  607. which fixes URL handling at least in KeePassX, Electrum and Icedove
  608. (Closes: #11031); bugfix on 2.0. Thanks to segfault for the patch!
  609. * Minor improvements
  610. - Refactor and de-duplicate the chrooted browsers' configuration:
  611. prefs.js, userChrome.css (Closes: #9896).
  612. - Make the -profile Tor Launcher workaround simpler (Closes: #7943).
  613. - Move Torbutton environment configuration to the tor-browser script,
  614. instead of polluting the default system environment with it.
  615. - Refresh patch against the Tor Browser AppArmor profile
  616. (Closes: #11078).
  617. - Propagate Tor Launcher options via the wrapper.
  618. - Move tor-launcher script to /usr/local/bin.
  619. - Move tor-launcher-standalone to /usr/local/lib.
  620. - Move Tor Launcher env configuration closer to the place where it is used,
  621. for simplicity's sake.
  622. * Test suite
  623. - Mass update browser and Tor Launcher related images due to font change,
  624. caused by Tor Browser 5.5's font fingerprinting protection
  625. (Closes: #11097). And then, use separate PrintToFile.png for the browsers,
  626. and Evince, since it cannot be shared anymore.
  627. - Adjust to the refactored chrooted browsers configuration handling.
  628. - Test that Tor Launcher uses the correct Tor Browser libraries.
  629. - Allow more slack when verifying that the date that was set.
  630. - Bump a bit the timeout used when waiting for the remote shell.
  631. - Bump timeout for the process to disappear, when closing Evince.
  632. - Bump timeout when saving persistence configuration.
  633. - Bump timeout for bootstrapping I2P.
  634. * Build system
  635. - Remove no longer relevant places.sqlite cleanup procedure.
  636. -- Tails developers <tails@boum.org> Fri, 12 Feb 2016 13:00:15 +0000
  637. tails (2.0) unstable; urgency=medium
  638. * Major new features and changes
  639. - Upgrade to Debian 8 (Jessie).
  640. - Migrate to GNOME Shell in Classic mode.
  641. - Use systemd as PID 1, and convert all custom initscripts to systemd units.
  642. - Remove the Windows camouflage feature: our call for help to port
  643. it to GNOME Shell (issued in January, 2015) was unsuccessful.
  644. - Remove Claws Mail: Icedove is now the default email client
  645. (Closes: #10167).
  646. - Upgrade Tor Browser to 5.5 (Closes: #10858, #10983).
  647. * Security fixes
  648. - Minimally sandbox many services with systemd's namespacing features.
  649. - Upgrade Linux to 3.16.7-ckt20-1+deb8u3.
  650. - Upgrade Git to 1:2.1.4-2.1+deb8u1.
  651. - Upgrade Perl to 5.20.2-3+deb8u3.
  652. - Upgrade bind9-related packages to 1:9.9.5.dfsg-9+deb8u5.
  653. - Upgrade FUSE to 2.9.3-15+deb8u2.
  654. - Upgrade isc-dhcp-client tot 4.3.1-6+deb8u2.
  655. - Upgrade libpng12-0 to 1.2.50-2+deb8u2.
  656. - Upgrade OpenSSH client to 1:6.7p1-5+deb8u1.
  657. * Bugfixes
  658. - Restore the logo in the "About Tails" dialog.
  659. - Don't tell the user that "Tor is ready" before htpdate is done
  660. (Closes: #7721).
  661. - Upgrader wrapper: make the check for free memory more accurate
  662. (Closes: #10540, #8263).
  663. - Allow the desktop user, when active, to configure printers;
  664. fixes regression introduced in Tails 1.1 (Closes: #8443).
  665. - Close Vidalia before we restart Tor. Otherwise Vidalia will be running
  666. and showing errors while we make sure that Tor bootstraps, which could
  667. take a while.
  668. - Allow Totem to read DVDs, by installing apparmor-profiles-extra
  669. from jessie-backports (Closes: #9990).
  670. - Make memory erasure on shutdown more robust (Closes: #9707, #10487):
  671. · don't forcefully overcommit memory
  672. · don't kill the allocating task
  673. · make sure the kernel doesn't starve from memory
  674. · make parallel sdmem handling faster and more robust
  675. - Don't offer the option, in Tor Browser, to open a downloaded file with
  676. an external application (Closes: #9285). Our AppArmor confinement was
  677. blocking most such actions anyway, resulting in poor UX; bugfix on 1.3.
  678. Accordingly, remove the now-obsolete exception we had in the Tor
  679. Browser AppArmor profile, that allowed executing seahorse-tool.
  680. - Fix performance issue in Tails Upgrader, that made it very slow to apply
  681. an automatic upgrade; bugfix on 1.7 (Closes: #10757).
  682. - Use our wrapper script to start Icedove from the GNOME menus.
  683. - Make it possible to localize our Icedove wrapper script.
  684. - List Icedove persistence option in the same position where Claws Mail
  685. used to be, in the persistent volume assistant (Closes: #10832).
  686. - Fix Electrum by installing the version from Debian Testing
  687. (Closes: #10754). We need version >=2.5.4-2, see #9713;
  688. bugfix on 2.0~beta1. And, explicitly install python-qt4 to enable
  689. Electrum's GUI: it's a Recommends, and we're not pulling it ourselves
  690. via other means anymore.
  691. - Restore default file associations (Closes: #10798);
  692. bugfix on 2.0~beta1.
  693. - Update 'nopersistent' boot parameter to 'nopersistence'; bugfix on 0.12
  694. (Closes: #10831). Thanks to live-media=removable, this had no security
  695. impact in practice.
  696. - Repair dotfiles persistence feature, by adding a symlink from
  697. /lib/live/mount/persistence to /live/persistence; bugfix on 2.0~beta1
  698. (Closes: #10784).
  699. - Fix ability to re-configure an existing persistent volume using
  700. the GUI; bugfix on 2.0~beta1 (Closes: #10809).
  701. - Associate armored OpenPGP public keys named *.key with Seahorse,
  702. to workaround https://bugs.freedesktop.org/show_bug.cgi?id=93656;
  703. bugfix on 1.1 (Closes: #10889).
  704. - Update the list of enabled GNOME Shell extensions, which might fix
  705. the "GNOME Shell sometimes leaves Classic mode" bug seen in 2.0~beta1:
  706. · Remove obsolete "Alternative Status Menu", that is not shipped
  707. in Debian anymore.
  708. · Explicitly enable the GNOME Shell extensions that build
  709. the Classic mode.
  710. - Make _get_tg_setting() compatible with set -u (Closes: #10785).
  711. - laptop-mode-tools: don't control autosuspend. Some USB input
  712. devices don't support autosuspend. This change might help fix
  713. #10850, but even if it doesn't, it makes sense to me that we
  714. don't let laptop-mode-tools fiddle with this on a Live system
  715. (Closes (for now): #10850).
  716. * Minor improvements
  717. - Remove obsolete code from various places.
  718. - Tails Greeter:
  719. · hide all windows while logging in
  720. · resize and re-position the panel when the screen size grows
  721. · PostLogin: log into the Journal instead of a dedicated log file
  722. · use localectl to set the system locale and keyboard mapping
  723. · delete the Live user's password if no administration password is set
  724. (Closes: #5589)
  725. · port to GDBus greeter interface, and adjust to other GDM
  726. and GNOME changes
  727. - Tails Installer:
  728. · port to UDisks2, and from Qt4 to GTK3
  729. · adapt to work on other GNU/Linux operating systems than Tails
  730. · clean up enough upstream code and packaging bits to make it
  731. deserve being uploaded to Debian
  732. · rename everything from liveusb-creator to tails-installer
  733. - Port tails-perl5lib to GTK3 and UDisks2. In passing, do some minor
  734. refactoring and a GUI improvement.
  735. - Persistent Volume Assistant:
  736. · port to GTK3 and UDisks2
  737. · handle errors when deleting persistent volume (Closes: #8435)
  738. · remove obsolete workarounds
  739. - Don't install UDisks v1.
  740. - Adapt custom udev and polkit rules to UDisks v2 (Closes: #9054, #9270).
  741. - Adjust import-translations' post-import step for Tails Installer,
  742. to match how its i18n system works nowadays.
  743. - Use socket activation for CUPS, to save some boot time.
  744. - Set memlockd.service's OOMScoreAdjust to -1000.
  745. - Don't bother creating /var/lib/live in tails-detect-virtualization.
  746. If it does not exist at this point, we have bigger and more
  747. noticeable problems.
  748. - Simplify the virtualization detection & reporting system, and do it
  749. as a non-root user with systemd-detect-virt rather than virt-what.
  750. - Replace rsyslog with the systemd Journal (Closes: #8320), and adjust
  751. WhisperBack's logs handling accordingly.
  752. - Drop tails-save-im-environment.
  753. It's not been used since we stopped automatically starting the web browser.
  754. - Add a hook that aborts the build if any *.orig file is found. Such files
  755. appear mainly when a patch of ours is fuzzy. In most cases they are no big
  756. deal, but in some cases they end up being taken into account
  757. and break things.
  758. - Replace the tor+http shim with apt-transport-tor (Closes: #8198).
  759. - Install gnome-tweak-tool.
  760. - Don't bother testing if we're using dependency based boot.
  761. - Drop workaround to start spice-vdagent in GDM (Closes: #8025).
  762. This has been fixed in Jessie proper.
  763. - Don't install ipheth-utils anymore. It seems to be obsolete
  764. in current desktop environments.
  765. - Stop installing the buggy unrar-free, superseded in Jessie (Closes: #5838)
  766. - Drop all custom fontconfig configuration, and configure fonts rendering
  767. via dconf.
  768. - Drop zenity patch (zenity-fix-whitespacing-box-sizes.diff),
  769. that was applied upstream.
  770. - Install libnet-dbus-perl (currently 1.1.0) from jessie-backports,
  771. it brings new features we need.
  772. - Have the security check and the upgrader wait for Tor having bootstrapped
  773. with systemd unit ordering.
  774. - Get rid of tails-security-check's wrapper.
  775. Its only purpose was to wait for Tor to have bootstrapped,
  776. which is now done via systemd.
  777. - Don't allow the amnesia and tails-upgrade-frontend users to run
  778. tor-has-bootstrapped as root with sudo. They don't need it anymore,
  779. thanks to using systemd for starting relevant units only once Tor
  780. has bootstrapped.
  781. - Install python-nautilus, that enables MAT's context menu item in Nautilus.
  782. (Closes: #9151).
  783. - Configure GDM with a snippet file instead of patching its
  784. greeter.dconf-defaults.
  785. - WhisperBack:
  786. · port to Python 3 and GObject Introspection (Closes: #7755)
  787. · migrate from the gnutls module to the ssl one
  788. · use PGP/MIME for better attachments handling
  789. · migrate from the gnupginterface module to the gnupg one
  790. · natively support SOCKS ⇒ don't wrap with torsocks anymore
  791. (Closes: #9412)
  792. · don't try to include the obsolete .xession-errors in bug reports
  793. (Closes: #9966)
  794. - chroot-browser.sh: don't use static DISPLAY.
  795. - Simplify debugging:
  796. · don't hide the emergency shutdown's stdout
  797. · tails-unblock-network: trace commands so that they end up in the Journal
  798. - Configure the console codeset at ISO build time, instead of setting it
  799. to a constant via the Greeter's PostLogin.default.
  800. - Order the AppArmor policy compiling in a way that is less of a blocker
  801. during boot.
  802. - Include the major KMS modules in the initramfs. This helps seamless
  803. transition to X.Org when booting, and back to text mode on shutdown,
  804. can help for proper graphics hardware reinitialization post-kexec,
  805. and should improve GNOME Shell support in some virtual machines.
  806. - Always show the Universal Access menu icon in the GNOME panel.
  807. - Drop notification for not-migrated-yet persistence configuration,
  808. and persistence settings disabled due to wrong access rights.
  809. That migration happened more two years ago.
  810. - Remove the restricted network detector, that has been broken for too long;
  811. see #10560 for next steps (Closes: #8328).
  812. - Remove unsupported, never completed kiosk mode support.
  813. - clock_gettime_monotonic: use Perl's own function to get the integer part,
  814. instead of forking out to sed.
  815. - Don't (try to) disable lvm2 initscripts anymore. Both the original reason
  816. and the implementation are obsolete on Jessie.
  817. - Lower potential for confusion (#8443), by removing system-config-printer.
  818. One GUI to configure printers is enough (Closes: #8505).
  819. - Add "set -u" to tails-unblock-network.
  820. - Add a systemd target whose completion indicates that Tor has bootstrapped,
  821. and use it everywhere sensible (Closes: #9393).
  822. - Disable udev's 75-persistent-net-generator.rules, to preventing races
  823. between MAC spoofing and interface naming.
  824. - Replace patch against NetworkManager.conf with drop-in files.
  825. - Replace resolvconf with simpler NetworkManager and dhclient configuration.
  826. (Closes: #7708)
  827. - Replace patching of the gdomap, i2p, hdparm, tor and ttdnsd initscripts
  828. with 'systemctl disable' (Closes: #9881).
  829. - Replace patches that wrapped apps with torsocks with dynamic patching with
  830. a hook, to ease maintenance. Also, patch D-Bus services as needed
  831. (Closes: #10603).
  832. - Notify the user if running Tails inside non-free virtualization software
  833. that does not try to hide its nature (Closes: #5315).
  834. Thanks to Austin English <austinenglish@gmail.com> for the patch.
  835. - Declare htpdate.service as being needed for time-sync.target, to ensure
  836. that "services where correct time is essential should be ordered after
  837. this unit".
  838. - Convert some of the X session startup programs to `systemd --user' units.
  839. - Let the Pidgin wrapper pass through additional command-line arguments
  840. (Closes: #10383)
  841. - Move out of the $PATH a bunch of programs that users should generally
  842. not run directly: connect-socks, end-profile, getTorBrowserUserAgent,
  843. generate-tor-browser-profile, kill-boot-profile, tails-spoof-mac,
  844. tails-set-wireless-devices-state, tails-configure-keyboard,
  845. do_not_ever_run_me, boot-profile, tails-unblock-network,
  846. tor-controlport-filter, tails-virt-notify-user, tails-htp-notify-user,
  847. udev-watchdog-wrapper (Closes: #10658)
  848. - Upgrade I2P to 0.9.23-2~deb8u+1.
  849. - Disable I2P's time syncing support.
  850. - Install Torbirdy from official Jessie backports, instead of from
  851. our own APT repository (Closes: #10804).
  852. - Make GNOME Disks' passphrase strength checking new feature work,
  853. by installing cracklib-runtime (Closes: #10862).
  854. - Add support for Japanese in Tor Browser.
  855. - Install xserver-xorg-video-intel from Jessie Backports (currently:
  856. 2.99.917-2~bpo8+1). This adds support for recent chips such as
  857. Intel Broadwell's HD Graphics (Closes: #10841).
  858. - Improve a little bit post-Greeter network unblocking:
  859. · Sleep a bit longer between deleting the blacklist, and triggering udev;
  860. this might help cure #9012.
  861. · Increase logging, so that we get more information next time someone
  862. sees #9012.
  863. · Touch /etc/modprobe.d/ after deleting the blacklist; this might help,
  864. in case all this is caused by some aufs bug.
  865. - Enable and use the Debian jessie-proposed-updates APT repository,
  866. anticipating on the Jessie 8.3 point-release (Closes: #10897).
  867. - Upgrade most firmware packages to 20160110-1.
  868. - Upgrade Intel CPU microcodes to 3.20151106.1~deb8u1.
  869. - Disable IPv6 for the default wired connection, so that
  870. NetworkManager does not spam the logs with IPv6 router
  871. solicitation failure. Note that this does not fix the problem
  872. for other connections (Partially closes: #10939).
  873. * Test suite
  874. - Adapt to the new desktop environment and applications' look.
  875. - Adapt new changed nmcli syntax and output.
  876. - New NetworkManager connection files must be manually loaded in Jessie.
  877. - Adapt to new pkexec behavior.
  878. - Adapt to how we now disable networking.
  879. - Use sysctl instead of echo:ing into /proc/sys.
  880. - Use oom_score_adj instead of the older oom_adj.
  881. - Adapt everything depending on logs to the use of the Journal.
  882. - Port to UDisks v2.
  883. - Check that the system partition is an EFI System Partition.
  884. - Add ldlinux.c32 to the list of bootloader files that are expected
  885. to be modified when we run syslinux (Closes: #9053).
  886. - Use apt(8) instead of apt-get(8).
  887. - Don't hide the cursor after opening the GNOME apps menu.
  888. - Convert the remote shell to into a systemd native service and a Python 3,
  889. script that uses the sd_notify facility (Closes: #9057). Also, set its
  890. OOM score adjustment value via its unit file, and not from the test suite.
  891. - Adjust to match where screenshots are saved nowadays.
  892. - Check that all system units have started (Closes: #8262)
  893. - Simplify the "too small device" test.
  894. - Spawn `poweroff' and `halt' in the background, and don't wait for them
  895. to return: anything else would be racy vs. the remote shell's stopping.
  896. - Bump video memory allocated to the system under test, to fix out of video
  897. memory errors.
  898. - When configuring the CPU to lack PAE support, use a qemu32 CPU instead
  899. of a Pentium one: the latter makes GNOME Shell crash.
  900. See #8778 for details about how Mesa's CPU features detection has
  901. room for improvement.
  902. - Adjust free(1) output parsing for Jessie.
  903. - vm-execute: rename --type option to --spawn.
  904. - Add method to set the X.Org clipboard, and install its dependency
  905. (xsel) in the ISO.
  906. - Paste URLs in one go, to work around issue with lost key presses
  907. in the browser (Closes: #10467).
  908. - Reliably wait for Synaptic's search button to fade in.
  909. - Take into account that the sticky bit is not set on block devices
  910. on Jessie anymore.
  911. - Ensure that we can use a NetworkManager connection stored in persistence
  912. (Closes: #7966).
  913. - Use a stricter regexp when extracting logs for dropped packets.
  914. - Clone the host CPU for the test suite guests (Closes: #8778).
  915. - Run ping as root (aufs does not support file capabilities so we don't
  916. get cap_net_raw+ep, and if built on a filesystem that does support
  917. file capabilities, then /bin/ping is not setupd root).
  918. - Escape regexp special characters when constructing the firewall log
  919. parsing regexp, and pass -P to grep, since Ruby uses PCRE.
  920. - Adjust is_persistent?() helper to findmnt changes in Jessie.
  921. - Rework in depth how we measure pattern coverage in memory, with more
  922. reliable Linux OOM and VM settings, fundamental improvements
  923. in what exactly we measure, and custom OOM adjutments for fillram
  924. processes (Closes: #9705).
  925. - Use blkid instead of parted to determine the filesystem type.
  926. - Use --kiosk mode instead of --fullscreen in virt-viewer, to remove
  927. the tiny border of the in-viewer menu.
  928. - Remove now redundant desktop screenshot directory scenario.
  929. - Adapt GNOME notification handling for Debian Jessie (Closes: #8782)
  930. - Disable screen blanking in the automated test suite, which occasionally
  931. breaks some test cases (Closes: #10403).
  932. - Move upgrade scenarios to the feature dedicated to them.
  933. - Don't make libvirt storage volumes executable.
  934. - Refactor the PAUSE_ON_FAIL functionality, so that we can use `pause()`
  935. as a breakpoint when debugging.
  936. - Drop non-essential Totem test that is mostly a duplicate, and too painful
  937. to be worth automating on Jessie.
  938. - Retry Totem HTTPS test with a new Tor circuit on failure.
  939. - Replace iptables status regexp-based parser with a new XML-based
  940. status analyzer: the previous implementation could not be adjusted
  941. to the new ip6tables' output (Closes: #9704).
  942. - Don't reboot in one instance when it is not needed.
  943. - Optimize memory erasure anti-test: block the boot to save CPU on the host.
  944. - Update I2P tests for Jessie, and generally make them more robust.
  945. - Update Electrum tests for 2.5.4-2 (Closes: #10758).
  946. - Add workaround for libvirt vs. guestfs permissions issue, to allow
  947. running the test suite on current Debian sid.
  948. - Fix buggy code, that happened to work by mistake, in the Seahorse
  949. test cases; bugfix on 1.8.
  950. - Update test suite images due to CSS change on Tails' website.
  951. - Adapt Tor Browser tests to work with the 5.5 series.
  952. - Automatically test downloading files in Tor Browser.
  953. - Remove obsolete scenario, that tested opening a downloaded file with
  954. an external application, which we do not support anymore.
  955. - Improve robustness of the "Tails OpenPGP keys" scenario (Closes: #10378).
  956. - Automatically test the "Diable all networking" feature (Closes: #10430).
  957. - Automatically test that SSH works over LAN (Closes: #9087).
  958. - Bump some statuc sleeps to fix a few race conditions (Closes: #5330).
  959. - Automatically test that an emergency shutdown triggers on boot
  960. medium removal (Closes: #5472).
  961. - Make the AppArmor checks actually detect errors (Closes: #10926).
  962. * Build system
  963. - Bump amount of disk space needed to build Tails with Vagrant.
  964. The addition of the Japanese Tor Browser tarball made us reach
  965. the limit of the previous value.
  966. * Adjustments for Debian 8 (Jessie) with no or very little user-visible impact
  967. - Free the fixed UIDs/GIDs we need before creating the corresponding users.
  968. - Replace the real gnome-backgrounds with a fake, equivs generated one
  969. (Closes: #8055). Jessie's gnome-shell depends on gnome-backgrounds,
  970. which is too fat to ship considering we're not using it.
  971. - AppArmor: adjust CUPS profile to support our Live system environment
  972. (Closes: #8261):
  973. · Mangle lib/live/mount/overlay/... as usual for aufs.
  974. · Pass the the attach_disconnected flag, that's needed for compatibility
  975. with PrivateTmp.
  976. - Make sure we don't ship geoclue* (Closes: #7949).
  977. - Drop deprecated GDM configuration file.
  978. - Don't add the Live user to the deprecated 'fuse' group.
  979. - Drop hidepid mount option for /proc (Closes: #8256). In its current,
  980. simplistic form it cannot be supported by systemd.
  981. - Don't manually load acpi-cpufreq at boot time. It fails to load
  982. whenever no device it supports is present, which makes the
  983. systemd-modules-load.service fail. These days, the kernel
  984. should just automatically load such modules when they are needed.
  985. - Drop sysvinit-specific (sensigs.omit.d) tweaks for memlockd.
  986. - Disable the GDM unit file's Restart=always, that breaks our "emergency
  987. shutdown on boot medium removal" feature.
  988. - Update the implementation of the memory erasure on shutdown feature:
  989. · check for rebooting state using systemctl, instead of the obsolete
  990. $RUNLEVEL (Closes: #8306)
  991. · the kexec-load initscript normally silently exits unless systemd is
  992. currently running a reboot job. This is not the case when the emergency
  993. shutdown has been triggered, so we removed this check
  994. · migrate tails-kexec to the /lib/systemd/system-shutdown/ facility
  995. · don't (try to) switch to tty1 on emergency shutdown: it apparently
  996. requires data that we haven't locked into memory, and then it blocks
  997. the whole emergency shutdown process
  998. - Display a slightly darker version of the desktop wallpaper on the screen
  999. saver, instead of the default flashy "Debian 8" branding (Closes: #9038).
  1000. - Disable software autorun from external media.
  1001. - Disable a few unneeded D-Bus services. Some of these services are
  1002. automatically started (via D-Bus activation) when GNOME Shell tries
  1003. to use them. The only "use" I've seen for them, except eating
  1004. precious RAM, is to display "No appointment today" in the calendar pop-up.
  1005. (Closes: #9037)
  1006. - Prevent NetworkManager services from starting at boot time
  1007. (Closes: #8313). We start them ourselves after changing the MAC address.
  1008. - Unfuzzy all patches (Closes: #8268) and drop a few obsolete ones.
  1009. - Adapt IBus configuration for Jessie (Closes: #8270), i.e. merge the two
  1010. places where we configure keyboard layout and input methods: both are now
  1011. configured in the same place in Jessie's GNOME.
  1012. - Migrate panel launchers to the favorite apps list (Closes: #7992).
  1013. - Drop pre-GNOME Shell menu tweaks.
  1014. - Hide "Log out" button in the GNOME Shell menu (Closes: #8364).
  1015. - Add a custom shutdown-helper GNOME Shell extension (Closes: #8302, #5684
  1016. and #5878) that removes the press-Alt-to-turn-shutdown-button-into-Suspend
  1017. functionality from the GNOME user menu, and makes Restart and Shutdown
  1018. immediate, without further user interaction. Accordingly remove our custom
  1019. Shutdown Helper panel applet (#8302).
  1020. - Drop GNOME Panel configuration, now deprecated.
  1021. - Disable GNOME Shell's screen lock feature.
  1022. We're not there yet (see #5684).
  1023. - Disable GNOME Shell screen locker's user switch feature.
  1024. - Explicitly install libany-moose-perl (Closes: #8051).
  1025. It's needed by our OpenPGP applet. On Wheezy, this package was pulled
  1026. by some other dependency. This is not the case anymore on Jessie.
  1027. - Don't install notification-daemon nor gnome-mag: GNOME Shell has taken
  1028. over this functionality (Closes: #7481).
  1029. - Don't install ntfsprogs: superseded on Jessie.
  1030. - Don't install barry-util: not part of Jessie.
  1031. - Link udev-watchdog dynamically, and lock it plus its dependencies
  1032. in memory.
  1033. - Migrate from gdm-simple-greeter to a custom gdm-tails session
  1034. (Closes: #7599).
  1035. - Update Plymouth installation and configuration:
  1036. · install the plymouth packages via chroot_local-hooks: lb 2.x's "standard"
  1037. packages list pulls console-common in, which plymouth now conflicts with
  1038. · don't patch the plymouth initscript anymore, that was superseded
  1039. by native systemd unit files
  1040. · mask the plymouth-{halt,kexec,poweroff,reboot,shutdown} services,
  1041. to prevent them from occupying the active TTY with an (empty) splash
  1042. screen on shutdown/reboot, that would hide the messages we want to show
  1043. to the user via tails-kexec (Closes: #9032)
  1044. - Migrate GNOME keyboard layout settings from libgnomekbd to input-sources
  1045. (Closes: #7898).
  1046. - Explicitly install syslinux-efi, that we need and is not automatically
  1047. pulled by anything else anymore.
  1048. - Workaround #7248 for GDM: use a solid blue background picture,
  1049. instead of a solid color fill, in the Greeter session.
  1050. - De-install gcc-4.8-base and gcc-4.9 at the end of the ISO build process.
  1051. - Revert the "Wrap syndaemon to always use -t" Wheezy-specific workaround.
  1052. - htpdate: run date(1) in a Jessie-compatible (and nicer) way.
  1053. - Remove obsolete dconf screenshot settings and the corresponding test.
  1054. - Drop our patched python-dbus{,-dev} package (Closes: #9177).
  1055. - live-persist: stop overriding live-boot's functions, we now have
  1056. a recent enough blkid.
  1057. - Adjust sdmem initramfs bits for Jessie:
  1058. · Directly call poweroff instead of halt -p.
  1059. · Don't pass -n to poweroff and reboot, it's not supported anymore.
  1060. - Wrap text in the Unsafe Browser startup warning dialog
  1061. (Jessie's zenity does not wrap it itself).
  1062. - Associate application/pgp-keys with Seahorse's "Import Key" application
  1063. (Closes: #10571).
  1064. - Install topIcons GNOME Shell extension (v28), to work around the fact
  1065. that a few of the applets we use hijack the notification area.
  1066. - "cd /" to fix permissions issue at tails-persistence-setup startup
  1067. (Closes: #8097).
  1068. - Install gstreamer1.0-libav, so that Totem can play H264-encoded videos.
  1069. - Adjust APT sources configuration:
  1070. · remove explicit jessie and jessie-updates sources:
  1071. automatically added by live-build
  1072. · add Debian testing
  1073. · add jessie-backports
  1074. - Firewall: white-list access to the accessibility daemon (Closes: #8075).
  1075. - Adjust to changed desktop notification behavior and supported feature set
  1076. (Closes: #7989):
  1077. · pass the DBUS_SESSION_BUS_ADDRESS used by the GNOME session
  1078. to notify-send
  1079. · update waiting for a notification handler: gnome-panel and nm-applet
  1080. are obsolete, GNOME Shell is now providing this facility, so instead
  1081. wait for a process that starts once GNOME Shell is ready, namely
  1082. ibus-daemon (Closes: #8685)
  1083. · port tails-warn-about-disabled-persistence and tails-virt-notify-user
  1084. to notification actions (instead of hyperlinks), and make the latter
  1085. transient; to this end, add support to Desktop::Notify for "hints"
  1086. and notification actions
  1087. · tails-security-check: use a dialog box instead of desktop notifications
  1088. · MAC spoofing failure notification: remove the link to the documentation;
  1089. it was broken on Tails/Wheezy already, see #10559 for next steps
  1090. - Don't explicitly install gnome-panel nor gnome-menus, so that they go away
  1091. whenever the Greeter does not pull them in anymore.
  1092. - Install gkbd-capplet, that provides gkbd-keyboard-display (Closes: #8363).
  1093. - Install Tor 0.2.7 from deb.torproject.org: we don't need to rebuild it
  1094. ourselves for seccomp support anymore.
  1095. - Wrap Seahorse with torsocks when it is started as a D-Bus service too
  1096. (Closes: #9792).
  1097. - Rename the AppArmor profile for Tor, so it applies to the system-wide
  1098. Tor service we run (Closes: #10528).
  1099. - Essentially revert ALSA state handling to how it was pre-Jessie, so that
  1100. mixer levels are unmuted and sanitized at boot time (Closes: #7591).
  1101. - Pass --yes to apt-get when installing imagemagick.
  1102. - Make removable devices, that we support installing Tails to, user writable:
  1103. Tails Installer requires raw block device access to such devices
  1104. (Closes: #8273). Similarly, allow the amnesia user, when active, to open
  1105. non-system devices for writing with udisks2. This is roughly udisks2's
  1106. equivalent of having direct write access to raw block storage devices.
  1107. Here too, Tails Installer uses this functionality.
  1108. - Disable networkd to prevent any risk of DNS leaks it might cause; and
  1109. disable timesyncd, as we have our own time synchronization mechanism.
  1110. They are not enabled by default in Jessie, but may be in Stretch,
  1111. so let's be explicit about it.
  1112. - Mask hwclock-save.service, to avoid sync'ing the system clock
  1113. to the hardware clock on shutdown (Closes: #9363).
  1114. - apparmor-adjust-cupsd-profile.diff: adjust to parse fine on Jessie
  1115. (Closes: #9963)
  1116. - Explicitly use tor@default.service when it's the one we mean.
  1117. - Refactor GNOME/X env exporting to Tails' shell library, and grab
  1118. more of useful bits of the desktop session environment.
  1119. Then, use the result in the test suite's remote shell.
  1120. - Stop tweaking /etc/modules. It's 2015, the kernel should load these things
  1121. automatically (Closes: #10609).
  1122. - Have systemd hardening let Tor modify its configuration (needed by Tor
  1123. Launcher), and start obfs4proy (Closes: #10696, #10724).
  1124. - Bump extensions.adblockplus.currentVersion and
  1125. extensions.enigmail.configuredVersion to match what we currently get
  1126. on Jessie.
  1127. - I2P: switch from 'service' to 'systemctl' where possible.
  1128. -- Tails developers <tails@boum.org> Mon, 25 Jan 2016 18:06:33 +0100
  1129. tails (1.8.2) unstable; urgency=medium
  1130. * Security fixes
  1131. - Upgrade Tor Browser to 5.0.7.
  1132. - Upgrade Linux to 3.16.7-ckt20-1+deb8u2.
  1133. - Upgrade foomatic-filters to 4.0.17-1+deb7u1.
  1134. - Upgrade git to 1:1.7.10.4-1+wheezy2.
  1135. - Upgrade Icedove to 38.5.0-1~deb7u1.
  1136. - Upgrade libxml2-related packages to 2.8.0+dfsg1-7+wheezy5.
  1137. - Upgrade OpenSSL-related packages to 1.0.1e-2+deb7u19.
  1138. - Upgrade libsmbclient to 2:3.6.6-6+deb7u6.
  1139. -- Tails developers <tails@boum.org> Sat, 09 Jan 2016 16:27:27 +0100
  1140. tails (1.8.1) unstable; urgency=medium
  1141. * Security fixes
  1142. - Upgrade Tor Browser to 5.0.6.
  1143. - Upgrade Linux to 3.16.7-ckt20-1+deb8u1
  1144. - Upgrade gdkpixbuf to 2.26.1-1+deb7u3
  1145. - Upgrade bind9 tools to 1:9.8.4.dfsg.P1-6+nmu2+deb7u8
  1146. * Bugfixes
  1147. - Fix time synchronization in bridge mode by refreshing our patch
  1148. against Tor's AppArmor profile.
  1149. -- Tails developers <tails@boum.org> Fri, 18 Dec 2015 19:05:18 +0000
  1150. tails (1.8) unstable; urgency=medium
  1151. * Security fixes
  1152. - Upgrade Tor to 0.2.7.6-1~d70.wheezy+1+tails1.
  1153. - Upgrade Tor Browser to 5.0.5. (Closes: #10751)
  1154. - Upgrade LibreOffice to 1:3.5.4+dfsg2-0+deb7u5.
  1155. - Upgrade krb5-based packages to 1.10.1+dfsg-5+deb7u6.
  1156. - Upgrade Linux to 3.16.7-ckt11-1+deb8u6.
  1157. - Upgrade wpasupplicant to 1.0-3+deb7u3.
  1158. - Upgrade libpng12-0 to 1.2.49-1+deb7u1.
  1159. - Upgrade openjdk-7 to 7u91-2.6.3-1~deb7u1.
  1160. - Upgrade libnspr4 to 2:4.9.2-1+deb7u3
  1161. - Upgrade dpkg to 1.16.17.
  1162. - Upgrade gnutls26 to 2.12.20-8+deb7u4.
  1163. - Upgrade Icedove to 1:38.0.1-1~deb7u1.
  1164. - Upgrade OpenSSL to 1.0.1e-2+deb7u18.
  1165. * Bugfixes
  1166. - Upgrade to Electrum 2.5.4-2~d70.wheezy+1+tails1. Now Electrum
  1167. should work again. Note that the documentation has not been
  1168. adapted to the slight changes in the Electrum account setup
  1169. wizard yet.
  1170. * Minor improvements
  1171. - Upgrade I2P to 0.9.23-2~deb7u+1.
  1172. - Rebase our patch against the Tor Browser AppArmor profile on top
  1173. of the one shipped in torbrowser-launcher 0.2.1-2.
  1174. - Warn if the claws-mail persistence is enabled and contains a
  1175. Claws Mail configuration when starting icedove. (Closes: #10458)
  1176. - Replace the Claws Mail GNOME launcher with Icedove. (Closes:
  1177. #10739)
  1178. - Remove the Claws Mail persistence feature from the Persistence
  1179. Assistant. (Closes: #10742)
  1180. * Build system
  1181. - Simplify ISO image naming rules by using the base rule we use
  1182. for Jenkins all the time, except when building from a tag
  1183. (i.e. building a release). (Closes: #10349)
  1184. * Test suite
  1185. - Lower the waiting time for USB installation in the test suite.
  1186. So far we were waiting up to one hour, which is just the same as
  1187. our Jenkins inactivity timeout, so in practice when Tails
  1188. Installer fails and displays an error message, instead of
  1189. reporting that the job failed (which is the point of the
  1190. exercise) we abort the job due to this timeout which
  1191. communicates less clearly that there's probably a bug. (Closes:
  1192. #10718)
  1193. - Remove the check for the sound icon in the systray in the
  1194. Windows Camouflage tests. (Closes: #10493)
  1195. - Retry running whois when "LIMIT EXCEEDED" is in its output for
  1196. increased robustness. (Closes: #10523)
  1197. - Make Seahorse tests more robust. (Closes: #9095, #10501)
  1198. - Make the handling of Pidgin's account manager more robust.
  1199. (Closes: #10506)
  1200. -- Tails developers <tails@boum.org> Mon, 14 Dec 2015 23:07:19 +0100
  1201. tails (1.7) unstable; urgency=medium
  1202. * Major new features and changes
  1203. - Upgrade Tor Browser to 5.0.4. (Closes: #10456)
  1204. - Add a technology preview of the Icedove Email client (a
  1205. rebranded version of Mozilla Thunderbird), including OpenPGP
  1206. support via the Enigmail add-on, general security and anonymity
  1207. improvements via the Torbirdy add-on, and complete persistence
  1208. support (which will be enabled automatically if you already have
  1209. Claws Mail persistence enabled). Icedove will replace Claws Mail
  1210. as the supported email client in Tails in a future
  1211. release. (Closes: #6151, #9498, #10285)
  1212. - Upgrade Tor to 0.2.7.4-rc-1~d70.wheezy+1+tails1. Among the many
  1213. improvement of this new Tor major release, the new
  1214. KeepAliveIsolateSOCKSAuth option allows us to drop the
  1215. bug15482.patch patch (taken from the Tor Browse bundle) that
  1216. enabled similar (but inferior) functionality for *all*
  1217. SocksPort:s -- now the same circuit is only kept alive for
  1218. extended periods for the SocksPort used by the Tor
  1219. Browser. (Closes: #10194, #10308)
  1220. - Add an option to Tails Greeter which disables networking
  1221. completely. This is useful when intending to use Tails for
  1222. offline work only. (Closes: #6811)
  1223. * Security fixes
  1224. - Fix CVE-2015-7665, which could lead to a network interface's IP
  1225. address being exposed through wget. (Closes: #10364)
  1226. - Prevent a symlink attack on ~/.xsession-errors via
  1227. tails-debugging-info which could be used by the amnesia user to
  1228. read the contents of any file, no matter the
  1229. permissions. (Closes: #10333)
  1230. - Upgrade libfreetype6 to 2.4.9-1.1+deb7u2.
  1231. - Upgrade gdk-pixbuf packages to 2.26.1-1+deb7u2.
  1232. - Upgrade Linux to 3.16.7-ckt11-1+deb8u5.
  1233. - Upgrade openjdk-7 packages to 7u85-2.6.1-6~deb7u1.
  1234. - Upgrade unzip to 6.0-8+deb7u4.
  1235. * Bugfixes
  1236. - Add a temporary workaround for an issue in our code which checks
  1237. whether i2p has bootstrapped, which (due to some recent change
  1238. in either I2P or Java) could make it appear it had finished
  1239. prematurely. (Closes: #10185)
  1240. - Fix a logical bug in the persistence preset migration code while
  1241. real-only persistence is enabled. (Closes: #10431)
  1242. * Minor improvements
  1243. - Rework the wordings of the various installation and upgrade
  1244. options available in Tails installer in Wheezy. (Closes: #9672)
  1245. - Restart Tor if bootstrapping stalls for too long when not using
  1246. pluggable transports. (Closes: #9516)
  1247. - Install firmware-amd-graphics, and firmware-misc-nonfree instead
  1248. of firmware-ralink-nonfree, both from Debian Sid.
  1249. - Update the Tails signing key. (Closes: #10012)
  1250. - Update the Tails APT repo signing key. (Closes: #10419)
  1251. - Install the nmh package. (Closes: #10457)
  1252. - Explicitly run "sync" at the end of the Tails Upgrader's upgrade
  1253. process, and pass the "sync" option when remounting the system
  1254. partition as read-write. This might help with some issues we've
  1255. seen, such as #10239, and possibly for #8449 as well.
  1256. * Test suite
  1257. - Add initial automated tests for Icedove. (Closes: #10332)
  1258. - Add automated tests of the MAC spoofing feature. (Closes: #6302)
  1259. - Drop the concept of "background snapshots" and introduce a general
  1260. system for generating snapshots that can be shared between
  1261. features. This removes all silly hacks we previously used to
  1262. "skip" steps, and greatly improves performance and reliability
  1263. of the whole test suite. (Closes: #6094, #8008)
  1264. - Flush to the log file in debug_log() so the debugging info can
  1265. be viewed in real time when monitoring the debug log
  1266. file. (Closes: #10323)
  1267. - Force UTF-8 locale in automated test suite. Ruby will default to
  1268. the system locale, and if it is non-UTF-8, some String-methods
  1269. will fail when operating on non-ASCII strings. (Closes: #10359)
  1270. - Escape regexp used to match nick in CTCP replies. Our Pidgin
  1271. nick's have a 10% chance to include a ^, which will break that
  1272. regexp. We need to escape all characters in the nick. (Closes:
  1273. #10219)
  1274. - Extract TBB languages from the Tails source code. This will
  1275. ensure that valid locales are tested. As an added bonus, the
  1276. code is greatly simplified. (Closes: #9897)
  1277. - Automatically test that tails-debugging-info is not susceptible
  1278. to the type of symlink attacks fixed by #10333.
  1279. - Save all test suite artifacts in a dedicated directory with more
  1280. useful infromation encoded in the path. This makes it easier to
  1281. see which artifacts belongs to which failed scenario and which
  1282. run. (Closes: #10151)
  1283. - Log all useful information via Cucumber's formatters instead of
  1284. printing to stderr, which is not included when logging to file
  1285. via `--out`. (Closes: #10342)
  1286. - Continue running the automated test suite's vnc server even if
  1287. the client disconnects. (Closes: #10345)
  1288. - Add more automatic tests for I2P. (Closes: #6406)
  1289. - Bump the Tor circuit retry count to 10. (Closes: #10375)
  1290. - Clean up dependencies: (Closes: #10208)
  1291. * libxslt1-dev
  1292. * radvd
  1293. * x11-apps
  1294. -- Tails developers <tails@boum.org> Tue, 03 Nov 2015 01:09:41 +0100
  1295. tails (1.6) unstable; urgency=medium
  1296. * Security fixes
  1297. - Upgrade Tor Browser to 5.0.3. (Closes: #10223)
  1298. - Upgrade bind9-based packages to 1:9.8.4.dfsg.P1-6+nmu2+deb7u7.
  1299. - Upgrade liblcms1 to 1.19.dfsg2-1.2+deb7u1.
  1300. - Upgrade libldap-2.4-2 to 2.4.31-2+deb7u1.
  1301. - Upgrade libslp1 to 1.2.1-9+deb7u1.
  1302. - Upgrade ssl-cert to 1.0.32+deb7u1.
  1303. * Bugfixes
  1304. - Fix a corner case for the MAC spoofing panic mode. If panic mode
  1305. failed to disable the specific device that couldn't be spoofed
  1306. (by unloading the module) we disable networking. Previously we
  1307. only stopped NetworkManager. The problem is that NM isn't even
  1308. started at this time, but will specifically be started when
  1309. we're done with MAC spoofing. Therefore, let's completely
  1310. disable NetworkManager so it cannot possibly be
  1311. started. (Closes: #10160)
  1312. - Avoid use of uninitialized value in restricted-network-detector.
  1313. If NetworkManager decides that a wireless connection has timed
  1314. out before "supplicant connection state" has occued, our idea of
  1315. the state is `undef`, so it cannot be used in a string
  1316. comparison. Hence, let's initialize the state to the empty
  1317. string instead of `undef`. Also fix the state
  1318. recording. Apparently NetworkManager can say a few different
  1319. things when it logs the device state transitions. (Closes:
  1320. #7689)
  1321. * Minor improvements
  1322. - Remove workaround for localizing search engine plugins. The
  1323. workaround has recently become unnecessary, possibly due to the
  1324. changes made for the seach bar after the Tor Browser was rebased
  1325. on Firefox 38esr. (Closes: #9146)
  1326. - Refer to the I2P Browser in the I2P notifications. Instead of
  1327. some obscure links that won't work in the Tor Browser, where
  1328. users likely will try them, and which I believe will open them
  1329. by default. (Closes: #10182)
  1330. - Upgrade I2P to 0.9.22. Also set the I2P apparmor profile to
  1331. enforce mode. (Closes: #9830)
  1332. * Test suite
  1333. - Test that udev-watchdog is monitoring the correct device when
  1334. booted from USB. (Closes: #9890)
  1335. - Remove unused 'gksu' step. This causes a false-positive to be
  1336. found for #5330. (Closes: #9877)
  1337. - Make --capture capture individual videos for failed scenarios
  1338. only, and --capture-all to capture videos for all scenarios.
  1339. (Closes: #10148)
  1340. - Use the more efficient x264 encoding when capturing videos using
  1341. the --capture* options. (Closes: #10001)
  1342. - Make --old-iso default to --iso if omitted. Using the same ISO
  1343. for the USB upgrade tests most often still does what we want,
  1344. e.g. test that the current version of Tails being tested has a
  1345. working Tails installer. Hence this seems like a reasonable
  1346. default. (Closes: #10147)
  1347. - Avoid nested FindFailed exceptions in waitAny()/findAny(), and
  1348. throw a new dedicated FindAnyFailed exception if these fail
  1349. instead. Rjb::throw doesn't block Ruby's execution until the
  1350. Java exception has been received by Ruby, so strange things can
  1351. happen and we must avoid it. (Closes: #9633)
  1352. - Fix the Download Management page in our browsers. Without the
  1353. browser.download.panel.shown pref set, the progress being made
  1354. will not update until after the browser has been restarted.
  1355. (Closes: #8159)
  1356. - Add a 'pretty_debug' (with an alias: 'debug') Cucumber formatter
  1357. that deals with debugging instead of printing it to STDERR via
  1358. the `--debug` option (which now has been removed). This gives us
  1359. the full flexibility of Cucumber's formatter system, e.g. one
  1360. easy-to-read formatter can print to the terminal, while we get
  1361. the full debug log printed to a file. (Closes: #9491)
  1362. - Import logging module in otr-bot.py. Our otr-bot.py does not use
  1363. logging but the jabberbot library makes logging calls, causing a
  1364. one-off message “No handlers could be found for logger
  1365. "jabberbot"” to be printed to the console. This commit
  1366. effectively prevents logging/outputting anything to the terminal
  1367. which is at a level lower than CRITICAL. (Closes: 9375)
  1368. - Force new Tor circuit and reload web site on browser
  1369. timeouts. (Closes: #10116)
  1370. - Focus Pidgin's buddy list before trying to access the tools
  1371. menu. (Closes: #10217)
  1372. - Optimize IRC test using waitAny. If connecting to IRC fails,
  1373. such as when OFTC is blocking Tor, waiting 60 seconds to connect
  1374. while a a Reconnect button is visible is sub-optimal. It would
  1375. be better to try forcing a new Tor circuit and clicking the
  1376. reconnect button. (Closes: #9653)
  1377. - Wait for (and focus if necessary) Pidgin's Certificate windows.
  1378. (Closes: #10222)
  1379. -- Tails developers <tails@boum.org> Sun, 20 Sep 2015 17:47:26 +0000
  1380. tails (1.5.1) unstable; urgency=medium
  1381. * Security fixes
  1382. - Upgrade Tor Browser to 5.0.2. (Closes: #10112)
  1383. - Upgrade gdk-pixbuf packages to 2.26.1-1+deb7u1.
  1384. - Upgrade libnss3 to 2:3.14.5-1+deb7u5.
  1385. * Bugfixes
  1386. - Refresh Tor Browser AppArmor profile patch. The old one doesn't
  1387. apply on top of testing's torbrowser-launcher anymore.
  1388. * Build system
  1389. - Make sure Jenkins creates new jobs to build the testing branch
  1390. after freezes. (Closes: #9925)
  1391. -- Tails developers <tails@boum.org> Fri, 28 Aug 2015 01:52:14 +0200
  1392. tails (1.5) unstable; urgency=medium
  1393. * Major new features and changes
  1394. - Move LAN web browsing from Tor Browser to the Unsafe Browser,
  1395. and forbid access to the LAN from the former. (Closes: #7976)
  1396. - Install a 32-bit GRUB EFI boot loader. This at least works
  1397. on some Intel Baytrail systems. (Closes: #8471)
  1398. * Security fixes
  1399. - Upgrade Tor Browser to 5.0, and integrate it:
  1400. · Disable Tiles in all browsers' new tab page.
  1401. · Don't use geo-specific search engine prefs in our browsers.
  1402. · Hide Tools -> Set Up Sync, Tools -> Apps (that links to the Firefox
  1403. Marketplace), and the "Share this page" button in the Tool bar.
  1404. · Generate localized Wikipedia search engine plugin icons so the
  1405. English and localized versions can be distinguished in the new
  1406. search bar. (Closes: #9955)
  1407. - Fix panic mode on MAC spoofing failure. (Closes: #9531)
  1408. - Deny Tor Browser access to global tmp directories with AppArmor,
  1409. and give it its own $TMPDIR. (Closes: #9558)
  1410. - Tails Installer: don't use a predictable file name for the subprocess
  1411. error log. (Closes: #9349)
  1412. - Pidgin AppArmor profile: disable the launchpad-integration abstraction,
  1413. which is too wide-open.
  1414. - Use aliases so that our AppArmor policy applies to
  1415. /lib/live/mount/overlay/ and /lib/live/mount/rootfs/*.squashfs/ as well as
  1416. it applies to /. And accordingly:
  1417. · Upgrade AppArmor packages to 2.9.0-3~bpo70+1.
  1418. · Install rsyslog from wheezy-backports, since the version from Wheezy
  1419. conflicts with AppArmor 2.9.
  1420. · Stop installing systemd for now: the migration work is being done in
  1421. the feature/jessie branch, and it conflicts with rsyslog from
  1422. wheezy-backports.
  1423. · Drop apparmor-adjust-user-tmp-abstraction.diff: obsoleted.
  1424. · apparmor-adjust-tor-profile.diff: simplify and de-duplicate rules.
  1425. · Take into account aufs whiteouts in the system_tor profile.
  1426. · Adjust the Vidalia profile to take into account Live-specific paths.
  1427. - Upgrade Linux to 3.16.7-ckt11-1+deb8u3.
  1428. - Upgrade bind9-host, dnsutils and friends to 1:9.8.4.dfsg.P1-6+nmu2+deb7u6.
  1429. - Upgrade cups-filters to 1.0.18-2.1+deb7u2.
  1430. - Upgrade ghostscript to 9.05~dfsg-6.3+deb7u2.
  1431. - Upgrade libexpat1 to 2.1.0-1+deb7u2.
  1432. - Upgrade libicu48 to 4.8.1.1-12+deb7u3.
  1433. - Upgrade libwmf0.2-7 to 0.2.8.4-10.3+deb7u1.
  1434. - Upgrade openjdk-7 to 7u79-2.5.6-1~deb7u1.
  1435. * Bugfixes
  1436. - Upgrade Tor to 0.2.6.10-1~d70.wheezy+1+tails1.
  1437. * Minor improvements
  1438. - Tails Installer: let the user know when it has rejected a candidate
  1439. destination device because it is too small. (Closes: #9130)
  1440. - Tails Installer: prevent users from trying to "upgrade" a device
  1441. that contains no Tails, or that was not installed with Tails Installer.
  1442. (Closes: #5623)
  1443. - Install libotr5 and pidgin-otr 4.x from wheezy-backports. This adds
  1444. support for the OTRv3 protocol and for multiple concurrent connections
  1445. to the same account. (Closes: #9513)
  1446. - Skip warning dialog when starting Tor Browser while being offline,
  1447. in case it is already running. Thanks to Austin English for the patch!
  1448. (Closes: #7525)
  1449. - Install the apparmor-profiles package (Closes: #9539), but don't ship
  1450. a bunch of AppArmor profiles we don't use, to avoid increasing
  1451. boot time. (Closes: #9757)
  1452. - Ship a /etc/apparmor.d/tunables/home.d/tails snippet, instead
  1453. of patching /etc/apparmor.d/tunables/home.
  1454. - live-boot: don't mount tmpfs twice on /live/overlay, so that the one which
  1455. is actually used as the read-write branch of the root filesystem's union
  1456. mount, is visible. As a consequence:
  1457. · One can now inspect how much space is used, at a given time, in the
  1458. read-write branch of the root filesystem's union mount.
  1459. · We can make sure our AppArmor policy works fine when that filesystem
  1460. is visible, which is safer in case e.g. live-boot's behavior changes
  1461. under our feet in the future... or in case these "hidden" files are
  1462. actually accessible somehow already.
  1463. * Build system
  1464. - Add our jenkins-tools repository as a Git submodule, and replace
  1465. check_po.sh with a symlink pointing to the same script in that submodule.
  1466. Adjust the automated test suite accordingly. (Closes: #9567)
  1467. - Bump amount of RAM needed for Vagrant RAM builds to 7.5 GiB. In
  1468. particular the inclusion of the Tor Browser 5.0 series has recently
  1469. increased the amount of space needed to build Tails. (Closes: #9901)
  1470. * Test suite
  1471. - Test that the Tor Browser cannot access LAN resources.
  1472. - Test that the Unsafe Browser can access the LAN.
  1473. - Installer: test new behavior when trying to upgrade an empty device, and
  1474. when attempting to upgrade a non-Tails FAT partition on GPT; also, take
  1475. into account that all unsupported upgrade scenarios now trigger
  1476. the same behavior.
  1477. - Request a new Tor circuit and re-run the Seahorse and GnuPG CLI tests
  1478. on failure. (Closes: #9518, #9709)
  1479. - run_test_suite: remove control chars from log file even when cucumber
  1480. exits with non-zero. (Closes: #9376)
  1481. - Add compatibility with cucumber 2.0 and Debian Stretch. (Closes: #9667)
  1482. - Use custom exception when 'execute_successfully' fails.
  1483. - Retry looking up whois info on transient failure. (Closes: #9668)
  1484. - Retry wget on transient failure. (Closes: #9715)
  1485. - Test that Tor Browser cannot access files in /tmp.
  1486. - Allow running the test suite without ntp installed. There are other means
  1487. to have an accurate host system clock, e.g. systemd-timesyncd and tlsdate.
  1488. (Closes: #9651)
  1489. - Bump timeout in the Totem feature.
  1490. - Grep memory dump using the --text option. This is necessary with recent
  1491. versions of grep, such as the one in current Debian sid, otherwise it
  1492. will count only one occurrence of the pattern we're looking for.
  1493. (Closes: #9759)
  1494. - Include execute_successfully's error in the exception, instead
  1495. of writing it to stdout via puts. (Closes: #9795)
  1496. - Test that udev-watchdog is actually monitoring the correct device.
  1497. (Closes: #5560)
  1498. - IUK: workaround weird Archive::Tar behaviour on current sid.
  1499. - Test the SocksPort:s given in torrc in the Unsafe Browser.
  1500. This way we don't get any sneaky errors in case we change them and
  1501. forget to update this test.
  1502. - Directly verify AppArmor blocking of the Tor Browser by looking in
  1503. the audit log: Firefox 38 does no longer provide any graphical feedback
  1504. when the kernel blocks its access to files the user wants to access.
  1505. - Update browser-related automated test suite images, and workaround
  1506. weirdness introduced by the new Tor Browser fonts.
  1507. - Test that Pidgin, Tor Browser, Totem and Evince cannot access ~/.gnupg
  1508. via alternate, live-boot generated paths.
  1509. - Adjust tests to cope with our new AppArmor aliases.
  1510. - Bump memory allocated to the system under test to 2 GB. (Closes: #9883)
  1511. -- Tails developers <tails@boum.org> Mon, 10 Aug 2015 19:12:58 +0200
  1512. tails (1.4.1) unstable; urgency=medium
  1513. * Security fixes
  1514. - Upgrade Tor Browser to 4.5.3, based on Firefox 31.8.0 ESR. (Closes: #9649)
  1515. - Upgrade Tor to 0.2.6.9-1~d70.wheezy+1+tails2, which includes a circuit
  1516. isolation bugfix. (Closes: #9560)
  1517. - AppArmor: deny Tor Browser access to the list of recently used files.
  1518. (Closes: #9126)
  1519. - Upgrade OpenSSL to 1.0.1e-2+deb7u17.
  1520. - Upgrade Linux to 3.16.7-ckt11-1.
  1521. - Upgrade CUPS to 1.5.3-5+deb7u6.
  1522. - Upgrade FUSE to 2.9.0-2+deb7u2.
  1523. - Upgrade libsqlite3-0 to 3.7.13-1+deb7u2.
  1524. - Upgrade ntfs-3g and ntfsprogs to 1:2012.1.15AR.5-2.1+deb7u2.
  1525. - Upgrade p7zip-full to 9.20.1~dfsg.1-4+deb7u1.
  1526. * Bugfixes
  1527. - Fix automatic upgrades in Windows Camouflage mode. (Closes: #9413)
  1528. - Don't ship the snakeoil SSL key pair generated by ssl-cert in the ISO.
  1529. (Closes: #9416)
  1530. - Partially fix the truncated notifications issue. (#7249)
  1531. * Minor improvements
  1532. - Disable the hwclock.sh initscript at reboot/shutdown time.
  1533. This is an additional safety measure to ensure that the hardware clock
  1534. is not modified. (Closes: #9364)
  1535. - Stop shipping /var/cache/man/*, to make ISOs and IUKs smaller.
  1536. (Closes: #9417)
  1537. - Update torbrowser-AppArmor-profile.patch to apply cleanly on top of the
  1538. profile shipped with torbrowser-launcher 0.2.0-1.
  1539. - Add the jessie/updates APT repo and set appropriate pinning.
  1540. - Upgrade Electrum to 1.9.8-4~bpo70+1.
  1541. - Upgrade kernel firmware packages to 0.44.
  1542. * Build system
  1543. - Install the Linux kernel from Debian Jessie. (Closes: #9341)
  1544. - Remove files that are not under version control when building in Jenkins.
  1545. (Closes: #9406)
  1546. - Don't modify files in the source tree before having possibly merged
  1547. the base branch into it. (Closes: #9406)
  1548. - Make it so eatmydata is actually used during a greater part of the build
  1549. process. This includes using eatmydata from wheezy-backports.
  1550. (Closes: #9419, #9523)
  1551. - release script: adjust to support current Debian sid.
  1552. * Test suite
  1553. - Test the system clock sanity check we do at boot. (Closes: #9377)
  1554. - Remove the impossible "Clock way in the past" scenarios.
  1555. Thanks to config/chroot_local-includes/lib/live/config/0001-sane-clock,
  1556. these scenarios cannot happen, and since we test that it works they
  1557. can be safely removed.
  1558. - Test that the hardware clock is not modified at shutdown. (Closes: #9557)
  1559. - Pidgin: retry looking for the roadmap URL in the topic.
  1560. - Avoid showing Pidgin's tooltips during test, potentially confusing Sikuli.
  1561. (Closes: #9317)
  1562. - Test all OpenPGP keys shipped with Tails. (Closes: #9402)
  1563. - Check that notification-daemon is running when looking for notifications
  1564. fails. (Closes: #9332)
  1565. - Allow using the cucumber formatters however we want. (Closes: #9424)
  1566. - Enable Spice in the guest, and blacklist the psmouse kernel module,
  1567. to help with lost mouse events. (Closes: #9425)
  1568. - Automate testing Torbutton's 'New Identity' feature. (Closes: #9286)
  1569. - Test that Seahorse is configured to use the correct keyserver.
  1570. (Closes: #9339)
  1571. - Always export TMPDIR back to the test suite's shell environment.
  1572. (Closes: #9479)
  1573. - Make OpenPGP tests more reliable:
  1574. · Retry accessing the OpenPGP applet menus on failure. (Closes: #9355)
  1575. · Retry accessing menus in Seahorse on failure. (Closes: #9344)
  1576. - Focus the Pidgin conversation window before any attempt to interact
  1577. with it. (Closes: #9317)
  1578. - Use convertkey from the (backported to Jessie) Debian package,
  1579. instead of our own copy of that script. (Closes: #9066)
  1580. - Make the memory erasure tests more robust (Closes: #9329):
  1581. · Bump /proc/sys/vm/min_free_kbytes when running fillram.
  1582. · Actually set oom_adj for the remote shell when running fillram.
  1583. · Try to be more sure that we OOM kill fillram.
  1584. · Run fillram as non-root.
  1585. - Only try to build the storage pool if TailsToasterStorage isn't found.
  1586. (Closes: #9568)
  1587. -- Tails developers <tails@boum.org> Sun, 28 Jun 2015 19:46:25 +0200
  1588. tails (1.4) unstable; urgency=medium
  1589. * Major new features
  1590. - Upgrade Tor Browser to 4.5.1, based on Firefox 31.7.0 ESR, which
  1591. introduces many major new features for usability, security and
  1592. privacy. Unfortunately its per-tab circuit view did not make it
  1593. into Tails yet since it requires exposing more Tor state to the
  1594. user running the Tor Browser than we are currently comfortable
  1595. with. (Closes: #9031, #9369)
  1596. - Upgrade Tor to 0.2.6.7-1~d70.wheezy+1+tails2. Like in the Tor
  1597. bundled with the Tor Browser, we patch it so that circuits used
  1598. for SOCKSAuth streams have their lifetime increased indefinitely
  1599. while in active use. This currently only affects the Tor Browser
  1600. in Tails, and should improve the experience on certain web sites
  1601. that otherwise would switch language or log you out every ten
  1602. minutes or so when Tor switches circuit. (Closes: #7934)
  1603. * Security fixes
  1604. - tor-browser wrapper script: avoid offering avenues to arbitrary
  1605. code execution to e.g. an exploited Pidgin. AppArmor Ux rules
  1606. don't sanitize $PATH, which can lead to an exploited application
  1607. (that's allowed to run this script unconfined, e.g. Pidgin)
  1608. having this script run arbitrary code, violating that
  1609. application's confinement. Let's prevent that by setting PATH to
  1610. a list of directories where only root can write. (Closes: #9370)
  1611. - Upgrade Linux to 3.16.7-ckt9-3.
  1612. - Upgrade curl to 7.26.0-1+wheezy13.
  1613. - Upgrade dpkg to 1.16.16.
  1614. - Upgrade gstreamer0.10-plugins-bad to 0.10.23-7.1+deb7u2.
  1615. - Upgrade libgd2-xpm to 2.0.36~rc1~dfsg-6.1+deb7u1.
  1616. - Upgrade openldap to 2.4.31-2.
  1617. - Upgrade LibreOffice to 1:3.5.4+dfsg2-0+deb7u4.
  1618. - Upgrade libruby1.9.1 to 1.9.3.194-8.1+deb7u5.
  1619. - Upgrade libtasn1-3 to 2.13-2+deb7u2.
  1620. - Upgrade libx11 to 2:1.5.0-1+deb7u2.
  1621. - Upgrade libxml-libxml-perl to 2.0001+dfsg-1+deb7u1.
  1622. - Upgrade libxml2 to 2.8.0+dfsg1-7+wheezy4.
  1623. - Upgrade OpenJDK to 7u79-2.5.5-1~deb7u1.
  1624. - Upgrade ppp to 2.4.5-5.1+deb7u2.
  1625. * Bugfixes
  1626. - Disable security warnings when connecting to POP3 and IMAP ports.
  1627. (Closes: #9327)
  1628. - Make the Windows 8 browser theme compatible with the Unsafe and I2P
  1629. browsers. (Closes: #9138)
  1630. - Hide Torbutton's "Tor Network Settings..." context menu entry.
  1631. (Closes: #7647)
  1632. - Upgrade the syslinux packages to support booting Tails on
  1633. Chromebook C720-2800. (Closes: #9044)
  1634. - Enable localization in Tails Upgrader. (Closes: #9190)
  1635. - Make sure the system clock isn't before the build date during
  1636. early boot. Our live-config hook that imports our signing keys
  1637. depend on that the system clock isn't before the date when the
  1638. keys where created. (Closes: #9149)
  1639. - Set GNOME's OpenPGP keys via desktop.gnome.crypto.pgp to prevent
  1640. us from getting GNOME's default keyserver in addition to our
  1641. own. (Closes: #9233)
  1642. - Prevent Firefox from crashing when Orca is enabled: grant
  1643. it access to assistive technologies in its Apparmor
  1644. profile. (Closes: #9261)
  1645. - Add Jessie APT source. (Closes: #9278)
  1646. - Fix set_simple_config_key(). If the key already existed in the
  1647. config file before the call, all other lines would be removed
  1648. due to the sed option -n and p combo. (Closes: #9122)
  1649. - Remove illegal instance of local outside of function definition.
  1650. Together with `set -e` that error has prevented this script from
  1651. restarting Vidalia, like it should. (Closes: #9328)
  1652. * Minor improvements
  1653. - Upgrade I2P to 0.9.19-3~deb7u+1.
  1654. - Install Tor Browser's bundled Torbutton instead of custom .deb.
  1655. As of Torbutton 1.9.1.0 everything we need has been upstreamed.
  1656. - Install Tor Browser's bundled Tor Launcher instead of our
  1657. in-tree version. With Tor 0.2.6.x our custom patches for the
  1658. ClientTransportPlugin hacks are not needed any more. (Closes:
  1659. #7283)
  1660. - Don't install msmtp and mutt. (Closes: #8727)
  1661. - Install fonts-linuxlibertine for improved Vietnamese support in
  1662. LibreOffice. (Closes: #8996)
  1663. - Remove obsoletete #i2p-help IRC channel from the Pidgin
  1664. configuration (Closes: #9137)
  1665. - Add Gedit shortcut to gpgApplet's context menu. Thanks to Ivan
  1666. Bliminse for the patch. (Closes: #9069).
  1667. - Install printer-driver-gutenprint to support more printer
  1668. models. (Closes: #8994).
  1669. - Install paperkey for off-line OpenPGP key backup. (Closes: #8957)
  1670. - Hide the Tor logo in Tor Launcher. (Closes: #8696)
  1671. - Remove useless log() instance in tails-unblock-network. (Closes:
  1672. #9034)
  1673. - Install cdrdao: this enables Brasero to burn combined data/audio
  1674. CDs and to do byte-to-byte disc copy.
  1675. - Hide access to the Add-ons manager in the Unsafe Browser. It's
  1676. currently broken (#9307) but we any way do not want users to
  1677. install add-ons in the Unsafe Browser. (Closes: #9305)
  1678. - Disable warnings on StartTLS for POP3 and IMAP (Will-fix: #9327)
  1679. The default value of this option activates warnings on ports
  1680. 23,109,110,143. This commit disables the warnings for POP3 and
  1681. IMAP as these could be equally used in encrypted StartTLS
  1682. connections. (Closes: #9327)
  1683. - Completely rework how we localize our browser by generating our
  1684. branding add-on, and search plugins programatically. This
  1685. improves the localization for the ar, es, fa, ko, nl, pl, ru,
  1686. tr, vi and zh_CN locales by localizing the Startpage and
  1687. Disconnect.me search plugins. Following Tor Browser 4.5's recent
  1688. switch, we now use Disconnect.me as the default search
  1689. engine. (Closes: #9309)
  1690. * Actively set Google as the Unsafe Browser's default search
  1691. engine.
  1692. * Build system
  1693. - Encode in Git which APT suites to include when building Tails.
  1694. (Closes: #8654)
  1695. - Clean up the list of packages we install. (Closes: #6073)
  1696. - Run auto/{build,clean,config} under `set -x' for improved
  1697. debugging.
  1698. - Zero-pad our ISO images so their size is divisible by 2048.
  1699. The data part of an ISO image's sectors is 2048 bytes, which
  1700. implies that ISO images should always have a size divisible
  1701. by 2048. Some applications, e.g. VirtualBox, use this as a sanity
  1702. check, treating ISO images for which this isn't true as garbage.
  1703. Our isohybrid post-processing does not ensure this,
  1704. however. Also Output ISO size before/after isohybrid'ing and
  1705. truncate'ing it. This will help detect if/when truncate is
  1706. needed at all, so that we can report back to syslinux
  1707. maintainers more useful information. (Closes: #8891)
  1708. - Vagrant: raise apt-cacher-ng's ExTreshold preference to 50. The
  1709. goal here is to avoid Tor Browser tarballs being deleted by
  1710. apt-cacher-ng's daily expiration cronjob: they're not listed in
  1711. any APT repo's index file, so acng will be quite eager to clean
  1712. them up.
  1713. * Test suite
  1714. - Bring dependency checks up-to-date (Closes: #8988).
  1715. - Adapt test suite to be run on Debian Jessie, which includes
  1716. removing various Wheezy-specific workarounds, adding a few
  1717. specific to Jessie, migrating from ffmpeg to libav, and
  1718. more. (Closes: #8165)
  1719. - Test that MAT can see that a PDF is dirty (Closes: #9136).
  1720. - Allow throwing Timeout::Error in try_for() blocks, as well as
  1721. nested try_for() (Closes: #9189, #9290).
  1722. - Read test suite configuration files from the features/config/local.d
  1723. directory. (Closes: #9220)
  1724. - Kill virt-viewer with SIGTERM, not SIGINT, to prevent hordes of
  1725. zombie processes from appearing. (Closes: #9139)
  1726. - Kill Xvfb with SIGTERM, not SIGKILL, on test suite exit to allow
  1727. it to properly clean up. (Closes: #8707)
  1728. - Split SSH & SFTP configs in the test suite. (Closes: #9257)
  1729. - Improve how we start subprocesses in the test suite, mostly by
  1730. bypassing the shell for greater security and robustness (Closes:
  1731. #9253)
  1732. - Add Electrum test feature. (Closes #8963)
  1733. - Test that Tails Installer detects when USB devices are
  1734. removed. (Closes: #9131)
  1735. - Test Tails Installer with devices which are too small. (Closes:
  1736. #9129)
  1737. - Test that the Report an Error launcher works in German. (Closes:
  1738. #9143)
  1739. - Verify that no extensions are installed in the Unsafe Browser
  1740. using about:support instead of about:addons, which is broken
  1741. (#9307). (Closes: #9306)
  1742. - Retry GNOME application menu actions when they glitch. The
  1743. GNOME application menus seem to have issues with clicks or
  1744. hovering actions not registering, and hence sometimes submenus
  1745. are not opened when they should, and sometimes clicks on the
  1746. final application shortcut are lost. There seems to be a
  1747. correlation between this and CPU load on the host running the
  1748. test suite. We workaround this by simply re-trying the last
  1749. action when it seems to fail. (Closes: #8928)
  1750. - Work around Seahorse GUI glitchiness (Closes: #9343):
  1751. * When Seahorse appears to be frozen--apparently due to network
  1752. issues--it can often be worked around by refreshing the screen
  1753. or activating a new window.
  1754. * Open Seahorse's preferences dialog using the mouse.
  1755. * Access menu entries with the mouse.
  1756. - Wait for systray icons to finish loading before interacting with
  1757. the systray. (Closes: #9258)
  1758. - Test suite configuration: generalize local.d support to *.d. We
  1759. now load features/config/*.d/*.yml.
  1760. - Use code blocks in "After Scenario" hooks. This is much simpler
  1761. to use (and more readable!) compared to hooking functions and
  1762. arguments like we used to do.
  1763. - Create filesystem share sources in the temporary directory and
  1764. make them world-readable. (Closes: #8950)
  1765. -- Tails developers <tails@boum.org> Mon, 11 May 2015 16:45:04 +0200
  1766. tails (1.3.2) unstable; urgency=medium
  1767. * Security fixes
  1768. - Upgrade Tor Browser to 4.0.6, based on Firefox 31.6.0 ESR.
  1769. - Upgrade OpenSSL to 1.0.1e-2+deb7u16.
  1770. * Bugfixes
  1771. - Make Florence usable with touchpads by forcing syndaemon to
  1772. always use the `-t` option, which only disables tapping and
  1773. scrolling and not mouse movements (Closes: #9011).
  1774. - Make tails-spoof-mac log the correct macchanger exit code on
  1775. failure (Closes: #8687).
  1776. - Tails Installer:
  1777. · Ignore devices with less than 3.5 GB of storage since they
  1778. do not fit a Tails installation (Closes: #6538).
  1779. · Remove devices from the device list as they are unplugged
  1780. (Closes: #8691).
  1781. * Minor improvements
  1782. - Install obfs4proxy 0.0.4-1~tpo1, which adds support for
  1783. client-mode ScrambleSuit.
  1784. - Don't start Vidalia if Windows Camouflage is enabled. (Closes:
  1785. #7400)
  1786. - I2P Browser:
  1787. · Remove "Add-ons" from the Tools menu, and hide "Keyboard
  1788. Shortcuts" and "Take a Tour" since they point to resources on
  1789. the open Internet (Closes: #7970).
  1790. · Hide TorButton button from the customize toolbar options, and
  1791. remove configs whose only purpose was to make Torbutton "green"
  1792. (Closes: #8893).
  1793. * Test suite
  1794. - New tests:
  1795. · Test non-LAN SSH, and SFTP via GNOME's "Connect to Server"
  1796. (Closes: #6308).
  1797. · Verify that Tails' Tor binary has the expected Tor authorities
  1798. hard coded (Closes: #8960).
  1799. - Improvements:
  1800. · Programmatically determine the supported languages when testing
  1801. the Unsafe Browser (Closes: #8918).
  1802. · Rename --temp-dir to --tmpdir and make it behave more like
  1803. mktemp, and honour TMPDIR if set in the environment. (Closes:
  1804. #8709).
  1805. - Bugfixes:
  1806. · Make --temp-dir (now --tmpdir) actually work.
  1807. -- Tails developers <tails@boum.org> Mon, 30 Mar 2015 16:54:20 +0200
  1808. tails (1.3.1) unstable; urgency=medium
  1809. * Security fixes
  1810. - Upgrade Tor Browser to 4.0.5, based on Firefox 31.5.3 ESR. This addresses:
  1811. · https://www.mozilla.org/en-US/security/advisories/mfsa2015-28/
  1812. · https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/
  1813. - Upgrade Linux to 3.16.7-ckt7-1.
  1814. - Upgrade libxfont to 1:1.4.5-5.
  1815. - Upgrade OpenSSL to 1.0.1e-2+deb7u15.
  1816. - Upgrade tcpdump to 4.3.0-1+deb7u2.
  1817. - Upgrade bsdtar to 3.0.4-3+wheezy1.
  1818. - Upgrade CUPS to 1.5.3-5+deb7u5.
  1819. - Upgrade file and libmagic to 5.11-2+deb7u8.
  1820. - Upgrade GnuPG to 1.4.12-7+deb7u7.
  1821. - Upgrade libarchive to 3.0.4-3+wheezy1.
  1822. - Upgrade libav to 6:0.8.17-1.
  1823. - Upgrade FreeType 2 to 2.4.9-1.1+deb7u1.
  1824. - Upgrade libgcrypt11 1.5.0-5+deb7u3.
  1825. - Upgrade libgnutls26 to 2.12.20-8+deb7u3.
  1826. - Upgrade libgtk2-perl to 2:1.244-1+deb7u1.
  1827. - Upgrade ICU to 4.8.1.1-12+deb7u2.
  1828. - Upgrade NSS to 2:3.14.5-1+deb7u4.
  1829. - Upgrade libssh2 to 1.4.2-1.1+deb7u1.
  1830. * Bugfixes
  1831. - Upgrade Tor to 0.2.5.11-1~d70.wheezy+1+tails1. Changes include:
  1832. · Directory authority changes.
  1833. · Fix assertion errors that may trigger under high DNS load.
  1834. · No longer break on HUP with seccomp2 enabled.
  1835. · and more - please consult the upstream changelog.
  1836. - Upgrade Tor Launcher to 0.2.7.2, and update the test suite accordingly
  1837. (Closes: #8964, #6985). Changes include:
  1838. · Ask about bridges before proxy in wizard.
  1839. · Hide logo if TOR_HIDE_BROWSER_LOGO set.
  1840. · Remove firewall prompt from wizard.
  1841. · Feedback when “Copy Tor Log” is clicked.
  1842. · Improve behavior if tor exits.
  1843. · Add option to hide TBB's logo
  1844. · Change "Tor Browser Bundle" to "Tor Browser"
  1845. · Update translations from Transifex.
  1846. - Fix the Tor Launcher killer. (Closes: #9067)
  1847. - Allow Seahorse to communicate with keyservers when run from Tails
  1848. OpenPGP Applet. (Closes: #6394)
  1849. - SSH client: don't proxy connections to 172.17.* to 172.31.*.
  1850. (Closes: #6558)
  1851. - Repair config/chroot_local-packages feature, that was broken in Tails 1.3
  1852. by 19-install-tor-browser-AppArmor-profile. (Closes: #8910)
  1853. - language_statistics.sh: count original words instead of translated words.
  1854. Otherwise we get >100% translation if translated strings are longer than
  1855. original strings. (Closes: #9016)
  1856. * Minor improvements
  1857. - Only ship the new Tails signing key, and have Tails Upgrader stop trusting
  1858. the old one. Update the documentation and test suite accordingly.
  1859. (Closes: #8735, #8736, #8882, #8769, #8951)
  1860. - Polish and harden a bit the WhisperBack configuration (Closes: #8991):
  1861. · Only allow the `amnesia' user to run tails-debugging info as root
  1862. with no arguments.
  1863. · Fix spelling and grammar mistakes, improve phrasing a bit.
  1864. · Quote variables consistently.
  1865. * Test suite
  1866. - New tests:
  1867. · Chatting over XMPP in Pidgin, both peer-to-peer and in a multi-user
  1868. chatroom. (Closes: #8002)
  1869. · Chatting with OTR enabled over XMPP in Pidgin. (Closes: #8001)
  1870. · Check that Pidgin only responds to the expected CTCP requests.
  1871. (Closes: #8966)
  1872. · Fetching keys using Seahorse started via the OpenPGP Applet.
  1873. · Sync'ing keys using Seahorse.
  1874. - Bugfixes:
  1875. · Fix a race condition between the remote shell's and Tails Greeter's
  1876. startup, by making sure the remote shell is ready before we start
  1877. GDM. (Closes: #8941)
  1878. · Kill virt-viewer properly. (Closes: #9070)
  1879. · Make sure the display is stopped on destroy_and_undefine().
  1880. Where we had it earlier, it could be skipped if anything else in the
  1881. block threw an exception.
  1882. · Fix wrong use of "$@". (Closes: #9071)
  1883. · Enable the pipefail option in run_test_suite.
  1884. · Improve the GNOME screenshot test's robustness. (Closes: #8952)
  1885. - Refactoring:
  1886. · turn the focus_pidgin_window() helper into a more generic
  1887. VM.focus_xorg_window() one.
  1888. · Reorganize the Display class.
  1889. · Use clearer method to check process status in the Display class.
  1890. - New developer-oriented features:
  1891. · Add a --log-to-file option to run_test_suite. (Closes: #8894)
  1892. · Add helpers for generating random strings.
  1893. · Make it possible to hook arbitrary calls on scenario end. This is useful
  1894. for dynamically adding cleanup functions, instead of having
  1895. to explicitly deal with them in some After hook.
  1896. -- Tails developers <tails@boum.org> Mon, 23 Mar 2015 12:34:56 +0000
  1897. tails (1.3) unstable; urgency=medium
  1898. * Major new features
  1899. - Produce the Tails image in hybrid mode (again) so that the same
  1900. image can be installed both on DVD *and* "hard disks" like USB
  1901. storage and similar. (Closes: #8510)
  1902. - Confine the Tor Browser using AppArmor. (Closes: #5525)
  1903. - Install the Electrum bitcoin client from wheezy-backports, and
  1904. add a persistence preset for the Live user's bitcoin wallet. If
  1905. electrum is started without the persistence preset enabled, a
  1906. warning is shown. (Closes: #6739)
  1907. * Security fixes
  1908. - Upgrade Tor Browser to 4.0.4 (based on Firefox 31.5.0esr)
  1909. (Closes: #8938).
  1910. * Bugfixes
  1911. - Have tor_bootstrap_progress echo 0 if no matching log line is
  1912. found. (Closes: #8257)
  1913. - Always pass arguments through wrappers (connect-socks, totem,
  1914. wget, whois) with "$@". $* doesn't handle arguments with
  1915. e.g. embedded spaces correctly. (Closes: #8603, #8830)
  1916. - Upgrade Linux to 3.16.7-ckt4-3.
  1917. * Minor improvements
  1918. - Install a custom-built Tor package with Seccomp enabled;
  1919. enable the Seccomp sandbox when no pluggable transport is used.
  1920. (Closes: #8174)
  1921. - Install obfs4proxy instead of obfsproxy, which adds support for
  1922. the obfs4 Tor pluggable transport. (Closes: #7980)
  1923. - Install GnuPG v2 and associated tools from wheezy-backports,
  1924. primarily for its improved support for OpenPGP smartcards. It
  1925. lives side-by-side with GnuPG v1, which still is the
  1926. default. (Closes: #6241)
  1927. - Install ibus-unikey, a Vietnamese input method for IBus. (Closes:
  1928. #7999)
  1929. - Install torsocks (2.x) from wheezy-backports. (Closes: #8220)
  1930. - Install keyringer from Debian Jessie. (Closes: #7752)
  1931. - Install pulseaudio-utils.
  1932. - Remove all traces of Polipo: we don't use it anymore. This
  1933. closes #5379 and #6115 because:
  1934. * Have APT directly use the Tor SOCKS proxy. (Closes: #8194)
  1935. * Wrap wget with torsocks. (Closes: #6623)
  1936. * Wrap Totem to torify it with torsocks. (Closes: #8219)
  1937. * Torify Git with tsocks, instead of setting GIT_PROXY_COMMAND.
  1938. (Closes: #8680)
  1939. - Use torsocks for whois and Gobby, instead of torify.
  1940. - Upgrade I2P to 0.9.18-1~deb7u+1.
  1941. - Refactor the Unsafe and I2P browser code into a common shell
  1942. library. A lot of duplicated code is now shared, and the code
  1943. has been cleaned up and made more reliable. Several
  1944. optimizations of memory usage and startup time were also
  1945. implemented. (Closes: #7951)
  1946. - Invert Exit and About in gpgApplet context menu. This is a
  1947. short-term workaround for making it harder to exit the
  1948. application by mistake (e.g. a double right-click). (Closes:
  1949. #7450)
  1950. - Implement new touchpad settings. This enables tap-to-click,
  1951. 2-fingers scrolling, and disable while typing. We don't enable
  1952. reverse scrolling nor horizontal scrolling. (Closes: #7779)
  1953. - Include the mount(8) output and live-additional-software.conf in
  1954. WhisperBack bug reports (Closes: #8719, #8491).
  1955. - Reduce brightness and saturation of background color. (Closes:
  1956. #7963)
  1957. - Have ALSA output sound via PulseAudio by default. This gives us
  1958. centralized sound volume controls, and... allows to easily, and
  1959. automatically, test that audio output works from Tor Browser,
  1960. thanks to the PulseAudio integration into the GNOME sound
  1961. control center.
  1962. - Import the new Tails signing key, which we will use for Tails
  1963. 1.3.1, and have Tails Upgrader trust both it and the "old"
  1964. (current) Tails signing key. (Closes: #8732)
  1965. - tails-security-check: error out when passed an invalid CA file.
  1966. Unfortunately, the underlying HTTPS stack we use here fails open
  1967. in those case, so we have to check it ourselves. Currently, we
  1968. check that the file exists, is readable, is a plain file and is
  1969. not empty. Also support specifying the CA file via an
  1970. environment variable. This will ease development and bug-fixing
  1971. quite a bit.
  1972. - Fix racy code in Tails Installer that sometimes made the
  1973. automated test suite stall for scenarios installing Tails
  1974. to USB disks. (Closes: #6092)
  1975. - Make it possible to use Tails Upgrader to upgrade a Tails
  1976. installation that has cruft files on the system partition.
  1977. (Closes: #7678)
  1978. * Build system
  1979. - Install syslinux-utils from our builder-wheezy APT repository in
  1980. Vagrant. We need version 6.03~pre20 to make the Tails ISO image
  1981. in hybrid mode
  1982. - Update deb.tails.boum.org apt repo signing key. (Closes: #8747)
  1983. - Revert "Workaround build failure in lb_source, after creating
  1984. the ISO." This is not needed anymore given the move to the Tor
  1985. SOCKS proxy. (Closes: #5307)
  1986. - Remove the bootstrap stage usage option and disable all
  1987. live-build caching in Vagrant. It introduces complexity and
  1988. potential for strange build inconsistencies for a meager
  1989. reduction in build time. (Closes: #8725)
  1990. - Hardcode the mirrors used at build and boot time in auto/config.
  1991. Our stuff will be more consistent, easier to reproduce, and our
  1992. QA process will be more reliable if we all use the same mirrors
  1993. at build time as the ones we configure in the ISO. E.g. we won't
  1994. have issues such as #8715 again. (Closes: #8726)
  1995. - Don't attempt to retrieve source packages from local-packages so
  1996. local packages can be installed via
  1997. config/chroot_local-packages. (Closes: #8756)
  1998. - Use our own Tor Browser archive when building an ISO. (Closes:
  1999. #8125)
  2000. * Test suite
  2001. - Use libguestfs instead of parted when creating partitions and
  2002. filsystems, and to check that only the expected files
  2003. persist. We also switch to qcow2 as the default disk image
  2004. format everywhere to reduce disk usage, enable us to use
  2005. snapshots that includes the disks (in the future), and to use
  2006. the same steps for creating disks in all tests. (Closes: #8673)
  2007. - Automatically test that Tails ignores persistence volumes stored
  2008. on non-removable media, and doesn't enable swaps. (Closes:
  2009. #7822)
  2010. - Actually make sure that Tails can boot from live systems stored
  2011. on a hard drive. Running the 'I start Tails from DVD ...' step
  2012. will override the earlier 'the computer is set to boot from ide
  2013. drive "live_hd"' step, so let's make the "from DVD" part
  2014. optional; it will be the default any way.
  2015. - Make it possible to use an old iso with different persistence
  2016. presets. (Closes: #8091)
  2017. - Hide the cursor between steps when navigating the GNOME
  2018. applications menu. This makes it a bit more robust, again:
  2019. sometimes the cursor is partially hiding the menu entry we're
  2020. looking for, hence preventing Sikuli from finding it (in
  2021. particular when it's "Accessories", since we've just clicked on
  2022. "Applications" which is nearby). (Closes: #8875)
  2023. - Ensure that the test will fail if "apt-get X" commands fail.
  2024. - Test 'Tor is ready' notification in a separate scenario. (Closes:
  2025. #8714)
  2026. - Add automated tests for torified wget and whois. This should
  2027. help us identify future regressions such as #8603 in their
  2028. torifying wrappers.
  2029. - Add automated test for opening an URL from Pidgin.
  2030. - And add automated tests for the Tor Browser's AppArmor
  2031. sandboxing.
  2032. - Test that "Report an Error Launcher" opens the support
  2033. documentation.
  2034. - Test that the Unsafe Browser:
  2035. * starts in various locales.
  2036. * complains when DNS isn't configured.
  2037. * tears down its chroot on shutdown.
  2038. * runs as the correct user.
  2039. * has no plugins or add-ons installed.
  2040. * has no unexpected bookmarks.
  2041. * has no proxy configured.
  2042. - Bump the "I2P router console is ready" timeout in its test to
  2043. deal with slow Internet connections.
  2044. - Make the automatic tests of gpgApplet more robust by relying
  2045. more on graphical elements instead of keyboard shortcuts and
  2046. static sleep():s. (Closes: #5632)
  2047. - Make sure that enough disk space is available when creating
  2048. virtual storage media. (Closes: #8907)
  2049. - Test that the Unsafe Browser doesn't generate any non-user
  2050. initiated traffic, and in particular that it doesn't check for
  2051. upgrades, which is a regression test for #8694. (Closes: #8702)
  2052. - Various robustness improvements to the Synaptic tests. (Closes:
  2053. #8742)
  2054. - Automatically test Git. (Closes: #6307)
  2055. - Automatically test GNOME Screenshot, which is a regression test
  2056. for #8087. (Closes: #8688)
  2057. - Fix a quoting issue with `tails_persistence_enabled?`. (Closes:
  2058. #8919)
  2059. - Introduce an improved configuration system that also can store
  2060. local secrets, like user credentials needed for some
  2061. tests. (Closes: #6301, #8188)
  2062. - Actually verify that we successfully set the time in our time
  2063. syncing tests. (Closes: #5836)
  2064. - Automatically test Tor. This includes normal functionality and
  2065. the use pluggable transports, that our Tor enforcement is
  2066. effective (e.g. only the Tor network or configured bridges are
  2067. contacted) and that our stream isolation configuration is
  2068. working. (Closes: #5644, #6305, #7821)
  2069. -- Tails developers <tails@boum.org> Mon, 23 Feb 2015 17:14:00 +0100
  2070. tails (1.2.3) unstable; urgency=medium
  2071. * Security fixes
  2072. - Upgrade Linux to 3.16.7-ckt2-1.
  2073. - Upgrade Tor Browser to 4.0.3 (based on Firefox 31.4.0esr)
  2074. (Closes: #8700).
  2075. - Fail safe by entering panic mode if macchanger exits with an
  2076. error, since in this situation we have to treat the
  2077. driver/device state as undefined. Also, we previously just
  2078. exited the script in this case, not triggering the panic mode
  2079. and potentially leaking the real MAC address (Closes: #8571).
  2080. - Disable upgrade checking in the Unsafe Browser. Until now the
  2081. Unsafe Browser has checked for upgrades of the Tor Browser in
  2082. the clear (Closes: #8694).
  2083. * Bugfixes
  2084. - Fix startup of the Unsafe Browser in some locales (Closes: #8693).
  2085. - Wait for notification-daemon to run before showing the MAC
  2086. spoofing panic mode notifications. Without this, the "Network
  2087. card disabled" notification is sometimes lost when MAC spoofing
  2088. fails. Unfortunately this only improves the situation, but
  2089. doesn't fix it completely (see #8685).
  2090. - Log that we're going to stop NetworkManager before trying to do
  2091. it in the MAC spoofing scripts. Without this we wouldn't get the
  2092. log message in case stopping NetworkManager fails (thanks to
  2093. `set -e`).
  2094. - Set GNOME Screenshot preferences to save the screenshots in
  2095. /home/amnesia (Closes: #8087).
  2096. - Do not suspend to RAM when closing the lid on battery power
  2097. (Closes: #8071).
  2098. - Properly update the Tails Installer's status when plugging in a
  2099. USB drive after it has started (Closes: #8353).
  2100. - Make rsync compare file contents by using --checksum for more
  2101. reliable generation of the squashfs filesystem in
  2102. IUKs. Previously it used the default, which is checking
  2103. timestamps and file size, but that doesn't play well with the
  2104. Tor browser files, that have a fixed mtime, which could result
  2105. in updated files not ending up in the IUK.
  2106. * Minor improvements
  2107. - Finish migrating tails-security-check's and tails-iuk's pinning
  2108. to our website's new X.509 certificate authority (Closes: #8404).
  2109. * Build system
  2110. - Update to Vagrant build box tails-builder-20141201. The only
  2111. change is the removal of a reference to an ISO image which
  2112. doesn't exist (except on the system that generated the build
  2113. box) which causes an error for some users (Closes: #7644).
  2114. - Generate the list of packages used during build, after building
  2115. with Jenkins (Closes: #8518). This allows tracking their status
  2116. on the Debian reproducible build front:
  2117. https://reproducible.debian.net/index_pkg_sets.html#tails
  2118. * Automated test suite
  2119. - Check PO files with i18nspector (Closes: #8359).
  2120. - Fix the expected image of a check.tp.o failure. Previously we
  2121. looked for the "Sorry. You are not using Tor." text, but it
  2122. seems it recently changed enough for Sikuli to not find it. To
  2123. prevent future errors of the same kind we'll look for the
  2124. crossed-over onion icon instead (Closes: #8533).
  2125. - Bump timeout when waiting for Tor to re-bootstrap. We have a
  2126. dreaded issue with timeouts that are multiple of 2 minutes, and
  2127. then Tor succeeds soon after, so in order to allow for this
  2128. timeout to be reached twice, and then possibly succeed, let's
  2129. use N*2 minutes + 30 seconds, with N=2.
  2130. -- Tails developers <tails@boum.org> Wed, 14 Jan 2015 16:12:26 +0100
  2131. tails (1.2.2) unstable; urgency=medium
  2132. * Bugfixes
  2133. - Create a CA bundle for Tails Upgrader at ISO build time, and
  2134. patch Tails Upgrader to use it. Specifically this will make it
  2135. possible to check for Tails upgrades after our website changes
  2136. certificate around the 2014 to 2015 transition (Partially fixes
  2137. #8404).
  2138. -- Tails developers <tails@boum.org> Mon, 15 Dec 2014 10:05:17 +0100
  2139. tails (1.2.1) unstable; urgency=low
  2140. * Security fixes
  2141. - Upgrade Linux to 3.16.0-4, i.e. 3.16.7-1.
  2142. - Install Tor Browser 4.0.2 (based on Firefox 31.3.0esr).
  2143. * Bugfixes
  2144. - Install syslinux-utils, to get isohybrid back (Closes: #8155).
  2145. - Update xserver-xorg-input-evdev to 1:2.7.0-1+tails1 which
  2146. includes a patch that restores mouse scrolling in KVM/Spice
  2147. (Closes: 7426).
  2148. - Set Torbutton logging preferences to the defaults (Closes:
  2149. #8160). With the default settings, no site-specific information is
  2150. logged.
  2151. - Use the correct stack of rootfs:s for the chroot browsers (Closes:
  2152. #8152, #8158). After installing incremental upgrades Tails' root
  2153. filesystem consists of a stack squashfs:s, not only
  2154. filesystem.squashfs. When not stacking them correct we may end up
  2155. using the Tor Browser (Firefox) from an older version of Tails, or
  2156. with no Tor Browser at all, as in the upgrade from Tails 1.1.2 to
  2157. 1.2, when we migrated from Iceweasel to the Tor Browser. Based on
  2158. a patch contributed by sanic.
  2159. - Use the Tor Browser for MIME type that GNOME associates with
  2160. Iceweasel (Closes: #8153). Open URLs from Claws Mail, KeePassX
  2161. etc. should be possible again.
  2162. - Update patch to include all Intel CPU microcodes (Closes: #8189).
  2163. - AppArmor: allow Pidgin to run Tor Browser unconfined, with
  2164. scrubbed environment (Closes: #8186). Links opened in Pidgin are
  2165. now handled by the Tor Browser.
  2166. - Install all localized Iceweasel search plugins (Closes: #8139).
  2167. - When generating the boot profile, ignore directories in
  2168. process_IN_ACCESS as well (Closes: #7925). This allows ut to
  2169. update the squashfs-ordering again in Tails 1.2.1.
  2170. - gpgApplet: Don't pass already encoded data to GTK2 (Closes:
  2171. #7968). It's now possible to clearsign text including non-ASCII
  2172. characters.
  2173. - Do not run the PulseAudio initscript, neither at startup nor
  2174. shutdown (Closes: #8082).
  2175. * Minor improvements
  2176. - Upgrade I2P to 0.9.17-1~deb7u+1.
  2177. - Make GnuPG configuration closer to the best practices one
  2178. (Closes: #7512).
  2179. - Have GnuPG directly use the Tor SOCKS port (Closes: #7416).
  2180. - Remove TrueCrypt support and documentat how to open TrueCrypt
  2181. volumes using cryptsetup (Closes: #5373).
  2182. - Install hopenpgp-tools from Debian Jessie.
  2183. * Build system
  2184. - Add gettext >= 0.18.3 as a Tails build dependency. We need it for
  2185. xgettext JavaScript support in feature/jessie.
  2186. * Automated test suite
  2187. - Don't click to open a sub-menu in the GNOME applications menu
  2188. (Closes: #8140).
  2189. - When testing the Windows camouflage, look for individual systray
  2190. applets, to avoid relying on their ordering (Closes: #8059).
  2191. - Focus the Pidgin Buddy List before looking for something
  2192. happening in it (Closes: #8161).
  2193. - Remove workaround for showing the TBB's menu bar (Closes #8028).
  2194. -- Tails developers <tails@boum.org> Tue, 02 Dec 2014 11:34:03 +0100
  2195. tails (1.2) unstable; urgency=medium
  2196. * Major new features
  2197. - Migrate from Iceweasel to the Tor Browser from the Tor Browser
  2198. Bundle 4.0 (based on Firefox 31.2.0esr). This fixes the POODLE
  2199. vulnerability.
  2200. The installation in Tails is made global (multi-profile), uses
  2201. the system-wide Tor instance, disables the Tor Browser updater,
  2202. and keeps the desired deviations previously present in Iceweasel,
  2203. e.g. we install the AdBlock Plus add-on, but not Tor Launcher (since
  2204. we run it as a standalone XUL application), among other things.
  2205. - Install AppArmor's userspace tools and apparmor-profiles-extra
  2206. from Wheezy Backports, and enable the AppArmor Linux Security
  2207. Module. This adds Mandatory Access Control for several critical
  2208. applications in Tails, including Tor, Vidalia, Pidgin, Evince
  2209. and Totem.
  2210. - Isolate I2P traffic from the Tor Browser by adding a dedicated
  2211. I2P Browser. It is set up similarly to the Unsafe Browser,
  2212. but further disables features that are irrelevant for I2P, like
  2213. search plugins and the AdBlock Plus addon, while keeping Tor Browser
  2214. security features like the NoScript and Torbutton addons.
  2215. - Upgrade Tor to 0.2.5.8-rc-1~d70.wheezy+1.
  2216. * Security fixes
  2217. - Disable TCP timestamps (Closes: #6579).
  2218. * Bugfixes
  2219. - Remove expired Pidgin certificates (Closes: #7730).
  2220. - Use sudo instead of gksudo for running tails-upgrade-frontend to
  2221. make stderr more easily accessible (Closes: #7431).
  2222. - Run tails-persistence-setup with sudo instead of gksudo to make
  2223. stderr more easily accessible, and allow the desktop user to
  2224. pass the --verbose parameter (Closes: #7623).
  2225. - Disable CUPS in the Unsafe Browser. This will prevent the
  2226. browser from hanging for several minutes when accidentally
  2227. pressing CTRL+P or trying to go to File -> Print (Closes: #7771).
  2228. * Minor improvements
  2229. - Install Linux 3.16-3 (version 3.16.5-1) from Debian
  2230. unstable (Closes: #7886, #8100).
  2231. - Transition away from TrueCrypt: install cryptsetup and friends
  2232. from wheezy-backports (Closes: #5932), and make it clear that
  2233. TrueCrypt will be removed in Tails 1.2.1 (Closes: #7739).
  2234. - Install Monkeysign dependencies for qrcodes scanning.
  2235. - Upgrade syslinux to 3:6.03~pre20+dfsg-2~bpo70+1, and install
  2236. the new syslinux-efi package.
  2237. - Upgrade I2P to 0.9.15-1~deb7u+1
  2238. - Enable Wheezy proposed-updates APT repository and setup APT
  2239. pinnings to install packages from it.
  2240. - Enable Tor's syscall sandbox. This feature (new in 0.2.5.x)
  2241. should make Tor a bit harder to exploit. It is only be enabled
  2242. when when no special Tor configuration is requested in Tails
  2243. Greeter due to incompatibility with pluggable transports.
  2244. - Start I2P automatically when the network connects via a
  2245. NetworkManager hook, and "i2p" is present on the kernel command
  2246. line. The router console is no longer opened automatically, but
  2247. can be accessed through the I2P Browser (Closes: #7732).
  2248. - Simplify the IPv6 ferm rules (Closes: #7668).
  2249. - Include persistence.conf in WhisperBack reports (Closes: #7461)
  2250. - Pin packages from testing to 500, so that they can be upgraded.
  2251. - Don't set Torbutton environment vars globally (Closes: #5648).
  2252. - Enable VirtualBox guest additions by default (Closes: #5730). In
  2253. particular this enables VirtualBox's display management service.
  2254. - In the Unsafe Browser, hide option for "Tor Browser Health
  2255. report", and the "Get Addons" section in the Addon manager
  2256. (Closes: #7952).
  2257. - Show Pidgin's formatting toolbar (Closes: #7356). Having the
  2258. formatting toolbar displayed in Pidgin makes the OTR status more
  2259. explicit by displaying it with words.
  2260. * Automated test suite
  2261. - Add --pause-on-fail to ease VM state debugging when tests
  2262. misbehave.
  2263. - Add execute_successfully() and assert_vmcommand_success() for
  2264. added robustness when executing some command in the testing VM.
  2265. - Use Test::Unit::Assertions instead of our home-made assert().
  2266. - Add test for persistent browser bookmarks.
  2267. - Add basic tests for Pidgin, Totem and Evince, including their
  2268. AppArmor enforcement.
  2269. - Factorize some common step pattern into single steps.
  2270. - Factorize running a command in GNOME Terminal.
  2271. - Add common steps to copy a file and test for its existence.
  2272. - Add a wait_and_double_click Sikuli helper method.
  2273. - Add a VM.file_content method, to avoid repeating ourselves, and
  2274. use it whenever easily doable.
  2275. - Drop test that diffs syslinux' exithelp.cfg: we don't ship this
  2276. file anymore.
  2277. - In the Unsafe Browser tests, rely on subtle timing less (Closes:
  2278. #8009).
  2279. - Use the same logic to determine when Tor is working in the test
  2280. suite as in Tails itself. The idea is to avoid spamming the Tor
  2281. control port during bootstrap, since we've seen problems with
  2282. that already.
  2283. -- Tails developers <tails@boum.org> Wed, 15 Oct 2014 18:34:50 +0200
  2284. tails (1.1.2) unstable; urgency=medium
  2285. * Security fixes
  2286. - Upgrade the web browser to 24.8.0esr-0+tails3~bpo70+1
  2287. (fixes Mozilla#1064636).
  2288. - Install Linux 3.16-1 from sid (Closes: #7886).
  2289. - Upgrade file to 5.11-2+deb7u5 (fixes CVE-2014-0207,
  2290. CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479,
  2291. CVE-2014-3480, CVE-2014-3487, CVE-2014-3538 and CVE-2014-3587).
  2292. - Upgrade curl to 7.26.0-1+wheezy10 (fixes CVE-2014-3613 and
  2293. CVE-2014-3620).
  2294. - Upgrade bind9-based packages to 1:9.8.4.dfsg.P1-6+nmu2+deb7u2
  2295. (fixes CVE-2014-0591).
  2296. - Upgrade gnupg to 1.4.12-7+deb7u6 (fixes CVE-2014-5270).
  2297. - Upgrade apt to 0.9.7.9+deb7u5 (fixes CVE-2014-0487,
  2298. CVE-2014-0488, CVE-2014-0489, CVE-2014-0490, and
  2299. CVE-2014-6273.).
  2300. - Upgrade dbus to 1.6.8-1+deb7u4 (fixes CVE-2014-3635,
  2301. CVE-2014-3636, CVE-2014-3637, CVE-2014-3638 and CVE-2014-3639).
  2302. - Upgrade libav-based pacakges to 6:0.8.16-1 (fixes
  2303. CVE-2013-7020).
  2304. - Upgrade bash to 4.2+dfsg-0.1+deb7u1 (fixes CVE-2014-6271).
  2305. -- Tails developers <tails@boum.org> Tue, 23 Sep 2014 23:01:40 -0700
  2306. tails (1.1.1) unstable; urgency=medium
  2307. * Security fixes
  2308. - Upgrade the web browser to 24.8.0esr-0+tails1~bpo70+1
  2309. (Firefox 24.8.0esr + Iceweasel patches + Torbrowser patches).
  2310. Also import the Tor Browser profile at commit
  2311. 271b64b889e5c549196c3ee91c888de88148560f from
  2312. ttp/tor-browser-24.8.0esr-3.x-1.
  2313. - Upgrade Tor to 0.2.4.23-2~d70.wheezy+1 (fixes CVE-2014-5117).
  2314. - Upgrade I2P to 0.9.14.1-1~deb7u+1.
  2315. - Upgrade Linux to 3.14.15-2 (fixes CVE-2014-3534, CVE-2014-4667
  2316. and CVE-2014-4943).
  2317. - Upgrade CUPS-based packages to 1.5.3-5+deb7u4 (fixes
  2318. CVE-2014-3537, CVE-2014-5029, CVE-2014-5030 and CVE-2014-5031).
  2319. - Upgrade libnss3 to 2:3.14.5-1+deb7u1 (fixes CVE-2013-1741,
  2320. CVE-2013-5606, CVE-2014-1491 and CVE-2014-1492).
  2321. - Upgrade openssl to 1.0.1e-2+deb7u12 (fixes CVE-2014-3505,
  2322. CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509,
  2323. CVE-2014-3510, CVE-2014-3511, CVE-2014-3512 and CVE-2014-5139).
  2324. - Upgrade krb5-based packages to 1.10.1+dfsg-5+deb7u2 (fixes
  2325. CVE-2014-4341, CVE-2014-4342, CVE-2014-4343, CVE-2014-4344 and
  2326. CVE-2014-4345).
  2327. - Upgrade libav-based packages to 6:0.8.15-1 (fixes CVE-2011-3934,
  2328. CVE-2011-3935, CVE-2011-3946, CVE-2013-0848, CVE-2013-0851,
  2329. CVE-2013-0852, CVE-2013-0860, CVE-2013-0868, CVE-2013-3672,
  2330. CVE-2013-3674 and CVE-2014-2263.
  2331. - Upgrade libgpgme11 to 1.2.0-1.4+deb7u1 (fixes CVE-2014-5117).
  2332. - Upgrade python-imaging to 1.1.7-4+deb7u1 (fixes CVE-2014-3589).
  2333. - Prevent dhclient from sending the hostname over the network
  2334. (Closes: #7688).
  2335. - Override the hostname provided by the DHCP server (Closes: #7769).
  2336. - Add an I2P boot parameter. Without adding "i2p" to the kernel
  2337. command line, I2P will not be accessible for the Live user.
  2338. - Stricter I2P firewall rules:
  2339. * deny I2P from accessing the LAN
  2340. * deny I2P from accessing the loopback device, except for select
  2341. whitelisted services
  2342. * allow I2P access to the Internet
  2343. The ACCEPT rules will only be enabled when the string 'i2p' is
  2344. passed at the boot prompt. The rules which DENY or REJECT
  2345. access for the 'i2psvc' user will always be applied.
  2346. - Disable I2P plugins, since it doesn't make much sense without
  2347. persistence, and should eliminate some attack vectors.
  2348. - Disable I2P's BOB port. No maintained I2P application uses it.
  2349. * Bugfixes
  2350. - Fix condition clause in tails-security-check (Closes: #7657).
  2351. - Don't ship OpenJDK 6: I2P prefers v7, and we don't need both.
  2352. - Prevent Tails Installer from updating the system partition
  2353. properties on MBR partitions (Closes: #7716).
  2354. * Minor improvements
  2355. - Upgrade to Torbutton 1.6.12.1.
  2356. - Install gnome-user-guide (Closes: #7618).
  2357. - Install cups-pk-helper (Closes: #7636).
  2358. - Update the SquashFS sort file.
  2359. - Compress the SquashFS more aggressively (Closes: #7706).
  2360. - I2P: Keep POP3 email on server. The default in the I2P webmail
  2361. app was to keep mail on the server, but that setting was changed
  2362. recently. This configuration setting (susimail.config) will only
  2363. be copied over in I2P 0.9.14 and newer.
  2364. - Add a Close button to the Tails Installer launcher window.
  2365. * Build system
  2366. - Migrate Vagrant basebox to Debian Wheezy (Closes #7133, #6736).
  2367. - Consistently use the same Debian mirror.
  2368. - Disable runtime APT proxy configuration when using APT in
  2369. binary_local-hooks (Closes: #7691).
  2370. * Automated test suite
  2371. - Automatically test hostname leaks (Closes: #7712).
  2372. - Move autotest live-config hook to be run last. This way we'll
  2373. notice if some earlier live-config hook cancels all hooks by
  2374. running the automated test suite since the remote shell won't be
  2375. running in that case.
  2376. - Test that the I2P boot parameter does what it's supposed to do
  2377. (Closes: #7760).
  2378. - Start applications by using the GNOME Applications menu instead
  2379. of the GNOME Run Dialog (Closes: #5550, #7060).
  2380. -- Tails developers <tails@boum.org> Sun, 31 Aug 2014 20:49:28 +0000
  2381. tails (1.1) unstable; urgency=medium
  2382. * Rebase on Debian Wheezy
  2383. - Upgrade literally thousands of packages.
  2384. - Migrate to GNOME3 fallback mode.
  2385. - Install LibreOffice instead of OpenOffice.
  2386. - Remove custom LSB logging: Wheezy has fancy colored init
  2387. logging.
  2388. * Major new features
  2389. - UEFI boot support.
  2390. - Replace the Windows XP camouflage with an experimental Windows 8
  2391. camouflage.
  2392. - Install Linux 3.14.12-1 from Debian unstable.
  2393. - Bring back VirtualBox guest modules, installed from Wheezy
  2394. backports. Full functionality is only available when using the
  2395. 32-bit kernel.
  2396. * Security fixes
  2397. - Fix write access to boot medium via udisks (#6172).
  2398. - Don't allow the desktop user to pass arguments to
  2399. tails-upgrade-frontend (Closes: #7410).
  2400. - Make persistent file permissions safer (Closes #7443):
  2401. * Make the content of /etc/skel non-world-readable. Otherwise,
  2402. such files may be copied to /home/amnesia, and in turn to the
  2403. persistent volume, with unsafe permissions. That's no big deal
  2404. in /home/amnesia (that is itself not world-readable), *but*
  2405. the root of the persistent volume has to be world-readable.
  2406. * Have activate_custom_mounts create new directories with safe
  2407. permissions.
  2408. * Set strict permissions on /home/amnesia (Closes: #7463).
  2409. * Fix permissions on persistent directories that were created
  2410. with unsafe permissions (Closes: #7458).
  2411. * Fix files ownership while copying persistence (Closes: #7216).
  2412. The previous instructions to copy the persistent data were
  2413. creating personal files that belong to root. I don't think
  2414. there is a way of preserving the original ownership using
  2415. Nautilus (unless doing a "move" instead of a "copy" but that's
  2416. not what we are trying to do here).
  2417. - Disable FoxyProxy's proxy:// protocol handler (Closes: #7479).
  2418. FoxyProxy adds the proxy:// protocol handler, which can be used
  2419. to configure the proxy via an URI. A malicious web page can
  2420. include (or a malicious exit node can inject) some JavaScript
  2421. code to visit such an URI and disable or otherwise change
  2422. Iceweasel's proxy settings. While using this to disable
  2423. proxying will be dealt with safely by our firewall, this could
  2424. be used to defeat stream isolation, although the user must be
  2425. tricked into accepting the new proxy settings.
  2426. - Upgrade the web browser to 24.7.0esr-0+tails1~bpo70+1
  2427. (Firefox 24.7.0esr + Iceweasel patches + Torbrowser patches).
  2428. - Upgrade to Linux 3.14.12-1 (fixes CVE-2014-4699).
  2429. - Upgrade libav-based packages to 0.8.13-1 (fixes CVE-2014-4609).
  2430. - Upgrade to libxml2 2.8.0+dfsg1-7+wheezy1 (fixes CVE-2014-0191).
  2431. - Upgrade to dbus 1.6.8-1+deb7u3 (fixes CVE-2014-3477,
  2432. CVE-2014-3532 and CVE-2014-3533).
  2433. * Bugfixes
  2434. - Disable GNOME keyring's GnuPG functionality. (Closes: #7330) In
  2435. feature/regular-gnupg-agent, we installed the regular GnuPG
  2436. agent so that it is used instead of GNOME keyring's one. This is
  2437. not enough on Wheezy, so let's disable the starting of the "gpg"
  2438. component of GNOME keyring.
  2439. - Make sure /etc/default/locale exists, with a sensible default
  2440. value (Closes: #7333). Before Tails Greeter's PostLogin script
  2441. are run, /etc/default/locale does not exist on Wheezy. Our
  2442. tails-kexec initscript (and quite a few other scripts we run)
  2443. depends on this file to exist. So, let's make sure it exists,
  2444. with a sensible default value.
  2445. - Create the tails-persistence-setup user with the same UID/GID it
  2446. had on Tails/Squeeze. (Closes: #7343) Else, our various checks
  2447. for safe access rights on persistence.conf fail.
  2448. - Revert back to browsing the offline documentation using Iceweasel
  2449. instead of Yelp (Closes: #7390, #7285).
  2450. - Make the new NetworkManager configuration directory persistent,
  2451. when the old one was, but disable the old one (Closes: #7338).
  2452. - Before running tails-upgrade-frontend, chdir to a world-readable
  2453. place (Closes: #7641). In particular, Archive::Tar::Wrapper,
  2454. when called by tails-install-iuk, wants to chdir back to the
  2455. original cwd after it has chdir'd elsewhere to do its job.
  2456. * Minor improvements
  2457. - Install seahorse-nautilus, replacing seahorse-plugins (Closes #5516).
  2458. - Install hledger (custom backport, for now): our accountants need this.
  2459. - Install stable Scribus instead of scribus-ng.
  2460. - Install the printer driver for Epson Inkjet that use ESC/P-R.
  2461. - Install the BookletImposer PDF imposition toolkit. It's tiny,
  2462. and really helpful e.g. when producing booklets.
  2463. - Install gtkhash and nautilus-gtkhash (Closes #6763).
  2464. - Import new version of Tor Launcher:
  2465. · Now based on upstream Tor Launcher 0.2.5.4.
  2466. · Tor bug #11772: Proxy Type menu not set correctly
  2467. · Tor bug #11699: Change &amp;#160 to &#160; in network-settings.dtd
  2468. · Correctly handle startup paths that contain dot.
  2469. - Upgrade to Torbutton 1.6.9.0.
  2470. - Avoid shipping python2.6 in addition to python2.7.
  2471. - Don't install Gobby 0.4 anymore. Gobby 0.5 has been available in
  2472. Debian since Squeeze, now is a good time to drop the obsolete
  2473. 0.4 implementation.
  2474. - Require a bit less free memory before checking for upgrades with
  2475. Tails Upgrader. The general goal is to avoid displaying "Not
  2476. enough memory available to check for upgrades" too often due to
  2477. over-cautious memory requirements checked in the wrapper.
  2478. - Make Tails Greeter's help window resolution-aware. Previously it
  2479. used a static 800x600 which was problematic on lower resolutions,
  2480. and sub-optimal on higher resolutions. Now it adapts itself
  2481. according to the screen resolution.
  2482. - Whisperback now sanitizes attached logs better with respect to
  2483. DMI data, IPv6 addresses, and serial numbers (Closes #6797,
  2484. #6798, #6804).
  2485. - Integrate the new logo in Tails Installer (Closes #7095)
  2486. - Also install linux-base and linux-compiler-gcc-4.8-x86 from
  2487. sid. This way, we can get rid of our linux-compiler-gcc-4.8-x86
  2488. 3.12, and it makes things a bit more consistent.
  2489. - Include the syslinux binary, and its MBR, in the ISO filesystem.
  2490. This in turn allows Tails Installer to use this binary and MBR,
  2491. which is critical for avoiding problems (such as #7345) on
  2492. "Upgrade from ISO".
  2493. - Include syslinux.exe for win32 in utils/win32/ on the ISO
  2494. filesystem (Closes: #7425).
  2495. - Tails Installer:
  2496. * Add consistent margins in GUI.
  2497. * Always reset the target drive's MBR, without asking for
  2498. confirmation, after installing or upgrading.
  2499. * Install the bootloader using the syslinux binary found on the
  2500. target device, once the Live OS has been extracted/copied
  2501. there.
  2502. - Enable double-clicking to pick entries in the language or
  2503. keyboard layout lists in Tails Greeter.
  2504. - Install backport of shared-mime-info 1.3 (Closes: #7079).
  2505. - Make sanity-check prompts closable in Tails Persistence Setup
  2506. (Closes: #7119).
  2507. - Fix quick search in Tails Greeter's Other languages window
  2508. (Closes: #5387).
  2509. - Install systemd. It is not enabled by default, but having it
  2510. around will help doing the migration work.
  2511. - Enable AppArmor on the kernel command-line. This is a no-op
  2512. without the userspace tools and with no profile shipped, but it
  2513. will make it easier to fix this part of the situation.
  2514. * Build system
  2515. - Bump Vagrant builder's memory for RAM builds. Wheezy requires
  2516. more space to build, and the resulting image is larger.
  2517. - Fix Vagrant compatibility issue. Some classes' methods/fields
  2518. have been renamed between Vagrant versions, so we need a simple
  2519. compatibility layer to support all versions. Without this, it's
  2520. not possible to issue e.g. a `build` command to an already
  2521. running (i.e. `vm:up`:ed) Vagrant instance.
  2522. - Move cpu and mem checks to the `build` task. Previously, when
  2523. they were checked in `vm:up` *only* when issued while the VM
  2524. already is up, so these checks weren't run if one issues a
  2525. `build` when the VM is off. Now we'll fail earlier with a more
  2526. informative error message, and it looks like a more logical home
  2527. for them too.
  2528. - Fix buggy memory checks for RAM building. We have to take into
  2529. account which state the Vagrant VM is in for determining *where*
  2530. we check if enough memory is available for a RAM build. If it's
  2531. off, we check the host; if it's on we check the VM. Previously
  2532. we always checked the host, which doesn't make sense when the VM
  2533. is already started.
  2534. * Automated test suite
  2535. - Bump the tester VM's RAM by 256 MiB. There is not enough free
  2536. RAM to run Tails Upgrader with just 1 GiB of RAM after the
  2537. migration to Wheezy.
  2538. - Always adjust OOM and memory overcommit settings. The kernel
  2539. freezes seem to also happen for the amd64 kernel when filling
  2540. the memory.
  2541. - Add option to make Sikuli rety on FindFailed. This makes it
  2542. possible to update manu images for Sikuli in just *one* test
  2543. suite run, by continuously updating outdated pictures as we go.
  2544. - Actually run "Upgrade from ISO" from a USB drive running the old
  2545. version. That's what users do, and is buggy.
  2546. - Automatically test persistent directories permissions (Closes: #7560).
  2547. - Use read-write persistence when testing upgraded USB
  2548. installations. Otherwise e.g. the permission fixes won't get
  2549. applied, and the subsequent steps testing the permissions will
  2550. fail.
  2551. - Actually check that the ISO's Tails is installed. The step
  2552. "Tails is installed on USB drive $TARGET" only checks that the
  2553. *running* Tails is installed on $TARGET, which obviously fails
  2554. when doing an upgrade from ISO running an old Tails. That it
  2555. worked for the same scenario running the current Tails is just
  2556. coincidental.
  2557. - Use OpenJDK 7 to run our test suite (Closes #7175).
  2558. - Use qemu-system-x86_64 directly, instead of kvm, for running the
  2559. automated test suite (Closes: #7605).
  2560. -- Tails developers <tails@boum.org> Sun, 20 Jul 2014 23:16:13 +0200
  2561. tails (1.0.1) unstable; urgency=medium
  2562. * Security fixes
  2563. - Upgrade the web browser to 24.6.0esr-0+tails1~bpo60+1
  2564. (Firefox 24.6.0esr + Iceweasel patches + Torbrowser patches).
  2565. Also import the Tor Browser profile at commit
  2566. 90ba8fbaf6f23494f1a0e38d63153b3b7e65d3d3 from
  2567. ttp/tor-browser-24.6.0esr-3.x-1.
  2568. - Install Linux 3.14 from Debian unstable (fixes CVE-2014-3153 and
  2569. others).
  2570. - Install openssl from Squeeze LTS (fixes CVE-2014-0076,
  2571. CVE-2014-0195, CVE-2014-0221, CVE-2014-3470 and CVE-2014-0224).
  2572. - Install GnuTLS from Squeeze LTS (fixes CVE-2014-3466.).
  2573. * Minor improvements
  2574. - Add Squeeze LTS APT sources. It has been given a low pinning
  2575. priority so explicit pinning must be used to actually install
  2576. anything from it.
  2577. - Upgrade Tor to 0.2.4.22-1~d60.squeeze+1.
  2578. - Upgrade I2P to 0.9.13-1~deb6u+1.
  2579. -- Tails developers <tails@boum.org> Sun, 08 Jun 2014 19:14:00 +0200
  2580. tails (1.0) unstable; urgency=medium
  2581. * Security fixes
  2582. - Upgrade the web browser to 24.5.0esr-0+tails1~bpo60+1
  2583. (Firefox 24.5.0esr + Iceweasel patches + Torbrowser patches).
  2584. - Upgrade Tor to 0.2.4.21-1+tails1~d60.squeeze+1:
  2585. * Based on 0.2.4.21-1~d60.squeeze+1.
  2586. * Backport the fix for Tor bug #11464. It adds client-side blacklists for
  2587. all Tor directory authority keys that was vulnerable to Heartbleed.
  2588. This protects clients in case attackers were able to compromise a
  2589. majority of the authority signing and identity keys.
  2590. * Bugfixes
  2591. - Disable inbound I2P connections. Tails already restricts incoming
  2592. connections, but this change tells I2P about it.
  2593. - Fix link to the system requirements documentation page in the Tails
  2594. Upgrader error shown when too little RAM is available.
  2595. * Minor improvements
  2596. - Upgrade I2P to 0.9.12-2~deb6u+1.
  2597. - Import TorBrowser profile. This was forgotten in Tails 0.23 and even
  2598. though we didn't explicitly set those preferences in that release
  2599. they defaulted to the same values. This future-proofs us in case the
  2600. defaults would ever change.
  2601. - Import new custom version of tor-launcher:
  2602. * Based on upstream Tor Launcher 0.2.5.3.
  2603. * Improve how Tor Launcher handles incomplete translation.
  2604. (Tor bug #11483; more future-proof fix for Tails bug #6885)
  2605. * Remove the bridge settings prompt. (Tor bug #11482; closes Tails
  2606. bug #6934,)
  2607. * Always show bridge help button. (Tor bug #11484)
  2608. - Integrate the new Tails logo into various places:
  2609. * The website
  2610. * The boot splash
  2611. * The "About Tails" dialog
  2612. * Build system
  2613. - Use the stable APT suite when building from the stable Git branch
  2614. (Closes: #7022).
  2615. * Test suite
  2616. - Add test for the #7022 fix.
  2617. -- Tails developers <tails@boum.org> Sun, 27 Apr 2014 19:34:01 +0200
  2618. tails (0.23) unstable; urgency=medium
  2619. * Security fixes
  2620. - Upgrade the web browser to 24.4.0esr-0+tails1~bpo60+1
  2621. (Firefox 24.4.0esr + Iceweasel patches + Torbrowser patches).
  2622. * Major new features
  2623. - Spoof the network interfaces' MAC address by default (Closes: #5421),
  2624. as designed on https://tails.boum.org/contribute/design/MAC_address/.
  2625. - Rework the way to configure how Tor connects to the network
  2626. (bridges, proxy, fascist firewall): add an option to Tails Greeter,
  2627. start Tor Launcher when needed (Closes: #5920, #5343).
  2628. * Bugfixes
  2629. - Additional software: do not crash when persistence is disabled
  2630. (Closes: #6440).
  2631. - Upgrade Pidgin to 2.10.9, that fixes some regressions introduced
  2632. in the 2.10.8 security update (Closes: #6661).
  2633. - Wait for Tor to have fully bootstrapped, plus a bit more time,
  2634. before checking for upgrades (Closes: #6728) and unfixed known
  2635. security issues.
  2636. - Disable the Intel Management Engine Interface driver (Closes: #6460).
  2637. We don't need it in Tails, it might be dangerous, and it causes bugs
  2638. on various hardware such as systems that reboot when asked to shut down
  2639. - Add a launcher for the Tails documentation. This makes it available
  2640. in Windows Camouflage mode (Closes: #5374, #6767).
  2641. - Remove the obsolete wikileaks.de account from Pidgin (Closes: #6807).
  2642. * Minor improvements
  2643. - Upgrade Tor to 0.2.4.21-1~d60.squeeze+1.
  2644. - Upgrade obfsproxy to 0.2.6-2~~squeeze+1.
  2645. - Upgrade I2P to 0.9.11-1deb6u1.
  2646. - Install 64-bit kernel instead of the 686-pae one (Closes: #5456).
  2647. This is a necessary first step towards UEFI boot support.
  2648. - Install Monkeysign (in a not-so-functional shape yet).
  2649. - Disable the autologin text consoles (Closes: #5588). This was one of
  2650. the blockers before a screen saver can be installed
  2651. in a meaningful way (#5684).
  2652. - Don't localize the text consoles anymore: it is broken on Wheezy,
  2653. the intended users can as well use loadkeys, and we now do not have
  2654. to trust setupcon to be safe for being run as root by the desktop user.
  2655. - Make it possible to manually start IBus.
  2656. - Reintroduce the possibility to switch identities in the Tor Browser,
  2657. using a filtering proxy in front of the Tor ControlPort to avoid giving
  2658. full control over Tor to the desktop user (Closes: #6383).
  2659. - Incremental upgrades improvements:
  2660. · Drop the Tails Upgrader launcher, to limit users' confusion
  2661. (Closes: #6513).
  2662. · Lock down sudo credentials a bit.
  2663. · Hide debugging information (Closes: #6505).
  2664. · Include ~/.xsession-errors in WhisperBack bug reports.
  2665. This captures the Tails Upgrader errors and debugging information.
  2666. · Report more precisely why an incremental upgrade cannot be done
  2667. (Closes: #6575).
  2668. · Various user interface and phrasing improvements.
  2669. - Don't install the Cookie Monster browser extension (Closes: #6790).
  2670. - Add a browser bookmark pointing to Tor's Stack Exchange (Closes: #6632).
  2671. - Remove the preconfigured #tor channel from the Pidgin: apparently,
  2672. too many Tails users go ask Tails questions there, without making
  2673. it clear that they are running Tails, hence creating a user-support
  2674. nightmare (Closes: #6679).
  2675. - Use (most of) Tor Browser's mozconfig (Closes: #6474).
  2676. - Rebase the browser on top of iceweasel 24.3.0esr-1, to get
  2677. the certificate authorities added by Debian back (Closes: #6704).
  2678. - Give access to the relevant documentation pages from Tails Greeter.
  2679. - Hide Tails Greeter's password mismatch warning when entry is changed.
  2680. - Persistent Volume Assistant:
  2681. · Take into account our installer is now called Tails Installer.
  2682. · Optimize window height (Closes: #5458).
  2683. · Display device paths in a more user-friendly way (Closes: #5311).
  2684. * Build system
  2685. - Ease updating POT and PO files at release time, and importing translations
  2686. from Transifex (Closes: #6288, #6207).
  2687. - Drop custom poedit backport, install it from squeeze-backports-sloppy.
  2688. - Make ISO and IUK smaller (Closes: #6390, #6425):
  2689. · Exclude more files from being included in the ISO.
  2690. · Remove *.pyc later so that they are not recreated.
  2691. · Truncate log files later so that they are not filled again.
  2692. · At ISO build time, set mtime to the epoch for large files whose content
  2693. generally does not change between releases. This forces rsync
  2694. to compare the actual content of these files, when preparing an IUK,
  2695. instead of blindly adding it to the IUK merely because the mtime
  2696. has changed, while the content is the same.
  2697. - Make local hooks logging consistent.
  2698. * Test suite
  2699. - Migrate from JRuby to native Ruby + rjb.
  2700. - The test suite can now be run on Debian Wheezy + backports.
  2701. - Fix buggy "persistence is not enabled" step (Closes: #5465).
  2702. - Use IPv6 private address as of RFC 4193 for the test suite's virtual
  2703. network. Otherwise dnsmasq from Wheezy complains, as it is not capable
  2704. of handling public IPv6 addresses.
  2705. - Delete volumes after each scenario unless tagged @keep_volumes.
  2706. - Add an anti-test to make sure the memory erasure test works fine.
  2707. - A *lot* of bugfixes, simplifications and robustness improvements.
  2708. -- Tails developers <tails@boum.org> Tue, 18 Mar 2014 00:58:50 +0100
  2709. tails (0.22.1) unstable; urgency=medium
  2710. * Security fixes
  2711. - Upgrade the web browser to 24.3.0esr-0+tails1~bpo60+2
  2712. (Firefox 24.3.0esr + Iceweasel patches + Torbrowser patches).
  2713. - Upgrade NSS to 3.14.5-1~bpo60+1.
  2714. - Upgrade Pidgin to 2.10.8.
  2715. - Workaround browser size fingerprinting issue by using small icons
  2716. in the web browser's navigation toolbar (Closes: #6377).
  2717. We're actually hit by Tor#9268, and this is the best workaround gk
  2718. and I were able to find when discussing this on Tor#10095.
  2719. * Major new features
  2720. - Check for upgrades availability using Tails Upgrader, and propose
  2721. to apply an incremental upgrade whenever possible (Closes: #6014).
  2722. · Run tails-update-frontend at session login time.
  2723. · Have tails-security-check only report unfixed security issues.
  2724. · Greatly improve the Tails Upgrader UI and strings phrasing.
  2725. · Enable startup notification for Tails Upgrader.
  2726. - Install Linux 3.12 (3.12.6-2) from Debian testing. Unfortunately,
  2727. this breaks the memory wipe feature on some hardware (#6460), but
  2728. it fixes quite a few security issues, and improves hardware support.
  2729. - Update the build system to be compatible with Vagrant 1.2 and 1.3,
  2730. in addition to the already supported versions (Closes: #6221).
  2731. Thanks to David Isaac Wolinsky <isaac.wolinsky@gmail.com>.
  2732. * Bugfixes
  2733. - Do not start IBus for languages that don't need it. This fixes
  2734. the keybindings problems introduced in 0.22 (Closes: #6478).
  2735. Thanks to WinterFairy.
  2736. - Disable network.proxy.socks_remote_dns in the Unsafe Browser.
  2737. Bugfix against 0.22 (Closes: #6479).
  2738. - Fetch Tor Browser User-Agent from its own prefs, rather than from
  2739. the obsolete Torbutton ones. Bugfix against 0.22 (Closes: #6477).
  2740. - Upgrade Vagrant basebox to include up-to-date Debian archive keys
  2741. (Closes: #6515, #6527).
  2742. - Do not use a non-working proxy for downloading the Vagrant basebox
  2743. (Closes: #6514).
  2744. - Use IE's icon in Windows camouflage mode.
  2745. Bugfix against 0.22 (Closes: #6536).
  2746. - Support "upgrading" a partial Tails installation (Closes: #6438)
  2747. and fix missing confirmation dialog in Tails Installer (Closes: #6437).
  2748. Thanks to Andres Gomez Ramirez <andres.gomez@cern.ch>.
  2749. - Fix browser homepage in Spanish locales (Closes: #6612).
  2750. * Minor improvements
  2751. - Tor 0.2.4 is stable! Adapt APT sources accordingly.
  2752. - Update Tor Browser to 24.2.0esr-1+tails1, that uses its own NSS
  2753. library instead of the system one.
  2754. - Update Torbutton to 1.6.5.3.
  2755. - Do not start Tor Browser automatically, but notify when Tor is ready.
  2756. Warn the user when they attempt to start Tor Browser before Tor is ready.
  2757. - Import Tor Browser profile at
  2758. 3ed5d9511e783deb86835803a6f40e7d5a182a12 from ttp/tor-browser-24.2.0esr-1.
  2759. - Use http.debian.net for Vagrant builds, instead of the mostly broken
  2760. (and soon obsolete) cdn.debian.net.
  2761. - Phrasing and UI improvements in tails-upgrade-frontend.
  2762. - Style and robustness improvements in tails-security-check.
  2763. - Make room for upcoming UEFI support in Tails Installer.
  2764. -- Tails developers <tails@boum.org> Wed, 29 Jan 2014 15:08:13 +0100
  2765. tails (0.22) unstable; urgency=medium
  2766. [Tails developers]
  2767. * Security fixes
  2768. - Upgrade to Iceweasel 24.2.0esr that fixes a few serious security issues.
  2769. - Stop migrating persistence configuration and access rights. Instead,
  2770. disable all persistence configuration files if the mountpoint has wrong
  2771. access rights (Closes: #6413).
  2772. - Upgrade to NSS 3.15.3 that fixes a few serious security issues affecting
  2773. the browser, such as CVE-2013-1741, CVE-2013-5605 and CVE-2013-5606.
  2774. * Major improvements
  2775. - Switch to Iceweasel 24 (Closes: #6370).
  2776. · Resync' (most) Iceweasel prefs with TBB 3.0-beta-1 and get rid
  2777. of many obsolete or default settings.
  2778. · Disable WebRTC (Closes: #6468).
  2779. · Import TorBrowser profile at commit
  2780. 51bf06502c46ee6c1f587459e8370aef11a3422d from the tor-browser-24.2.0esr-1
  2781. branch at https://git.torproject.org/tor-browser.git.
  2782. - Switch to Torbutton 1.6.5 (Closes: #6371).
  2783. · Prevent Torbutton from asking users to "upgrade TBB".
  2784. · Use the same Tor SOCKS port as the TBB (9151) for our web browser.
  2785. This should be enough to avoid being affected by Tor#8511.
  2786. · Disable Torbutton 1.6's check for Tor.
  2787. Unfortunately, the new check.torproject.org breaks the remote Tor
  2788. check. We cannot use the local Tor check with the control port. So,
  2789. the shortest and sanest path to fixing the check issue, because the
  2790. remote Tor check is broken" seems to simply disable this check.
  2791. Patch submitted upstream as Tor#10216.
  2792. - Prepare incremental upgrades to be the next default way to upgrade Tails,
  2793. on point-releases at least.
  2794. * Bugfixes
  2795. - Deny X authentication only after Vidalia exits (Closes: #6389).
  2796. - Disable DPMS screen blanking (Closes: #5617).
  2797. - Fix checking of the persistent volume's ACL.
  2798. - Sanitize more IP and MAC addresses in bug reports (Closes: #6391).
  2799. - Do not fail USB upgrade when the "tmp" directory exists on the
  2800. destination device.
  2801. - Tails Installer: list devices with isohybrid Tails installed
  2802. (Closes: #6462).
  2803. * Minor improvements
  2804. - Create a configuration file for additional software if needed
  2805. (Closes: #6436).
  2806. - Translations all over the place.
  2807. - Enable favicons in Iceweasel.
  2808. - Do not propose to make permanent NoScript exceptions.
  2809. In Tails, every such thing is temporary, so better only display the menu
  2810. entry that's about temporarily allowing something.
  2811. - Clearer warning when deleting persistent volume (thanks to Andres Gomez
  2812. Ramirez <andres.gomez@cern.ch> for the patch).
  2813. - Make wording in Tails Installer more consistent.
  2814. [ WinterFairy ]
  2815. * Use IBus instead of SCIM (Closes: #5624, #6206).
  2816. It makes it possible to input passwords in pinentry for at least Japanese,
  2817. Chinese and Korean languages.
  2818. * Add an import-translation script.
  2819. This automates the importation process of completed translations
  2820. from Transifex.
  2821. * Always list optimal keyboard layout in the greeter (Closes: #5741).
  2822. * Fix on-the-fly translation of the greeter in various languages
  2823. (Closes: #5469).
  2824. [ Kytv]
  2825. * Update I2P to 0.9.8.1 (Closes: #6080, #5889).
  2826. * Improve I2P configuration:
  2827. - Disable IPv6 support in a nicer way.
  2828. - Disable i2cp (allows java clients to communicate from outside the JVM). If
  2829. this is unset an exception for port 7654 would need to be added to ferm.
  2830. - Disable "in-network" updates (this is also done in the regular I2P
  2831. packages).
  2832. - Disable the outproxies. Access to the Internet is already routed through
  2833. Tor so these are unnecessary. If end-users have a good reason to go
  2834. through one of the I2P outproxies they can turn them back on.
  2835. * Add a couple of default I2P IRC channels to Pidgin.
  2836. * Allow access to the local 'eepsite' through FoxyProxy.
  2837. * Add firewall exceptions for the standard I2P ports.
  2838. -- Tails developers <tails@boum.org> Sat, 30 Nov 2013 16:47:18 +0100
  2839. tails (0.21) unstable; urgency=low
  2840. * Security fixes
  2841. - Don't grant access to the Tor control port for the desktop user
  2842. (amnesia). Else, an attacker able to run arbitrary code as this user
  2843. could obtain the public IP with a get_info command.
  2844. · Vidalia is now run as a dedicated user.
  2845. · Remove the amnesia user from the debian-tor group.
  2846. · Remove the Vidalia launcher in the Applications menu.
  2847. The Vidalia instance it starts is useless, since it can't connect
  2848. to the Tor control port.
  2849. - Don't allow the desktop user to directly change persistence settings.
  2850. Else, an attacker able to run arbitrary code as this user could
  2851. leverage this feature to gain persistent root access, as long as
  2852. persistence is enabled.
  2853. · Fully rework the persistent filesystem and files ownership
  2854. and permissions.
  2855. · Run the Persistent Volume Assistant as a dedicated user, that is
  2856. granted the relevant udisks and filesystem -level credentials.
  2857. · At persistence activation time, don't trust existing persistence
  2858. configuration files, migrate to the new ownership and permissions,
  2859. migrate every known-safe existing settings and backup what's left.
  2860. Warn the user when not all persistence settings could be migrated.
  2861. · Persistent Volume Assistant uses the new ownership and permissions
  2862. scheme when initializing a new persistent volume, and refuses to
  2863. read persistence.conf if it, or the parent directory, hasn't the
  2864. expected permissions.
  2865. · Make boot medium 'system internal' for udisks with bilibop.
  2866. Once Tails is based on Wheezy, this will further complete the
  2867. protection (see #6172 for details).
  2868. - Update Iceweasel to 17.0.10esr-0+tails2~bpo60+1.
  2869. - Update Torbutton to 1.5.2-2, including a patch cherry-picked from
  2870. upstream to make window resizing closer to what the design says.
  2871. * Major new features
  2872. - Add a persistence preset for printing settings (Closes: #5686).
  2873. Reload CUPS configuration after persistence activation.
  2874. - Support SD card connected through a SDIO host adapter (Closes: #6324).
  2875. · Rebrand Tails USB installer to Tails installer.
  2876. · Display devices brand, model and size in the Installer
  2877. (Closes: #6292).
  2878. · Ask for confirmation before installing Tails onto a device
  2879. (Closes: #6293).
  2880. · Add support for SDIO and MMC block devices to the Tails Installer
  2881. (Closes: #5744) and the Persistent Volume Assistant (Closes: #6325).
  2882. · Arm the udev watchdog when booted from SD (plugged in SDIO) too
  2883. (Closes: #6327).
  2884. * Minor improvements
  2885. - Provide a consistent path to the persistent volume mountpoint
  2886. (Closes: #5854).
  2887. - Add a KeePassX launcher to the top GNOME panel (Closes: #6290).
  2888. - Rework bug reporting workflow: point the desktop launcher to
  2889. the troubleshooting page.
  2890. - Make /home world-readable at build time, regardless of the Git
  2891. working copy permissions. This makes the build process more robust
  2892. against strict umasks.
  2893. - Add signing capabilities to the tails-build script (Closes: #6267).
  2894. This is in turn used to sign ISO images built by our Jenkins setup
  2895. (Closes: #6193).
  2896. - Simplify the ikiwiki setup and make more pages translatable.
  2897. - Exclude the version string in GnuPG's ASCII armored output.
  2898. - Prefer stronger ciphers (AES256,AES192,AES,CAST5) when encrypting
  2899. data with GnuPG.
  2900. - Use the same custom Startpage search URL than the TBB.
  2901. This apparently disables the new broken "family" filter.
  2902. - Update AdBlock Plus patterns.
  2903. - Install Linux from Debian testing.
  2904. (That is, the same version that was shipped in 0.20.1.)
  2905. * Test suite
  2906. - Look for "/tmp/.X11-unix/X${1#:}" too when detecting displays in use.
  2907. - Adapt tests to match the Control Port access security fix:
  2908. · Take into account that the amnesia user isn't part of the debian-tor
  2909. group anymore.
  2910. · Run as root the checks to see if a process is running: this
  2911. is required to see other users' processes.
  2912. -- Tails developers <tails@boum.org> Sat, 26 Oct 2013 23:42:46 +0200
  2913. tails (0.20.1) unstable; urgency=low
  2914. * Major new features
  2915. - Install Tor 0.2.4.17-rc-1~d60.squeeze+1 from the Tor project's repository.
  2916. - Install Iceweasel 17.0.9esr with Torbrowser patches.
  2917. - Install Linux kernel 3.10-3 (version 3.10.11-1) from sid.
  2918. * Bugfixes
  2919. - Remount persistence devices read-only at shutdown/reboot time
  2920. (Closes: #6228).
  2921. - Greeter: display a warning icon on admin password mismatch and on
  2922. persistence unlocking failure. Thanks to Andres Gomez Ramirez
  2923. <andres.gomez@cern.ch> for the fix!
  2924. - Don't torsocksify Pidgin.
  2925. Instead we disable Pidgin's GNOME integration to get the "Global proxy
  2926. configuration", which we set to use Tor. This fixes the I2P IRC account.
  2927. - Additional software: fix typo in notification.
  2928. - Allow installing "Priority: standard" packages that we do not install
  2929. by default: remove them late in the build process instead of assigning
  2930. them a -1 APT pinning level.
  2931. * Minor improvements
  2932. - Update AdBlock Plus patterns.
  2933. - Use more unique ISO file name when building from Jenkins.
  2934. - Additional software: point to the system log on upgrade failure.
  2935. - Set SOCKS5_USER and SOCKS5_PASSWORD in the connect-socks wrapper (used
  2936. by Git). Else, Tor 0.2.4's IsolateSOCKSAuth and connect-proxy
  2937. sometimes play together in some way that makes connect-proxy ask for
  2938. a password to connect to the SocksPort. SOCKS5_USER and
  2939. SOCKS5_PASSWORD are passed through unchanged if they were manually set
  2940. by the user already.
  2941. - Use our custom connect-socks wrapper for SSH. Else, Tor 0.2.4's
  2942. IsolateSOCKSAuth and connect-proxy sometimes play together in some way
  2943. that makes connect-proxy ask for a password to connect to the
  2944. SocksPort. Note that connect-socks uses the default SocksPort too, so
  2945. no change here wrt. our connection isolation design.
  2946. * Localization
  2947. - Import new translations from Transifex.
  2948. * Test suite
  2949. - Fix old ISO checking for consistent error reporting.
  2950. - Remove custom persistence test from manual test suite.
  2951. It was removed for the GUI in t-p-s 0.33.
  2952. -- Tails developers <tails@boum.org> Sun, 15 Sep 2013 15:49:36 +0200
  2953. tails (0.20) unstable; urgency=low
  2954. * Major new features
  2955. - Install Linux kernel 3.10.3-1 from Debian unstable.
  2956. - Iceweasel 17.0.8esr + Torbrowser patches.
  2957. * Bugfixes
  2958. - Prevent Iceweasel from displaying a warning when leaving HTTPS web sites.
  2959. - Make Iceweasel use the correct, localized search engine.
  2960. - Fix Git access to https:// repositories.
  2961. * Minor improvements
  2962. - Install Dasher, a predictive text entry tool.
  2963. - Add a wrapper around TrueCrypt which displays a warning about it soon
  2964. being deprecated in Tails.
  2965. - Remove Pidgin libraries for all protocols but IRC and Jabber/XMPP.
  2966. Many of the other protocols Pidgin support are broken in Tails and
  2967. haven't got any security auditting.
  2968. - Disable the pre-defined Pidgin accounts so they do not auto-connect
  2969. on Pidgin start.
  2970. - Include information about Alsa in WhisperBack reports.
  2971. - Explicitly restrict access to ptrace. While this setting was enabled
  2972. by default in Debian's Linux 3.9.6-1, it will later disabled in 3.9.7-1.
  2973. It's unclear what will happen next, so let's explicitly enable it ourselves.
  2974. - Do not display dialog when a message is sent in Claws Mail.
  2975. - Sync iceweasel preferences with the Torbrowser's.
  2976. * Localization
  2977. - Many translation updates all over the place.
  2978. - Merge all Tails-related POT files into one, and make use of intltoolize
  2979. for better integration with Transifex.
  2980. -- Tails developers <tails@boum.org> Tue, 30 Jul 2013 14:19:57 +0200
  2981. tails (0.19) unstable; urgency=low
  2982. * Major new features
  2983. - Install Linux kernel 3.9.5-1 from Debian unstable.
  2984. Features of particular interest for Tails are the Yama LSM
  2985. (ptrace scope restrictions) and improved hardware support.
  2986. As a corollary, install initramfs-tools from there too.
  2987. - Iceweasel 17.0.7esr + Torbrowser patches.
  2988. - Unblock Bluetooth, Wi-Fi, WWAN and WiMAX; block every other type of
  2989. wireless device. Next steps are described on the
  2990. todo/protect_against_external_bus_memory_forensics ticket.
  2991. * Bugfixes
  2992. - Fix write access to boot medium at the block device level,
  2993. by installing bilibop-udev. Thanks to quidame for his support.
  2994. - tails-greeter l10n-related fixes, thanks to winterfairy:
  2995. · Fix so translations is applied on password mismatch messages.
  2996. · Separate forward and login buttons and make them translatable.
  2997. - Fix link to documentation when no sudo password is set.
  2998. - gpgApplet: partial fix for clipboard emptying after a wrong passphrase
  2999. was entered.
  3000. - Workaround aufs bug in Unsafe Browser script.
  3001. * Minor improvements
  3002. - Drop GNOME proxy settings: we did not find any use of it we were keen
  3003. to support, other than two programs (Seahorse, Pidgin) that are now run
  3004. with torsocks.
  3005. - Format newly created persistent volumes as ext4.
  3006. - GnuPG: don't connect to the keyserver specified by the key owner.
  3007. This feature opens the door to a variety of subtle attacks.
  3008. - GnuPG: locate keys only from local keyrings.
  3009. This is probably the default, but better safe than sorry.
  3010. - Install virt-what from Wheezy.
  3011. The version from Squeeze does not detect at least Parallels for Mac v.8.
  3012. - Upgrade live-boot and live-config to the 3.0.x final version from Wheezy.
  3013. · Remove /live and /lib/live/image compatibility symlinks.
  3014. · Add /live/overlay -> /lib/live/mount/overlay symlink.
  3015. The live-boot changes (commit d2b2a461) brought to fix Debian bug
  3016. #696495 revert some of our previous changes (commit 77dab1cb), and as
  3017. a result, at the time live-persist runs, no tmpfs is mounted on
  3018. /live/overlay, which breaks the aufs mount. So, let's just ensure
  3019. /live/overlay points to a tmpfs.
  3020. · Really disable policykit and sudo live-config hooks.
  3021. ... by making it believe they've already been run.
  3022. This workarounds new live-config's default behavior.
  3023. * Localization
  3024. - Many translation updates all over the place.
  3025. * Test suite
  3026. - Re-enable previously disabled boot device permissions test.
  3027. -- Tails developers <tails@boum.org> Wed, 26 Jun 2013 12:36:20 +0200
  3028. tails (0.18) unstable; urgency=low
  3029. * New features
  3030. - Support obfs3 bridges.
  3031. - Automatically install a custom list of additional packages chosen by
  3032. the user at the beginning of every working session, and upgrade them
  3033. once a network connection is established (technology preview).
  3034. * Iceweasel
  3035. - Upgrade to Iceweasel 17.0.6esr-0+tails1~bpo60+1.
  3036. - Update Torbrowser patches to current maint-2.4 branch (567682b).
  3037. - Isolate DOM storage to first party URI, and enable DOM storage:
  3038. don't set dom.storage.enabled anymore, and set Torbutton's
  3039. disable_domstorage to false.
  3040. - Isolate the image cache per url bar domain.
  3041. - Torbutton 1.5.2, and various prefs hacks to fix breakage:
  3042. · Add .saved version of the Torbutton preferences the TBB also sets.
  3043. · Set TOR_SOCKS_HOST and TOR_SOCKS_PORT.
  3044. · Move some prefs (network.proxy.*, extensions.autoDisableScopes,
  3045. extensions.foxyproxy.last-version) to user.js.
  3046. Else, with Torbutton 1.5.x, these ones are not taken into account.
  3047. · Set network.proxy.socks_version.
  3048. Else we get the meaningless user_pref("network.proxy.socks_version", 9063);
  3049. in prefs.js after the initial startup.
  3050. · Set extensions.foxyproxy.socks_remote_dns to true.
  3051. Else, it overrides the various ways we set network.proxy.socks_remote_dns,
  3052. which in turn makes Torbutton think it should start in non-Tor mode.
  3053. · Also pass the TOR_SOCKS_* environment variables to iceweasel when
  3054. generating the profile: Torbutton behaves differently depending on
  3055. these variables, so we don't want the initial profile generation to be
  3056. done without them. In practice, this has no implication that we could
  3057. see right now, but better safe than sorry.
  3058. · Import all version overrides from the TBB prefs.
  3059. Else, the User-Agent sent in the HTTP headers is fine, but real
  3060. values leak with JavaScript, as demonstrated by ip-check's "Browser
  3061. type" test.
  3062. · Move a bunch of settings to user_pref(), that are not applied otherwise.
  3063. For some, this fixes a regression in 0.18~rc1.
  3064. For other, the bug was already present in Tails 0.17.2.
  3065. - HTTPS Everywhere 3.2.
  3066. - Update prefs to match the TBB's, fix bugs, and take advantage of the latest
  3067. Torbrowser patches:
  3068. · Increase pipeline randomization.
  3069. · Fix @font-face handling of local() fonts.
  3070. Also disable fallback font rendering.
  3071. · Explicitly disable SPDY v2 and v3.
  3072. · Update http pipelining prefs.
  3073. - Make prefs organization closer to the TBB's:
  3074. · Remove Torbutton prefs that we set at their default value.
  3075. · Import Torbutton preferences from the TBB.
  3076. · Organize iceweasel config files in sections the same way as the TBB.
  3077. - Cleanup prefs:
  3078. · Don't set extensions.torbutton.clear_cookies nor
  3079. extensions.torbutton.saved.share_proxy_settings:
  3080. we don't care about toggling anymore.
  3081. · Don't set extensions.torbutton.saved.download_retention nor
  3082. extensions.torbutton.saved.search_suggest:
  3083. these settings are not used in Torbutton anymore.
  3084. - Update unsafe browser prefs mangling accordingly.
  3085. - Move network.protocol-handler.warn-external.* to user_pref().
  3086. Else they're not applied.
  3087. These prefs are actually ignored by Firefox these days -- the TBB
  3088. design doc reads "They are set still anyway out of respect for the
  3089. dead". Let's go on doing the same.
  3090. - Update extensions.adblockplus.currentVersion.
  3091. - Fetch xul-ext-https-everywhere (3.2-2) and xul-ext-noscript (2.6.6.1-1)
  3092. from Debian unstable. They were uploaded there, and accordingly removed
  3093. from experimental.
  3094. * Bugfixes
  3095. - Linux 3.2.41-2+deb7u2.
  3096. - Fixed swapped filenames of tails-{reboot,shutdown}.desktop.
  3097. Thanks to Mikko Harhanen for the patch.
  3098. - Only add ClientTransportPlugin to torrc when bridge mode is enabled.
  3099. This should bring back support for proxies of type other than obfsproxy.
  3100. * Minor improvements
  3101. - Set kernel.dmesg_restrict=1, and make /proc/<pid>/ invisible
  3102. and restricted for other users. It makes it slightly harder for an attacker
  3103. to gather information that may allow them to escalate privileges.
  3104. - Install gnome-screenshot.
  3105. - Don't disable IPv6 on all network interfaces anymore.
  3106. It turns out the IPv6 leaks we wanted to fix actually don't exist.
  3107. - Add a "About Tails" launcher in the System menu.
  3108. - Install GNOME accessibility themes.
  3109. - Use 'Getting started...' as the homepage for Tails documentation button.
  3110. - Stop relying on the obsolete /live/image compatibility symlink.
  3111. - Disable audio preview in Nautilus.
  3112. - Wheezy was released => Squeeze is now oldstable.
  3113. - Pick Tor from deb.torproject.org regardless of the release name they
  3114. advertise. At some point we needed it, their APT repository still thought
  3115. that stable == Squeeze.
  3116. - Add Wheezy APT sources.
  3117. - Install Linux and related packages from Wheezy.
  3118. Debian sid just got Linux 3.8, and we don't want to switch to a new kernel
  3119. yet.
  3120. - Fetch laptop-mode-tools from Wheezy.
  3121. Wheezy has the version we've been installing in 0.18~rc1,
  3122. while a newer one was uploaded to sid in the meantime.
  3123. - Fetch a few packages from Wheezy instead of unstable.
  3124. Namely: spice-vdagent, libregexp-common-perl, macchanger, service-wrapper,
  3125. libservice-wrapper-java and libservice-wrapper-jni.
  3126. Wheezy has the versions we've been installing for a while, so let's
  3127. avoid having unstable push a newer one to us uselessly at some point.
  3128. Note that at the time of this writing, the versions in sid and in Wheezy
  3129. are the same, so this commit is effectively a no-op as of today: it is
  3130. merely a safeguard for the future.
  3131. * Localization
  3132. - Many translation updates all over the place.
  3133. * Build process
  3134. - Make Vagrant's build-tails script support Jenkins too.
  3135. * Test suite
  3136. - Fix Unsafe Browser test broken by hidepid.
  3137. -- Tails developers <tails@boum.org> Mon, 13 May 2013 22:17:38 +0200
  3138. tails (0.17.2) unstable; urgency=low
  3139. * Iceweasel
  3140. - Upgrade to Iceweasel 17.0.5esr-0+tails2~bpo60+1.
  3141. - Stop displaying obsolete context menu entries ("Open Tor URL" and friends).
  3142. * Hardware support
  3143. - Update Linux to 3.2.41-2
  3144. * Bugfixes
  3145. - Use more reliable OpenPGP keyservers:
  3146. · use the hkps pool in GnuPG (and import their SSL CA)
  3147. · use hkp://pool.sks-keyservers.net in Seahorse (as it does not support
  3148. hkps yet)
  3149. - Keep udisks users (GNOME Disk Utility, tails-persistence-setup, etc.)
  3150. from resetting the system partition's attributes when manipulating the
  3151. partition table. To this end, backport the relevant bugfix from Wheezy
  3152. into parted 2.3-5+tails1. This allowed to remove the sgdisk-based
  3153. workaround in tais-persistence-setup, and to stop installing
  3154. python-parted. All this is a first needed step to fix
  3155. todo/make_system_disk_read-only in a future release.
  3156. * Minor improvements
  3157. - Disable NoScript's HTML5 media click-to-play for better user experience.
  3158. * Localization
  3159. - Tails USB installer: update translations for French, German, Spanish,
  3160. Finnish, Greek, Italian, Latvian, Dutch, Polish and Chinese.
  3161. - Tails Greeter: update translations for Farsi, Chinese, French;
  3162. new translations: Finnish, Norwegian Bokmål, Galician.
  3163. - tails-persistence-setup: update Farsi and Chinese translations;
  3164. import new translations for Finnish and Swedish.
  3165. - WhisperBack: update translations for Arabic, French, German, Greek,
  3166. Spanish, Korean, Polish, Russian. New translations: Finnish, Chinese.
  3167. * Build process
  3168. - Add automated testing framework (Sikuli, Cucumber, libvirt -based)
  3169. with a bunch of tests.
  3170. -- Tails developers <amnesia@boum.org> Sun, 07 Apr 2013 12:17:26 +0200
  3171. tails (0.17.1) unstable; urgency=low
  3172. * Iceweasel
  3173. - Upgrade to Iceweasel 17.0.4esr-0+tails1~bpo60+1.
  3174. * Hardware support
  3175. - Update Linux to 3.2.39-2.
  3176. It includes the drm and agp subsystems from Linux 3.4.29.
  3177. - Don't install xserver-xorg-video-rendition backport.
  3178. xserver-xorg-video-rendition has been removed from squeeze-backports
  3179. due to an upstream tarball mismatch discover when merging backports
  3180. into the main Debian archive, and xserver-xorg-video-all still depends
  3181. on it, so we explicitly install all drivers from -all but -rendition
  3182. as a (hopefully temporary) workaround.
  3183. * Minor improvements
  3184. - Remove Indymedia IRC account, until we ship a version of Pidgin
  3185. with SASL support, that is when Tails is based on Wheezy.
  3186. * Build system
  3187. - Don't ship the wiki's todo and bugs on ISO images.
  3188. -- Tails developers <amnesia@boum.org> Thu, 21 Mar 2013 18:54:11 +0100
  3189. tails (0.17) unstable; urgency=low
  3190. * New features
  3191. - Install the KeePassX password manager, with a configuration and
  3192. documentation that makes it easy to persist the password database.
  3193. * Iceweasel
  3194. - Upgrade to Iceweasel 17.0.3esr-1+tails1~bpo60+1.
  3195. - Install xul-ext-adblock-plus from squeeze-backports.
  3196. - Do not allow listing all available fonts.
  3197. Set browser.display.max_font_attempts and browser.display.max_font_count
  3198. to enable the Torbrowser Limit-the-number-of-fonts-per-document patch.
  3199. - Set default spellchecker dictionary to English (USA),
  3200. and localize it according to locale with our custom branding extension.
  3201. - Disable the add-ons automatic update feature.
  3202. - Make the generated profile world-readable.
  3203. - Remove NoScript click-to-play confirmation.
  3204. - Sync some prefs set by Torbutton, to be ready when it stops setting these.
  3205. - Disable navigation timing.
  3206. - Disable SPDY. It stores state and may have keepalive issues.
  3207. - More aggressive iceweasel HTTP pipelining settings.
  3208. - Enable WebGL (as click-to-play only).
  3209. - Disable network.http.connection-retry-timeout.
  3210. - Disable full path information for plugins.
  3211. - Remove NoScript blocks of WebFonts.
  3212. - Disable DOM storage in Torbutton.
  3213. Since we don't apply the 0026-Isolate-DOM-storage-to-first-party-URI.patch
  3214. Torbrowser patch yet, and still disable DOM storage, we need to tell
  3215. Torbutton not to use it.
  3216. - Synchronize iceweasel's general.useragent.override with TBB based on FF17.
  3217. The User-Agent settings are not kept up-to-date anymore in Torbutton, so
  3218. we have to keep in sync manually with TBB's settings.
  3219. - Remove obsolete APT pining for Torbutton.
  3220. It's not maintained in Debian anymore, so we now fetch it from our own
  3221. APT repository.
  3222. - Fetch FoxyProxy from Debian experimental and libnspr4-0d from
  3223. squeeze-backports, for compatibility with Iceweasel 17.
  3224. - Rebase bookmarks file on top of the default iceweasel 17 one.
  3225. - Explicitly disable AdBlock Plus "correct typos" feature.
  3226. This feature connects to http://urlfixer.org/.
  3227. It is disabled by default in 2.2-1, but let's be careful.
  3228. * Minor improvements
  3229. - Upgrade to live-boot 3.0~b11-1 and live-config 3.0.12-1.
  3230. Accordingly update the 9980-permissions hook, live-persist,
  3231. unsafe-browser and boot-profile.
  3232. Add compatibility symlinks from /live to /lib/live, and from /live/image
  3233. to /lib/live/mount/medium, to ease the transition.
  3234. - Check for errors when sourcing live-boot files, e.g. to detect when
  3235. they have been renamed upstream.
  3236. - Don't add "quiet" to the kernel command-line ourselves.
  3237. Else, it appears twice as live-build's lb_binary_syslinux adds it too.
  3238. Historically, we've been adding it ourselves on top of that because
  3239. lb_binary_yaboot does not add it, but since we gave up the PowerPC support
  3240. attempt, we're now only interested in syslinux, so let's make it easier
  3241. for the general case, e.g. when one wants to remove the "quiet" parameter
  3242. as suggested by our "Tails does not start" debugging documentation.
  3243. - Upgrade I2P to 0.9.4.
  3244. * Bugfixes
  3245. - Many bugfixes brought by the Debian Squeeze 6.0.7 point-release.
  3246. - Use the regular GnuPG agent + pinentry-gtk2 instead of Seahorse
  3247. as a GnuPG agent. This fixes usage of OpenPGP in Claws Mail,
  3248. and brings support for OpenPGP smartcards.
  3249. - Enable I2P hidden mode.
  3250. Else, killing I2P ungracefully is bad for the I2P network.
  3251. - live-persist: move error() function before the first potential usecase.
  3252. - Add missing executable bit on restart-tor and restart-vidalia.
  3253. - Add shutdown and reboot launchers to the menu.
  3254. This workarounds the lack of a shutdown helper applet in camouflage mode.
  3255. - Remove Pidgin's MXit and Sametime support.
  3256. ... at least until CVE-2013-0273, CVE-2013-0272 and CVE-2013-0271 are
  3257. fixed in Debian stable. While we're at it, don't force file removal in
  3258. these "set -e" build scripts: fail hard, instead of silently ignoring
  3259. the fact that files may have moved or disappeared.
  3260. * Hardware support
  3261. - Install recent Intel and AMD microcode from squeeze-backports,
  3262. explicitly excluding the iucode-tool package that's not a good idea
  3263. for Live systems.
  3264. - Install firmware loader for Qualcomm Gobi USB chipsets.
  3265. This is needed to have various mobile broadband chipsets work.
  3266. - Upgrade barry to 0.18.3-5~bpo60+1.
  3267. This much improved new version supports more hardware & ISP,
  3268. and does not display dozens of spurious error messages at boot time.
  3269. * Build system
  3270. - Remove APT local cache (/Var/cache/apt/{,src}pkgcache.bin).
  3271. -- Tails developers <amnesia@boum.org> Sat, 23 Feb 2013 10:37:57 +0100
  3272. tails (0.16) unstable; urgency=low
  3273. * Minor improvements
  3274. - Replace the too-easy-to-misclick shutdown button with a better
  3275. "Shutdown Helper" Gnome applet.
  3276. - Display ~/Persistent in GNOME Places and GtkFileChooser if it is mounted.
  3277. - Set Unsafe Browser's window title to "Unsafe Browser".
  3278. - Install ekeyd to support the EntropyKey.
  3279. - Install font for Sinhala.
  3280. - Update Poedit to 1.5.4.
  3281. - Kill Vidalia when restarting Tor.
  3282. Doing this as early as possible exposes Vidalia's "broken onion" icon
  3283. to users less.
  3284. - Hide the persistence setup launchers in kiosk mode.
  3285. - Add a shell library for Tor functions.
  3286. These are shared among multiple of our scripts.
  3287. - Install dictionaries for supported languages.
  3288. Install hunspell dictionaries when possible,
  3289. fall back on myspell ones else.
  3290. * Bugfixes
  3291. - Disable IPv6 on all network interfaces.
  3292. This is a workaround for the IPv6 link-local multicast leak that was recently
  3293. discovered. Tails has no local service that listens on IPv6, so there should be
  3294. no regression, hopefully, unless one wants to play with OnionCat and VoIP,
  3295. but those of us should know how to workaround this anyway.
  3296. - live-persist: Fix variable mismatch, fixing probe white-list.
  3297. Tails may previously have been able to list GPT partitions labelled
  3298. "TailsData" on hard drives (!) as valid persistence volumes...
  3299. - live-persist: Fix --media option when no devices are attached.
  3300. Earlier, if it was set to e.g. 'removable-usb' and no USB storage was
  3301. connected, $whitelistdev would be empty, which is interpreted like
  3302. all devices are ok by the rest of the code.
  3303. - Fix SCIM in the autostarted web browser: save IM environment variables
  3304. to a file during Desktop session startup, and export them into the
  3305. autostarted browser's environment.
  3306. - Talk of DVD, not of CD, in the shutdown messages.
  3307. - Make tordate work in bridge mode with an incorrect clock.
  3308. When using a bridge Tor reports TLS cert lifetime errors (e.g. when
  3309. the system clock is way off) with severity "info", but when no bridge
  3310. is used the severity is "warn". tordate/20-time.sh depends on grepping
  3311. these error messages, so we termporarily increase Tor's logging
  3312. severity when using bridge mode. If we don't do this tordate will
  3313. sleep forever, leaving Tor in a non-working state.
  3314. · White-list root to use Tor's ControlPort.
  3315. · Add logging for is_clock_way_off().
  3316. · Remove Tor's log before time syncing.
  3317. We depend on grepping stuff from the Tor log (especially for
  3318. tordate/20-time.sh), so deleting it seems like a Good Thing(TM).
  3319. · Stop Tor before messing with its log or data dir.
  3320. - live-persist: limit searched devices the same way as live-boot.
  3321. If no --media argument is specified, use live-boot's
  3322. "(live-media|bootfrom)=removable(|-usb)" argument to limit devices
  3323. searched for a persistent volume.
  3324. - tails-greeter: do not pass media=removable to live-persist.
  3325. Now that we have autodetection with kernel command-line,
  3326. it should not be needed anymore.
  3327. - Start memlockd after configuring it,
  3328. instead of starting it before and restarting it after.
  3329. This avoids running memlockd twice, and prevents other possibly
  3330. surprising race-conditions.
  3331. As a consequence, also have tails-sdmem-on-media-removal start after the
  3332. memlockd service *and* tails-reconfigure-memlockd: to start the watchdog,
  3333. we need memlockd to be properly configured *and* running.
  3334. * iceweasel
  3335. - Set iceweasel homepage to the news section on the Tails website.
  3336. ... using the localized one when possible.
  3337. - Hide the iceweasel add-on bar by default.
  3338. Now that we don't want to ship the Monkeysphere addon anymore,
  3339. that was the only one displayed in there, we can as well hide the whole bar.
  3340. - Don't hide the AdBlock-Plus button in the add-on bar anymore. Now that
  3341. we hide the whole addon bar, we can get rid of this old
  3342. UX improvement.
  3343. - Do not install a placeholder (fake) FireGPG iceweasel extension anymore.
  3344. It was shipped from 0.10 (early 2012) to 0.15 (late November),
  3345. so the migration period should be over now.
  3346. - Don't install xul-ext-monkeysphere anymore.
  3347. The implication of the current keyserver policy are not well
  3348. understood, Monkeysphere is little used in Tails, and we're not sure
  3349. anymore it would be our first bet for the web browser profile with no
  3350. CA. Let's keep the various configuration bits (e.g. FoxyProxy,
  3351. patching MSVA), though, so that advanced users who are used to have
  3352. Monkeysphere in Tails just have to install the package.
  3353. * Build system
  3354. - Install the "standard" task with tasksel for better consistency in the
  3355. Tails ISO images built in various environments.
  3356. - Install p7zip-full. It's a dep by file-roller, but we explicily use it
  3357. elsewhere, and it's better to be safe than sorry.
  3358. - Remove pinning of libvpx0 to sid.
  3359. This package is part of Squeeze, and not from testing/sid.
  3360. We have been shipping the version from Squeeze for a while.
  3361. - Remove config/chroot_local-packages/ from .gitignore.
  3362. The documented way for "external" contributors to add custom packages
  3363. is to put them in chroot_local-packages, and once we pull we import
  3364. any such package into our APT repo and rewrite the
  3365. history appropriately.
  3366. Also, the ability to add packages in there and not see them in "git
  3367. status" makes it very easy to build tainted ISO images with
  3368. non-standard packages, which makes some of us fear can lead to hard to
  3369. debug situations.
  3370. - Make it clearer what can and cannot be done in terms of local packages.
  3371. -- Tails developers <amnesia@boum.org> Thu, 10 Jan 2013 12:47:42 +0100
  3372. tails (0.15) unstable; urgency=low
  3373. * Major new features
  3374. - Persistence for browser bookmarks.
  3375. - Support for obfsproxy bridges.
  3376. * Minor improvements
  3377. - Add the Hangul (Korean) Input Method Engine for SCIM.
  3378. - Add vendor-specific dpkg origin information. This makes dpkg-vendor
  3379. return correct information.
  3380. - Install pcscd and libccid from squeeze-backports. This is needed to
  3381. support, to some extent, some OpenPGP SmartCard readers.
  3382. - Install HPIJS PPD files and the IJS driver (hpijs).
  3383. This adds support for some printers, such as Xerox DocumentCenter400.
  3384. - Optimize fonts display for LCD.
  3385. - Update TrueCrypt to version 7.1a.
  3386. * Bugfixes
  3387. - Do not use pdnsd anymore. It has been orphaned in Debian, has quite
  3388. some bugs in there, and apparently Tor's DNSPort's own caching is
  3389. be good enough.
  3390. - Remove useless iceweasel cookies exceptions. They are useless as
  3391. per-session cookies are allowed.
  3392. - Do not run setupcon on X. This call is only needed on the Linux
  3393. console, no need to annoy the user with a weird "Press enter to
  3394. activate this console" when the open a root shell in a GNOME
  3395. Terminal.
  3396. - Allow the tails-iuk-get-target-file user to connect to the SOCKSPort
  3397. dedicated for Tails-specific software.
  3398. - Fix gpgApplet menu display in Windows camouflage mode.
  3399. - Fix Tor reaching an inactive state if it's restarted in "bridge mode",
  3400. e.g. during the time sync' process.
  3401. * Iceweasel
  3402. - Update iceweasel to 10.0.11esr-1+tails1.
  3403. - User profile is now generated at build time in order to support persistent
  3404. bookmarks.
  3405. - Update HTTPS Everywhere to version 3.0.4.
  3406. - Update NoScript to version 2.6.
  3407. - Fix bookmark to I2P router console.
  3408. - Re-enable Monkeysphere extension to connect to the validation agent.
  3409. * Localization
  3410. - The Tails USB installer, tails-persistence-setup and tails-greeter
  3411. are now translated into Bulgarian.
  3412. - Update Chinese translation for tails-greeter.
  3413. - Update Euskadi translation for WhisperBack.
  3414. * Build system
  3415. - Custom packages are now retrieved from Tails APT repository instead
  3416. of bloating the Git repository.
  3417. - Allow '~' in wiki filenames. This makes it possible to ship
  3418. update-description files for release candidates.
  3419. - Document how to create incremental update kit.
  3420. - Handle release candidates when generating custom APT sources.
  3421. - Remove pinning for xul-ext-adblock-plus.
  3422. It is obsolete since we've added this package to our APT repository.
  3423. -- Tails developers <amnesia@boum.org> Sun, 25 Nov 2012 12:59:17 +0100
  3424. tails (0.14) unstable; urgency=low
  3425. * Major new features
  3426. - Enable Tor stream isolation; several new SocksPorts with
  3427. appropriate Isolate* options have been added for different use
  3428. cases (i.e. applications). All application's have been
  3429. reconfigured to use these new SocksPorts, which should increase
  3430. anonymity by making it more difficulte to correlate traffic from
  3431. different applications or "online identities".
  3432. - The web browser now has the anonymity enhancing patches from the
  3433. TorBrowser applied.
  3434. - gpgApplet can now handle public-key cryptography.
  3435. - Install an additional, PAE-enabled kernel with NX-bit
  3436. support. This kernel is auto-selected when the hardware supports
  3437. it and will:
  3438. * provide executable space protection, preventing certain types of
  3439. buffer overflows from being exploitable.
  3440. * enable more than 4 GiB of system memory.
  3441. * make all processors/cores available, including their
  3442. power-saving functionality.
  3443. - Add a persistence preset for NetworkManager connections.
  3444. * Minor improvements
  3445. - On kexec reboot, make the boot quiet only if debug=wipemem was not
  3446. enabled.
  3447. - Update torproject.org's APT repo key.
  3448. - Update the embedded Tails signing key.
  3449. - Use symlinks instead of duplicating localized searchplugins.
  3450. - Rewrite Tails firewall using ferm. Tails firewall was written in
  3451. very unsophisticated iptables-save/restore format. As more feature
  3452. creeped in, it started to be quite unreadable.
  3453. - Optimize VirtualBox modules build at runtime to avoid installing the
  3454. userspace utils N times.
  3455. - Drop most of Vidalia's configuration. Our custom lines just caused
  3456. trouble (with multiple SocksPorts) and the default works well.
  3457. - Blacklist PC speaker module. On some computers, having the pcspkr
  3458. module loaded means loud beeps at bootup, shutdown and when using
  3459. the console. As it draws useless attention to Tails users, it is
  3460. better to prevent Linux from loading it by default.
  3461. - Remove all addons from the Unsafe Browser. No addons are essential
  3462. for the Unsafe Browser's intent. If anything they will modify the
  3463. network fingerprint compared to a normal Iceweasel install, which
  3464. is undesirable.
  3465. - Prevent some unwanted packages to be installed at all, rather than
  3466. uninstalling them later. This should speed up the build a bit.
  3467. - Add a symlink from /etc/live/config to /etc/live/config.d. This
  3468. makes the system compatible with live-config 3.0.4-1, without
  3469. breaking backward compatibility with various parts of the system
  3470. that use the old path.
  3471. - Do not run unecessary scripts during shutdown sequence, to make
  3472. shutdown faster.
  3473. - Make live-persist deal with persistent ~/.gconf subdirs so that
  3474. any options saved therein actually get persistent.
  3475. - Prevent memlockd unload on shutdown, to make sure that all
  3476. necessary tools for memory wiping are available when the new
  3477. kernel has kexec'd.
  3478. - Patch initscripts headers instead of fiddling with update-rc.d. We
  3479. now let insserv figure out the correct ordering for the services
  3480. during startup and shutdown, i.e. use dependency-based boot
  3481. sequencing.
  3482. - Remove the last absolute path in our isolinux config, which makes
  3483. it easier to migrate from isolinux to syslinux (just rename the
  3484. directory), and hence might make it easier for 3rd party USB
  3485. installers (like the Universal USB Installer) to support Tails.
  3486. * Bugfixes
  3487. - Include `seq` in the ramdisk environment: it is used to wipe more
  3488. memory. This fixes the long-standing bug about Tails not cleaning
  3489. all memory on shutdown.
  3490. - Fix Yelp crashing on internal links
  3491. - Allow amnesia user to use Tor's TransPort. This firewall exception
  3492. is necessary for applications that doesn't have in-built SOCKS
  3493. support and cannot use torsocks. One such example is Claws Mail,
  3494. which uses tsocks since torsocks makes it leak the hostname. This
  3495. exception, together with Tor's automatic .onion mapping makes
  3496. Claws Mail able to use hidden service mail providers again.
  3497. - Force threads locking support in Python DBus binding. Without this
  3498. liveusb-creator doesn't work with a PAE-enabled kernel.
  3499. - Fix localized search plugins for 'es' and 'pt'
  3500. - Fix live-boot's readahead, which caused an unnecessary pause
  3501. during boot.
  3502. - Factorize GCC wanted / available version numbers in VirtualBox
  3503. modules building hook. This, incidentally, fixes a bug caused by
  3504. duplication and not updating all instances.
  3505. - Fix tordate vs. Tor 0.2.3.x. Since 0.2.3.x Tor doesn't download a
  3506. consensus for clocks that are more than 30 days in the past or 2
  3507. days in the future (see commits f4c1fa2 and 87622e4 in Tor's git
  3508. repo). For such clock skews we set the time to the Tor authority's
  3509. cert's valid-after date to ensure that a consensus can be
  3510. downloaded.
  3511. * Tor
  3512. - Update to version 0.2.3.24-rc-1~~squeeze+1, a new major
  3513. version. It's not a stable release, but we have been assured by
  3514. the Tor developers that this is the right move.
  3515. - Stop setting custom value for the Tor LongLivedPorts
  3516. setting. Gobby's port was upstreamed in Tor 0.2.3.x.
  3517. * Iceweasel
  3518. - Update to 10.0.10esr-1+tails1, which has all the anonymity enhancing
  3519. patches from the TorBrowser applied.
  3520. - Install iceweasel from our own repo, http://deb.tails.boum.org.
  3521. - Fix Iceweasel's file associations. No more should you be suggested
  3522. to open a PDF in the GIMP.
  3523. * htpdate
  3524. - Use curl instead of wget, and add a --proxy option passed through
  3525. to curl.
  3526. - Remove the --fullrequest option, we don't need it anymore.
  3527. - Remove --dns-timeout option, we don't need it anymore.
  3528. - Change --proxy handling to support Debian Squeeze's curl.
  3529. - Clarify what happens if --proxy is not used.
  3530. - Compute the median of the diffs more correctly.
  3531. * Hardware support
  3532. - Update Linux to 3.2.32-1.
  3533. * Software
  3534. - Update vidalia to 0.2.20-1+tails1.
  3535. - Update bundled WhisperBack package to 1.6.2:
  3536. * Raise the socket library timeout to 120 seconds
  3537. * Use smtplib's timeout parameter
  3538. * Fix error output when calling send a 2nd time
  3539. - Update liveusb-creator to 3.11.6-3.
  3540. - Update i2p to 0.9.2.
  3541. - Update tails-persistence-setup to 0.20-1, which should make it
  3542. possible to install Tails on large (>= 32 GiB) USB drives.
  3543. - Install console-setup and keyboard-configuration from unstable
  3544. (required by new initramfs-tools).
  3545. - Update tails-greeter to 0.7.3:
  3546. * Import pt_BR translation.
  3547. * Let langpanel usable during option selection stage
  3548. * Print less debugging messages by default
  3549. (below are changes in tails-greeter 0.7.2:)
  3550. * Use correct test operators.
  3551. * Generate language codes of available locales at package build
  3552. time.
  3553. * Read list of language codes from where we have saved it at
  3554. package build time.
  3555. * Drop tails-lang-helper, not used anymore.
  3556. * Do not compile locales at login time anymore. Tails now ships
  3557. locales-all.
  3558. - Import live-config{,-sysvinit} 3.0.8-1. live-config >= 3.0.9-1
  3559. has basically nothing useful for us, and it migrates to new paths
  3560. brought by live-boot 3.0~b7, which we're not ready for yet (see:
  3561. todo/newer_live-boot).
  3562. * Localization
  3563. - Fix Tails specific Iceweasel localization for pt-BR
  3564. - Add Japanese input system: scim-anthy.
  3565. - whisperback is now also translated into German, Hebrew, Hungarian,
  3566. Italian and Korean.
  3567. - tails-persistence-setup is now also translated into Arabic.
  3568. - tails-greeter is now also translated into Arabic, Hebrew, Basque,
  3569. Hungarian, Italian and Chinese.
  3570. * Build system
  3571. - Catch more errors in during build time:
  3572. - Ensure that all local hooks start with 'set -e'.
  3573. - Fail hard if adduser fails in local hooks.
  3574. - Fail hard if 'rm' fails in local hooks.
  3575. - vagrant: Ensure we have the set of Perl packages needed by our
  3576. Ikiwiki
  3577. - vagrant: Configure live-build to ship with ftp.us.debian.org.
  3578. Using cdn.debian.net leads to bad interactions with Tor.
  3579. - vagrant: Don't use gzip compression when building from a tag, i.e.
  3580. a release.
  3581. - vagrant: Optionally use bootstrap stage cache for faster builds
  3582. via the 'cache' build option.
  3583. - vagrant: Make sure release builds are clean, i.e. they don't use
  3584. any potentially dangerous build options.
  3585. - vagrant: Disable live-build package caching. This build system is
  3586. meant to use an external caching proxy, so live-build's cache just
  3587. wastes RAM (for in-memory builds) or disk space.
  3588. - vagrant: use aufs magic instead of copying source into tmpfs.
  3589. This reduces the amount of RAM required for building Tails in.
  3590. - vagrant: Allow in-memory builds when a VM with enough memory is
  3591. already started.
  3592. -- Tails developers <amnesia@boum.org> Sat, 10 Nov 2012 12:34:56 +0000
  3593. tails (0.13) unstable; urgency=low
  3594. * Major new features
  3595. - Use white-list/principle of least privelege approach for local services.
  3596. Only users that need a certain local (i.e. hosted on loopback) service
  3597. (according to our use cases) are granted access to it by our firewall;
  3598. all other users are denied access.
  3599. - Ship a first version of the incremental update system. Updates are not
  3600. currently triggered automatically, but this will allow tests to be done
  3601. on larger scales.
  3602. * Minor improvements
  3603. - Enable four workspaces in the Windows XP camouflage. This allows
  3604. users to quickly switch to a more innocent looking workspace in case
  3605. they are working on sensitive data and attract unwanted attention.
  3606. The workspace switcher applet isn't there, though, since there's no
  3607. such thing in Windows XP, so switching is only possible via keyboard
  3608. shortcuts.
  3609. - Ship with precompiled locales instead of generating them upon login.
  3610. - Add support for wireless regulation.
  3611. - Use color for Git output, not intended for machine consumption,
  3612. written to the terminal.
  3613. - Have ttdnsd use OpenDNS. Using Google's DNS servers was very
  3614. glitchy, and rarely succeeded when it should. It can probably be
  3615. attributed to Google's DNS, which is known to take issue with Tor
  3616. exits.
  3617. - Upgrade WhisperBack to 1.6, with many UI improvements and new translations.
  3618. - Include GDM logs and dmidecode informations in the reports.
  3619. - Allow to modify language and layout in the "Advanced options" screen
  3620. of the greeter.
  3621. - GnuPG: bump cert-digest-algo to SHA512.
  3622. - Update torproject.org's APT repo key.
  3623. * Bugfixes
  3624. - Make Claws Mail save local/POP emails in its dot-directory. The
  3625. default is to save them at ~/Mail, which isn't included in our
  3626. current Claws Mail persistence preset.
  3627. - Fix the System Monitor applet.
  3628. - Remove broken ttdnsd from the default DNS resolution loop.
  3629. - Hide the 'TailsData' partition in desktop applications.
  3630. - Ship unrar-free again, so that the GNOME archive manager knows about
  3631. it.
  3632. - Ship with an empty whitelist for Noscript.
  3633. - Disable FoxyProxy's advertisement on proxy error page.
  3634. - Fix slow browsing experience for offline documentation.
  3635. - Raise the socket timeout to 120 seconds in WhisperBack.
  3636. - Enable the ikiwiki trail plugin for the locally built wiki too.
  3637. * Iceweasel
  3638. - Upgrade iceweasel to 10.0.6esr-1 (Extended Support Release) and install it
  3639. and its dependencies from squeeze-backports.
  3640. * Hardware support
  3641. - Upgrade Linux to 3.2.23-1.
  3642. * Software
  3643. - Update tor to version 0.2.2.39.
  3644. - Update Iceweasel to version 10.0.7esr-2.
  3645. - Update i2p to version 0.9.1.
  3646. * Build system
  3647. - vagrant: Install Ikiwiki from Debian unstable. The 'mirrorlist'
  3648. patches have finally been merged in upstream Ikiwiki. So instead of
  3649. building Ikiwiki by hand, we can now install the package directly
  3650. from Debian unstable.
  3651. - Do not build the ikiwiki forum on the bundled static website copy.
  3652. -- Tails developers <amnesia@boum.org> Mon, 17 Sep 2012 15:19:25 +0200
  3653. tails (0.12.1) unstable; urgency=low
  3654. This is a brown paper bag release to fix two major problems introduced in
  3655. Tails 0.12.
  3656. * Iceweasel
  3657. - Upgrade Torbutton to 1.4.6.
  3658. - Upgrade AdBlock Plus to 2.1.
  3659. - Update AdBlock Plus patterns.
  3660. * Hardware support
  3661. - Upgrade Linux to 3.2.21-3 (linux-image-3.2.0-3-486).
  3662. * Software
  3663. - Install MAT from Debian backports, drop custom package.
  3664. - Install python-pdfrw to re-add PDF support to the MAT.
  3665. - Upgrade tails-greeter to 0.7.1, which fixes the race condition that
  3666. broke administration password and locale settings on some systems.
  3667. * Boot
  3668. - Remove the Tails specific plymouth theme. The theme interfers heavily with
  3669. the boot process on some hardware.
  3670. -- Tails developers <amnesia@boum.org> Mon, 17 Sep 2012 13:06:03 +0200
  3671. tails (0.12) unstable; urgency=low
  3672. * Major new features
  3673. - Add the Unsafe Web Browser, which has direct access to the Internet and
  3674. can be used to login to captive portals.
  3675. - The (previously experimental, now deemed stable) Windows camouflage can now
  3676. be enabled via a check box in Tails greeter.
  3677. * Tor
  3678. - Upgrade to 0.2.2.37-1~~squeeze+1.
  3679. * Iceweasel
  3680. - Upgrade iceweasel to 10.0.5esr-1 (Extended Support Release) and install it
  3681. and its dependencies from squeeze-backports.
  3682. - Add a bookmark for the offline Tails documentation.
  3683. - Update AdBlock patterns.
  3684. * Persistence
  3685. - Allow using larger USB drives by increasing the mkfs timeout to 10 minutes.
  3686. - Tell the user what's going on when the Tails boot device cannot be found.
  3687. * Hardware support
  3688. - Upgrade Linux to 3.2.20-1 (linux-image-3.2.0-2-amd64).
  3689. * Software
  3690. - Install rfkill.
  3691. - Install torsocks. Note that this makes `torify' use `torsocks' instead of
  3692. `tsocks'. The `tsocks' binary is dropped to avoid problems, but remaining
  3693. files (the library) are kept since ttdnsd depends on them.
  3694. - Fetch live-config-sysvinit from sid so that it matches live-config version.
  3695. - Update virtualbox backports to 4.1.10-dfsg-1~bpo60+1.
  3696. - Install pciutils (needed by virtualbox-guest-utils).
  3697. - Install mousetweaks. This is needed to use the mouse accessibility settings
  3698. in System -> Preferences -> Mouse -> Accessibility.
  3699. - Install the "hardlink" files deduplicator.
  3700. - Do not install cryptkeeper anymore. See todo/remove_cryptkeeper for reason.
  3701. Users of cryptkeeper are encouraged to install cryptkeeper via `apt-get
  3702. update; apt-get install --yes cryptkeeper`, open their volume and move
  3703. their to Tails' built-in persistence instead, as a one-time migration.
  3704. - Upgrade I2P to version 0.9.
  3705. - Don't install GParted. GNOME Disk Utility has been on par with GParted
  3706. since Squeeze was released.
  3707. - Upgrade live-boot to 3.0~a27-1+tails2~1.gbp319fe6.
  3708. - Upgrade live-config to 3.0~a39-1 and install it from Debian experimental.
  3709. - Upgrade tails-greeter to 0.7.
  3710. - Upgrade tails-persistence-setup to 0.17-1.
  3711. - Install libyaml-libyaml-perl.
  3712. - Upgrade MAT, the metadata anonymisation toolkit, 0.3.2-1~bpo60+1.
  3713. - Fetch python-pdfrw from backports, drop custom package.
  3714. * Internationalization
  3715. - The Tails website and documentation now has a (partial) Portuguese
  3716. translation.
  3717. * Build system
  3718. - Tails can now be built without using a HTTP proxy.
  3719. - Tails can now easily be built by using Vagrant. See the updated
  3720. contribute/build page for instructions.
  3721. * Boot
  3722. - Remove obsolete noswap boot parameter. live-boot now handles swap on an
  3723. opt-in basis.
  3724. - The squashfs.sort files generated with boot-profile should now be ok which
  3725. makes the generate images boot noticeably faster on optical media. See
  3726. bugs/weird_squashfs.sort_entries for more information.
  3727. - Set Tails specific syslinux and plymouth themes.
  3728. - Add NVidia KMS video drivers to the initrd in order to show our shiny new
  3729. plymouth theme on more systems.
  3730. -- Tails developers <amnesia@boum.org> Mon, 11 Jun 2012 13:37:00 +0200
  3731. tails (0.11) unstable; urgency=low
  3732. * Major new features
  3733. - Do not grant the desktop user root credentials by default.
  3734. - A graphical boot menu (tails-greeter 0.6.3) allows choosing among
  3735. many languages, and setting an optional sudoer password.
  3736. - Support opt-in targeted persistence
  3737. · tails-persistence-setup 0.14-1
  3738. · live-boot 3.0~a25-1+tails1~5.gbp48d06c
  3739. · live-config 3.0~a35-1
  3740. - USB installer: liveusb-creator 3.11.6-1
  3741. * iceweasel
  3742. - Install iceweasel 10.0.4esr-1 (Extended Support Release).
  3743. Let's stop tracking a too fast moving target.
  3744. Debian Wheezy will ship ESR versions.
  3745. - Install needed dependencies from squeeze-backports.
  3746. - Search plugins:
  3747. · Remove bing.
  3748. bing appeared due to our upgrading iceweasel.
  3749. Removing it makes things consistent with the way they have been
  3750. until now, that is: let's keep only the general search engines
  3751. we've been asked to add, plus Google, and a few specialized ones.
  3752. · Replace Debian-provided DuckDuckGo search plugin with the "HTML SSL"
  3753. one, version 20110219. This is the non-JavaScript, SSL, POST flavour.
  3754. · Add ixquick.com.
  3755. · Install localized search engines in the correct place.
  3756. No need to copy them around at boot time anymore.
  3757. · Remove Scroogle. RIP.
  3758. - Enable TLS false start, like the TBB does since December.
  3759. - Adblock Plus: don't count and save filter hits, supress first run dialog.
  3760. - Install neither the GreaseMonkey add-on, nor any GreaseMonkey script.
  3761. YouTube's HTML5 opt-in program is over.
  3762. HTML5 video support is now autodetected and used.
  3763. * Vidalia
  3764. - Upgrade to 0.2.17-1+tails1: drop Do-not-warn-about-Tor-version.patch,
  3765. applied upstream.
  3766. - Set SkipVersionCheck=true.
  3767. Thanks to chiiph for implementing this upstream (needs Vidalia 0.2.16+).
  3768. * Internationalization
  3769. - Install all available iceweasel l10n packages.
  3770. - Remove syslinux language choosing menu.
  3771. tails-greeter allows choosing a non-English language.
  3772. - Add fonts for Hebrew, Thai, Khmer, Lao and Korean languages.
  3773. - Add bidi support.
  3774. - Setup text console at profile time.
  3775. Context: Tails runs with text console autologin on.
  3776. These consoles now wait, using a "Press enter to activate this console"
  3777. message, for the user. When they press enter in there, they should have chosen
  3778. their preferred keyboard layout in tails-greeter by now. Then, we run setupcon.
  3779. As a result, the resulting shell is properly localized, and setupcon
  3780. sets the correct keyboard layout, both according to the preferences expressed by
  3781. the user in tails-greeter.
  3782. - Don't use localepurge, don't remove any Scribus translations anymore,
  3783. don't localize environment at live-config time:
  3784. tails-greeter allows us to support many, many more languages.
  3785. * Hardware support
  3786. - Linux 3.2.15-1 (linux-image-3.2.0-2-amd64).
  3787. - Fix low sound level on MacBook5,2.
  3788. - Disable laptop-mode-tools automatic modules. This modules set often
  3789. needs some amount of hardware-specific tweaking to work properly.
  3790. This makes them rather not well suited for a Live system.
  3791. * Software
  3792. - Install GNOME keyring.
  3793. This is needed so that NetworkManager remembers the WEP/WPA secrets
  3794. for the time of a Tails session. Initialize GNOME keyring at user
  3795. creation time.
  3796. - Install usbutils to have the lsusb command.
  3797. - Install the Traverso multitrack audio recorder and editor.
  3798. * Miscellaneous
  3799. - GNOME Terminal: keep 8192 scrollback lines instead of the smallish
  3800. default.
  3801. - Replaced tails-wifi initscript with laptop-mode-tools matching feature.
  3802. - Disable gdomap service.
  3803. - Fetch klibc-utils and libklibc from sid.
  3804. The last initramfs-tools depends on these.
  3805. - Set root password to "root" if debug=root is passed on the
  3806. kernel cmdline. Allow setting root password on kernel cmdline via
  3807. rootpw=. Looks like we implemented this feature twice.
  3808. - Append a space on the kernel command line. This eases manually adding
  3809. more options.
  3810. - Rename sudoers.d snippets to match naming scheme.
  3811. Sudo credentials that shall be unconditionally granted to the Tails
  3812. default user are named zzz_*, to make sure they are applied.
  3813. - WhisperBack: also include /var/log/live-persist and
  3814. /var/lib/gdm3/tails.persistence.
  3815. - Add a wrapper to torify whois.
  3816. - Rework the VirtualBox guest modules building hook to support
  3817. multiple kernels.
  3818. - Consistently wait for nm-applet when waiting for user session to come up.
  3819. Waiting for gnome-panel or notification-daemon worked worse.
  3820. - Don't start the NetworkManager system service via init.
  3821. Some Tails NM hooks need the user to be logged in to run properly.
  3822. That's why tails-greeter starts NetworkManager at PostLogin time.
  3823. - Also lock /bin/echo into memory. For some reason, kexec-load needs it.
  3824. - Pidgin: don't use the OFTC hidden service anymore.
  3825. It proved to be quite unreliable, being sometimes down for days.
  3826. - Do not display storage volumes on Desktop, by disabling
  3827. /apps/nautilus/desktop/volumes_visible GConf entry. Enabling that
  3828. GConf setting avoids displaying the bind-mounted persistent
  3829. directories on the Desktop, and reduces user confusion. It also is
  3830. a first step towards a bigger UI change: GNOME3 does not manage the
  3831. Desktop anymore, so volume icons and other Desktop icons are meant to
  3832. disappear anyway. It implies we'll have to move all Desktop icons
  3833. elsewhere. Let's start this move now: this will smooth the UI change
  3834. Wheezy will carry for our users, by applying some of it progressively.
  3835. * Build system
  3836. - Don't build hybrid ISO images anymore. They boot less reliably on
  3837. a variety of hardware, and are made less useful by us shipping
  3838. a USB installer from now on.
  3839. - Append .conf to live-config configuration filenames:
  3840. live-config >3.0~a36-1 only takes into account files named *.conf
  3841. in there. Accordingly update scripts that source these files.
  3842. - Remove long-obsolete home-refresh script and its configuration.
  3843. * Virtualization support
  3844. - Support Spice and QXL: install the Spice agent from Debian sid,
  3845. install xserver-xorg-video-qxl from squeeze-backports.
  3846. -- Tails developers <amnesia@boum.org> Tue, 17 Apr 2012 14:54:00 +0200
  3847. tails (0.10.2) unstable; urgency=low
  3848. * Iceweasel
  3849. - Update to 10.0.2-1.
  3850. - Disable HTTPS-Everywhere's SSL Observatory (plus first-run pop-up).
  3851. - Revert "FoxyProxy: don't enclose regexps between ^ and $."
  3852. Currently "http://www.i2p2.de" (and everything similar) is captured by
  3853. the I2P filter, which is incorrect. It seems isMultiLine="false" does
  3854. *not* make RE into ^RE$ any longer.
  3855. - Remove file:// from NoScript's exception lists.
  3856. This will fix the JavaScript toggles in the local copy of the documentation.
  3857. - Update AdBlock patterns.
  3858. * Software
  3859. - Upgrade I2P to 0.8.13.
  3860. - Install libvpx0 from sid.
  3861. - Fetch klibc-utils and libklibc from sid.
  3862. The last initramfs-tools depends on these.
  3863. * Hardware support
  3864. - Upgrade Linux kernel to 3.2.7-1.
  3865. - Install firmware-libertas.
  3866. This adds support for wireless network cards with Marvell Libertas
  3867. 8xxx chips supported by the libertas_cs, libertas_sdio, libertas_spi,
  3868. libertas_tf_usb, mwl8k and usb8xxx drivers.
  3869. * Miscellaneous
  3870. - Revert "Set time to middle of [valid-after, fresh-until] from consensus."
  3871. This reverts commit 18d23a500b9412b4b0fbe4e38a9398eb1a3eadef.
  3872. With this vmid clocks that are E minutes back in time may cause issues
  3873. (temporary Tor outages) after consensus updates that happen at the
  3874. (60-E):th minute or later during any hour. Full analysis:
  3875. https://mailman.boum.org/pipermail/tails-dev/2012-January/000873.html
  3876. - Add the default user to the vboxsf group.
  3877. This will allow the user to get full access to automounted VirtualBox
  3878. shared folders as they are mounted with guid vboxsf and rwx group
  3879. permissions.
  3880. -- Tails developers <amnesia@boum.org> Thu, 01 Mar 2012 20:26:21 +0100
  3881. tails (0.10.1) unstable; urgency=low
  3882. * Iceweasel
  3883. - Make Startpage the default web search engine. Scroogle does not look
  3884. reliable enough these days.
  3885. * Software
  3886. - Upgrade WhisperBack to 1.5.1 (update link to bug reporting documentation).
  3887. - Update MAT to 0.2.2-2~bpo60+1 (fixes a critical bug in the GUI).
  3888. * Hardware support
  3889. - Upgrade Linux kernel to 3.2.1-2
  3890. * Time synchronization
  3891. Serious rework that should fix most, if not all, of the infamous
  3892. time-sync' related bugs some Tails users have experienced recently.
  3893. - Make htpdate more resilient by using three server pools, and
  3894. allowing some failure ratio.
  3895. - Set time from Tor's unverified-consensus if needed.
  3896. - Set time to middle of [valid-after, fresh-until] from consensus.
  3897. - Many robustness, performance and fingerprinting-resistance improvements.
  3898. - Display time-sync' notification much earlier.
  3899. * Miscellaneous
  3900. - Fix access to "dumb" git:// protocol by using a connect-socks wrapper
  3901. as GIT_PROXY_COMMAND.
  3902. - SSH client: fix access to SSH servers on the Internet by correcting
  3903. Host / ProxyCommand usage.
  3904. - Pidgin: use OFTC hidden service to workaround Tor blocking.
  3905. - Claws Mail: disable draft autosaving.
  3906. When composing PGP encrypted email, drafts are saved back to
  3907. the server in plaintext. This includes both autosaved and manually
  3908. saved drafts.
  3909. - tails-security-check-wrapper: avoid eating all memory when offline.
  3910. -- Tails developers <amnesia@boum.org> Sat, 28 Jan 2012 10:00:31 +0100
  3911. tails (0.10) unstable; urgency=low
  3912. * Tor: upgrade to 0.2.2.35-1.
  3913. * Iceweasel
  3914. - Install Iceweasel 9.0 from the Debian Mozilla team's APT repository.
  3915. - Update Torbutton to 1.4.5.1-1.
  3916. - Support viewing any YouTube video that is available in HTML5 format:
  3917. install xul-ext-greasemonkey and the "Permanently Enable HTML5 on
  3918. YouTube" GreaseMonkey script.
  3919. - Stop using Polipo in Iceweasel. Its SOCKS support was fixed.
  3920. - Install from Debian sid the iceweasel extensions we ship,
  3921. for compatibility with FF9.
  3922. - Use Scroogle (any languages) instead of Scroogle (English only) when
  3923. booted in English. Many users choose English because their own
  3924. language is not supported yet; let's not hide them search results in
  3925. their own language.
  3926. - Install Iceweasel language packs from Debian unstable:
  3927. unfortunately they are not shipped on the mozilla.debian.net repository.
  3928. - Install the NoScript Firefox extension; configure it the same way as
  3929. the TBB does.
  3930. - Disable third-party cookies.
  3931. They can be used to track users, which is bad. Besides, this is what
  3932. TBB has been doing for years.
  3933. - FoxyProxy: allow direct connections to RFC1918 IPs.
  3934. * Do not transparent proxy outgoing Internet connections through Tor.
  3935. - Torify the SSH client using connect-proxy to all IPs but RFC1918 ones.
  3936. - Torify APT using Polipo HTTP.
  3937. - Torify wget in wgetrc.
  3938. - Torify gobby clients using torsocks. It does not support proxies yet.
  3939. - Torify tails-security-check using LWP::UserAgent's SOCKS proxy support.
  3940. - Fix enabling of GNOME's HTTP proxy.
  3941. * Software
  3942. - Upgrade Vidalia to 0.2.15-1+tails1.
  3943. · New upstream release.
  3944. · Do not warn about Tor version.
  3945. - Upgrade MAT to 0.2.2-1~bpo60+1.
  3946. - Upgrade VirtualBox guest software to 4.1.6-dfsg-2~bpo60+1,
  3947. built against the ABI of X.Org backports.
  3948. - Upgrade I2P to 0.8.11 using KillYourTV's Squeeze packages;
  3949. additionally, fix its start script that was broken by the tordate merge.
  3950. - Install unar (The Unarchiver) instead of the non-free unrar.
  3951. - Install Nautilus Wipe instead of custom Nautilus scripts.
  3952. * Hardware support
  3953. - Upgrade Linux kernel to 3.1.6-1.
  3954. - Upgrade to X.Org from squeeze-backports.
  3955. - Install more, and more recent b43 firmwares.
  3956. - Upgrade barry to 0.15-1.2~bpo60+1.
  3957. * Internationalization
  3958. - Add basic language support for Russian, Farsi and Vietnamese.
  3959. - Install some Indic fonts.
  3960. - Install some Russian fonts.
  3961. - Add Alt+Shift shortcut to switch keyboard layout.
  3962. * Miscellaneous
  3963. - Support booting in "Windows XP -like camouflage mode":
  3964. · Install homebrewn local .debs for a Windows XP look-alike Gnome theme.
  3965. · Add the "Windows XP Bliss" desktop wallpaper.
  3966. · Added a script that's sets up Gnome to look like Microsoft Windows XP.
  3967. · Add Windows XP "camouflage" icons for some programs.
  3968. · Make Iceweasel use the IE icon when Windows XP camouflage is enabled.
  3969. · Add special launcher icons for the Windows XP theme so that they're
  3970. not too big.
  3971. - Decrease Florence focus zoom to 1.2.
  3972. - Do not fetch APT translation files. Running apt-get update is heavy enough.
  3973. - Add MSN support thanks to msn-pecan.
  3974. - Add custom SSH client configuration:
  3975. · Prefer strong ciphers and MACs.
  3976. · Enable maximum compression level.
  3977.  · Explicitly disable X11 forwarding.
  3978. · Connect as root by default, to prevent fingerprinting when username
  3979. was not specified.
  3980. - Replace flawed FireGPG with a home-made GnuPG encryption applet;
  3981. install a feature-stripped FireGPG that redirects users to
  3982. the documentation, and don't run Seahorse applet anymore.
  3983. - Enable Seahorse's GnuPG agent.
  3984. - Blank screen when lid is closed, rather than shutting down the system.
  3985. The shutdown "feature" has caused data losses for too many people, it seems.
  3986. There are many other ways a Tails system can be shut down in a hurry
  3987. these days.
  3988. - Import Tails signing key into the keyring.
  3989. - Fix bug in the Pidgin nick generation that resulted in the nick
  3990. "XXX_NICK_XXX" once out of twenty.
  3991. - Pre-configure the #tor IRC discussion channel in Pidgin.
  3992. - Fix "technology preview" of bridge support: it was broken by tordate merge.
  3993. - Install dependencies of our USB installer to ease its development.
  3994. - Make vidalia NM hook sleep only if Vidalia is already running.
  3995. - Reintroduce the htpdate notification, telling users when it's safe
  3996. to use Tor Hidden Services.
  3997. - htpdate: omit -f argument to not download full pages.
  3998. - htpdate: write success file even when not within {min,max}adjust.
  3999. Otherwise htpdate will not "succeed" when the time diff is 0 (i.e.
  4000. the clock was already correct) so the success file cannot be used
  4001. as an indicator that the system time now is correct, which arguably
  4002. is its most important purpose.
  4003. * Build system
  4004. - Name built images according to git tag.
  4005. -- Tails developers <tails@boum.org> Wed, 04 Jan 2012 09:56:38 +0100
  4006. tails (0.9) unstable; urgency=low
  4007. * Tor
  4008. - Upgrade to 0.2.2.34 (fixes CVE-2011-2768, CVE-2011-2769).
  4009. * Iceweasel
  4010. - Upgrade to 3.5.16-11 (fixes CVE-2011-3647, CVE-2011-3648, CVE-2011-3650).
  4011. - Upgrade FireGPG to 0.8-1+tails2: notify users that the FireGPG Text
  4012. Editor is the only safe place for performing cryptographic operations,
  4013. and make it impossible to do otherwise. Other ways open up several
  4014. severe attacks through JavaScript (e.g. leaking plaintext when
  4015. decrypting, signing messages written by the attacker).
  4016. - Install Cookie Monster extension instead of CS Lite.
  4017. - Always ask where to save files.
  4018. - Upgrade Torbutton to 1.4.4.1-1, which includes support for the in-browser
  4019. "New identity" feature.
  4020. * Software
  4021. - Install MAT, the metadata anonymisation toolkit.
  4022. - Upgrade TrueCrypt to 7.1.
  4023. - Upgrade WhisperBack to 1.5~rc1 (leads the user by the hand if an error
  4024. occurs while sending the bugreport, proposes to save it after 2 faild
  4025. attempts, numerous bugfixes).
  4026. - Linux: upgrade to linux-image-3.0.0-2-486 (version 3.0.0-6); fixes
  4027. a great number of bugs and security issues.
  4028. * Miscellaneous
  4029. - Fully rework date and time setting system.
  4030. - Remove the htp user firewall exception.
  4031. - Saner keyboard layouts for Arabic and Russian.
  4032. - Use Plymouth text-only splash screen at boot time.
  4033. - Color the init scripts output.
  4034. - Suppress Tor's warning about applications doing their own DNS lookups.
  4035. This is totally safe due to our Tor enforcement.
  4036. - Disable hdparm boot-time service.
  4037. We only want hdparm so that laptop-mode-tools can use it.
  4038. - Run Claws Mail using torify.
  4039. It's not as good as if Claws Mail supported SOCKS proxies itself,
  4040. but still better than relying on the transparent netfilter torification.
  4041. - Install HPLIP and hpcups for better printing support.
  4042. * Erase memory at shutdown
  4043. - Run many sdmem instances at once.
  4044. In hope of erasing more memory until we come up with a proper fix for
  4045. [[bugs/sdmem_does_not_clear_all_memory]].
  4046. - Kill gdm3 instead of using its initscript on brutal shutdown.
  4047. - Use absolute path to eject for more robust memory wipe on boot medium removal.
  4048. * Space savings
  4049. - Exclude kernel and initramfs from being put into the SquashFS.
  4050. Those files are already shipped where they are needed, that is in the ISO
  4051. filesystem. Adapt kexec and memlockd bits.
  4052. - Do not ship the GNOME icon theme cache.
  4053. - Do not ship .pyc files.
  4054. - Do not ship NEWS.Debian.gz files.
  4055. * Build system
  4056. - Re-implement hook that modifies syslinux config to make future
  4057. development easier.
  4058. -- Tails developers <amnesia@boum.org> Tue, 01 Nov 2011 13:26:38 +0100
  4059. tails (0.8.1) unstable; urgency=low
  4060. * Iceweasel
  4061. - Update to 3.5.16-10 (fixes DSA-2313-1).
  4062. - FireGPG: force crypto action results to appear in a new window, otherwise
  4063. JavaScript can steal decrypted plaintext. Advice: always use FireGPG's
  4064. text editor when writing text you want to encrypt. If you write it in a
  4065. textbox the plaintext can be stolen through JavaScript before it is
  4066. encrypted in the same way.
  4067. - Update HTTPS Everywhere extension to 1.0.3-1.
  4068. - Stop using the small version of the Tor check page. The small version
  4069. incorrectly tells Tails users to upgrade their Torbrowser, which has
  4070. confused some users.
  4071. * Software
  4072. - Update Linux to 3.0.0-2 (fixes DSA-2310-1, CVE-2011-2905, CVE-2011-2909,
  4073. CVE-2011-2723, CVE-2011-2699, CVE-2011-1162, CVE-2011-1161).
  4074. - Update usb-modeswitch to 1.1.9-2~bpo60+1 and usb-modeswitch-data to
  4075. 20110805-1~bpo60+1 from Debian backports. This adds support for a few
  4076. devices such as Pantech UMW190 CDMA modem.
  4077. - Install libregexp-common-perl 2011041701-3 from Debian unstable. This
  4078. fixes the bug: [[bugs/msva_does_not_use_configured_keyserver]].
  4079. - Install hdparm so the hard drives can be spinned down in order to save
  4080. battery power.
  4081. - Install barry-util for better BlackBerry integration.
  4082. - Debian security upgrades: OpenOffice.org (DSA-2315-1), openjdk-6
  4083. (DSA-2311-1), policykit-1 (DSA-2319-1)
  4084. * Protecting against memory recovery
  4085. - Set more appropriate Linux VM config before wiping memory. These
  4086. parameters should make the wipe process more robust and efficient.
  4087. -- Tails developers <amnesia@boum.org> Sun, 16 Oct 2011 11:31:18 +0200
  4088. tails (0.8) unstable; urgency=low
  4089. * Rebase on the Debian Squeeze 6.0.2.1 point-release.
  4090. * Tor
  4091. - Update to 0.2.2.33-1.
  4092. - Disabled ControlPort in favour of ControlSocket.
  4093. - Add port 6523 (Gobby) to Tor's LongLivedPorts list.
  4094. * I2P
  4095. - Update to 0.8.8.
  4096. - Start script now depends on HTP since I2P breaks if the clock jumps or is
  4097. too skewed during bootstrap.
  4098. * Iceweasel
  4099. - Update to 3.5.16-9 (fixes CVE-2011-2374, CVE-2011-2376, CVE-2011-2365,
  4100. CVE-2011-2373, CVE-2011-2371, CVE-2011-0083, CVE-2011-2363, CVE-2011-0085,
  4101. CVE-2011-2362, CVE-2011-2982, CVE-2011-2981, CVE-2011-2378, CVE-2011-2984,
  4102. CVE-2011-2983).
  4103. - Enable HTTP pipelining (like TBB).
  4104. - Update HTTPS Everywhere extension to 1.0.1-1 from Debian unstable.
  4105. - Suppress FoxyProxy update prompts.
  4106. - Prevent FoxyProxy from "phoning home" after a detected upgrade.
  4107. - Fixed a bunch of buggy regular expressions in FoxyProxy's configuration.
  4108. See [[bugs/exploitable_typo_in_url_regex?]] for details. Note that none of
  4109. these issues are critical due to the transparent proxy.
  4110. - Add DuckDuckGo SSL search engine.
  4111. * Torbutton
  4112. - Update to torbutton 1.4.3-1 from Debian unstable.
  4113. - Don't show Torbutton status in the status bar as it's now displayed in the
  4114. toolbar instead.
  4115. * Pidgin
  4116. - More random looking nicks in pidgin.
  4117. - Add IRC account on chat.wikileaks.de:9999.
  4118. * HTP
  4119. - Upgrade htpdate script (taken from Git 7797fe9) that allows setting wget's
  4120. --dns-timeout option.
  4121. * Software
  4122. - Update Linux to 3.0.0-1. -686 is now deprecated in favour of -486 and
  4123. -686-pae; the world is not ready for -pae yet, so we now ship -486.
  4124. - Update OpenSSL to 0.9.8o-4squeeze2 (fixes CVE-2011-1945 (revoke
  4125. compromised DigiNotar certificates), CVE-2011-1945).
  4126. - Update Vidalia to 0.2.14-1+tails1 custom package.
  4127. - Install accessibility tools:
  4128. - gnome-mag: screen magnifier
  4129. - gnome-orca: text-to-speech
  4130. - Replace the onBoard virtual keyboard with Florence.
  4131. - Install the PiTIVi non-linear audio/video editor.
  4132. - Install ttdnsd.
  4133. - Install tor-arm.
  4134. - Install lzma.
  4135. * Arbitrary DNS queries
  4136. - Tor can not handle all types of DNS queries, so if the Tor resolver fails
  4137. we fallback to ttdnsd. This is now possible with Tor 0.2.2.x, since we
  4138. fixed Tor bug #3369.
  4139. * Hardware support
  4140. - Install ipheth-utils for iPhone tethering.
  4141. - Install xserver-xorg-input-vmmouse (for mouse integration with the host OS
  4142. in VMWare and KVM).
  4143. - Install virtualbox-ose 4.x guest packages from Debian backports.
  4144. * Miscellaneous
  4145. - Switch gpg to use keys.indymedia.org's hidden service, without SSL.
  4146. The keys.indymedia.org SSL certificate is now self-signed. The hidden
  4147. service gives a good enough way to authenticate the server and encrypts
  4148. the connection, and just removes the certificates management issue.
  4149. - The squashfs is now compressed using XZ which reduces the image size quite
  4150. drastically.
  4151. - Remove Windows autorun.bat and autorun.inf. These files did open a static
  4152. copy of our website, which is not accessible any longer.
  4153. * Build system
  4154. - Use the Git branch instead of the Debian version into the built image's
  4155. filename.
  4156. - Allow replacing efficient XZ compression with quicker gzip.
  4157. - Build and install documentation into the chroot (-> filesystem.squashfs).
  4158. Rationale: our static website cannot be copied to a FAT32 filesystem due
  4159. to filenames being too long. This means the documentation cannot be
  4160. browsed offline from outside Tails. However, our installer creates GPT
  4161. hidden partitions, so the doc would not be browseable from outside Tails
  4162. anyway. The only usecase we really break by doing so is browsing the
  4163. documentation while running a non-Tails system, from a Tails CD.
  4164. -- Tails developers <amnesia@boum.org> Thu, 09 Sep 2011 11:31:18 +0200
  4165. tails (0.7.2) unstable; urgency=high
  4166. * Iceweasel
  4167. - Disable Torbutton's external application launch warning.
  4168. ... which advises using Tails. Tails *is* running Tails.
  4169. - FoxyProxy: install from Debian instead of the older one we previously
  4170. shipped.
  4171. * Software
  4172. - haveged: install an official Debian backport instead of a custom backport.
  4173. - unrar: install the version from Debian's non-free repository.
  4174. Users report unrar-free does not work well enough.
  4175. -- Tails developers <amnesia@boum.org> Sun, 12 Jun 2011 15:34:56 +0200
  4176. tails (0.7.1) unstable; urgency=high
  4177. * Vidalia: new 0.2.12-2+tails1 custom package.
  4178. * Iceweasel
  4179. - Don't show Foxyproxy's status / icon in FF statusbar to prevent users
  4180. from accidentaly / unconsciously put their anonymity at risk.
  4181. - "amnesia branding" extension: bump Iceweasel compatibility to 4.0 to ease
  4182. development of future releases.
  4183. * Software
  4184. - Upgrade Linux kernel to Debian's 2.6.32-33: fixes tons of bugs,
  4185. including the infamous missing mouse cursor one. Oh, and it closes
  4186. a few security holes at well.
  4187. - Install unrar-free.
  4188. - Do not install pppoeconf (superseeded by NetworkManager).
  4189. - Upgrade macchanger to Debian testing package to ease development of
  4190. future Tails releases.
  4191. - Debian security upgrades: x11-xserver-utils (DSA-2213-1), isc-dhcp
  4192. (DSA-2216-1), libmodplug (DSA-2226-1), openjdk-6 (DSA-2224-1).
  4193. * Protecting against memory recovery
  4194. - Add Italian translation for tails-kexec. Thanks to Marco A. Calamari.
  4195. - Make it clear what it may mean if the system does not power off
  4196. automatically.
  4197. - Use kexec's --reset-vga option that might fix display corruption issues
  4198. on some hardware.
  4199. * WhisperBack (encrypted bug reporting software)
  4200. - Upgrade WhisperBack to 1.4.1:
  4201. localizes the documentation wiki's URL,
  4202. uses WebKit to display the bug reporting help page,
  4203. now is usable on really small screens.
  4204. - Extract wiki's supported languages at build time, save this
  4205. information to /etc/amnesia/environment, source this file into the
  4206. Live user's environment so that WhisperBack 1.4+ can make good use
  4207. of it.
  4208. * Miscellaneous
  4209. - Fix boot in Chinese.
  4210. - Install mobile-broadband-provider-info for better 3G support.
  4211. - Add back GNOME system icons to menus.
  4212. - tails-security-check: avoid generating double-slashes in the Atom
  4213. feeds URL.
  4214. - Remove "vga=788" boot parameter which breaks the boot on some hardware.
  4215. - Remove now useless "splash" boot parameter.
  4216. - Fix a bunch of i386-isms.
  4217. - Pass the noswap option to the kernel. This does not change actual Tails
  4218. behaviour but prevents users from unnecessarily worrying because of
  4219. the "Activating swap" boot message.
  4220. - Make use of check.torproject.org's Arabic version.
  4221. * Build system
  4222. - Enable squeeze-backports. It is now ready and will be used soon.
  4223. - Install eatmydata in the chroot.
  4224. - Convert ikiwiki setup files to YAML.
  4225. -- Tails developers <amnesia@boum.org> Fri, 29 Apr 2011 17:14:53 +0200
  4226. tails (0.7) unstable; urgency=low
  4227. * Hardware support
  4228. - Install foomatic-filters-ppds to support more printers.
  4229. - Give the default user the right to manage printers.
  4230. * Software
  4231. - Deinstall unwanted packages newly pulled by recent live-build.
  4232. -- Tails developers <amnesia@boum.org> Wed, 06 Apr 2011 22:58:51 +0200
  4233. tails (0.7~rc2) unstable; urgency=low
  4234. ** SNAPSHOT build @824f39248a08f9e190146980fb1eb0e55d483d71 **
  4235. * Rebase on Debian Squeeze 6.0.1 point-release.
  4236. * Vidalia: new 0.2.10-3+tails5 custom package..
  4237. * Hardware support
  4238. - Install usb-modeswitch and modemmanager to support mobile broadband
  4239. devices such as 3G USB dongles. Thanks to Marco A. Calamari for the
  4240. suggestion.
  4241. * Misc
  4242. - Website relocated to https://tails.boum.org/ => adapt various places.
  4243. - Configure keyboard layout accordingly to the chosen language for
  4244. Italian and Portuguese.
  4245. -- Tails developers <amnesia@boum.org> Fri, 25 Mar 2011 15:44:25 +0100
  4246. tails (0.7~rc1) UNRELEASED; urgency=low
  4247. ** SNAPSHOT build @98987f111fc097a699b526eeaef46bc75be5290a **
  4248. * Rebase on Debian Squeeze.
  4249. * T(A)ILS has been renamed to Tails.
  4250. * Protecting against memory recovery
  4251. New, safer way to wipe memory on shutdown which is now also used when
  4252. the boot media is physically removed.
  4253. * Tor
  4254. - Update to 0.2.1.30-1.
  4255. * Iceweasel
  4256. - Add HTTPS Everywhere 0.9.4 extension.
  4257. - Better preserve Anonymity Set: spoof US English Browser and timezone
  4258. the same way as the Tor Browser Bundle, disable favicons and picture
  4259. iconification.
  4260. - Install AdBlock Plus extension from Debian.
  4261. - Add Tor-related bookmarks.
  4262. - Support FTP, thanks to FoxyProxy.
  4263. - Update AdBlock patterns.
  4264. - Disable geolocation and the offline cache.
  4265. * Software
  4266. - Update Vidalia to 0.2.10-3+tails4.
  4267. - Install gnome-disk-utility (Palimpsest) and Seahorse plugins.
  4268. - Add opt-in i2p support with Iceweasel integration through FoxyProxy.
  4269. - onBoard: fix "really quits when clicking the close window icon" bug.
  4270. - Optionally install TrueCrypt at boot time.
  4271. - Install laptop-mode-tools for better use of battery-powered hardware.
  4272. - Replace xsane with simple-scan which is part of GNOME and way easier
  4273. to use.
  4274. - Upgrade WhisperBack to 1.3.1 (bugfixes, French translation).
  4275. - Install scribus-ng instead of scribus. It is far less buggy in Squeeze.
  4276. * Firewall
  4277. - Drop incoming packets by default.
  4278. - Forbid queries to DNS resolvers on the LAN.
  4279. - Set output policy to drop (defense-in-depth).
  4280. * Hardware support
  4281. - Install Atheros and Broadcom wireless firmwares.
  4282. - Install libsane-hpaio and sane-utils, respectively needed for
  4283. multi-function peripherals and some SCSI scanners.
  4284. * live-boot 2.0.15-1+tails1.35f1a14
  4285. - Cherry-pick our fromiso= bugfixes from upstream 3.x branch.
  4286. * Miscellaneous
  4287. - Many tiny user interface improvements.
  4288. - More robust HTP time synchronization wrt. network failures.
  4289. Also, display the logs when the clock synchronization fails.
  4290. - Disable GNOME automatic media mounting and opening to protect against
  4291. a class of attacks that was recently put under the spotlights.
  4292. Also, this feature was breaking the "no trace is left on local
  4293. storage devices unless explicitly asked" part of Tails specification.
  4294. - Make configuration more similar to the Tor Browser Bundle's one.
  4295. - GnuPG: default to stronger digest algorithms.
  4296. - Many more or less proper hacks to get the built image size under 700MB.
  4297. - Compress the initramfs using LZMA for faster boot.
  4298. * Build system
  4299. - Run lb build inside eatmydata fsync-less environment to greatly improve
  4300. build time.
  4301. -- Tails developers <amnesia@boum.org> Fri, 11 Mar 2011 15:52:19 +0100
  4302. tails (0.6.2) unstable; urgency=high
  4303. * Tor: upgrade to 0.2.1.29 (fixes CVE-2011-0427).
  4304. * Software
  4305. - Upgrade Linux kernel, dpkg, libc6, NSS, OpenSSL, libxml2 (fixes various
  4306. security issues).
  4307. - Upgrade Claws Mail to 3.7.6 (new backport).
  4308. - Install Liferea, tcpdump and tcpflow.
  4309. * Seahorse: use hkp:// transport as it does not support hkps://.
  4310. * FireGPG: use hkps:// to connect to the configured keyserver.
  4311. * Build system: take note of the Debian Live tools versions being used
  4312. to make next point-release process faster.
  4313. * APT: don't ship package indices.
  4314. -- T(A)ILS developers <amnesia@boum.org> Wed, 19 Jan 2011 16:59:43 +0100
  4315. tails (0.6.1) unstable; urgency=low
  4316. * Tor: upgrade to 0.1.28 (fixes CVE-2010-1676)
  4317. * Software: upgrade NSS, Xulrunner, glibc (fixes various security issues)
  4318. * FireGPG: use the same keyserver as the one configured in gpg.conf.
  4319. * Seahorse: use same keyserver as in gpg.conf.
  4320. * HTP: display the logs when the clock synchronization fails.
  4321. * Update HTP configuration: www.google.com now redirects to
  4322. encrypted.google.com.
  4323. * Use the light version of the "Are you using Tor?" webpage.
  4324. * Update AdBlock patterns.
  4325. -- T(A)ILS developers <amnesia@boum.org> Fri, 24 Dec 2010 13:28:29 +0100
  4326. tails (0.6) unstable; urgency=low
  4327. * Releasing 0.6.
  4328. * New OpenPGP signing-only key. Details are on the website:
  4329. https://amnesia.boum.org/GnuPG_key/
  4330. * Iceweasel
  4331. - Fixed torbutton has migrated to testing, remove custom package.
  4332. * HTP
  4333. - Query ssl.scroogle.org instead of lists.debian.org.
  4334. - Don't run when the interface that has gone up is the loopback one.
  4335. * Nautilus scripts
  4336. - Add shortcut to securely erase free space in a partition.
  4337. - The nautilus-wipe shortcut user interface is now translatable.
  4338. * Misc
  4339. - Really fix virtualization warning display.
  4340. - More accurate APT pinning.
  4341. - Disable Debian sid APT source again since a fixed live-config has
  4342. migrated to Squeeze since then.
  4343. * live-boot: upgrade to 2.0.8-1+tails1.13926a
  4344. - Sometimes fixes the smem at shutdown bug.
  4345. - Now possible to create a second partition on the USB stick T(A)ILS is
  4346. running from.
  4347. * Hardware support
  4348. - Support RT2860 wireless chipsets by installing firmware-ralink from
  4349. Debian Backports.
  4350. - Install firmware-linux-nonfree from backports.
  4351. - Fix b43 wireless chipsets by having b43-fwcutter extract firmwares at
  4352. build time.
  4353. * Build system
  4354. - Install live-build and live-helper from Squeeze.
  4355. - Update SquashFS sort file.
  4356. -- T(A)ILS developers <amnesia@boum.org> Wed, 20 Oct 2010 19:53:17 +0200
  4357. tails (0.6~rc3) UNRELEASED; urgency=low
  4358. ** SNAPSHOT build @a3ebb6c775d83d1a1448bc917a9f0995df93e44d **
  4359. * Iceweasel
  4360. - Autostart Iceweasel with the GNOME session. This workarounds the
  4361. "Iceweasel first page is not loaded" bug.
  4362. * HTP
  4363. - Upgrade htpdate script (taken from Git 7797fe9).
  4364. * Misc
  4365. - Disable ssh-agent auto-starting with X session: gnome-keyring is
  4366. more user-friendly.
  4367. - Fix virtualization warning display.
  4368. - Boot profile hook: write desktop file to /etc/skel.
  4369. * Build system
  4370. - Convert build system to live-build 2.0.1.
  4371. - APT: fetch live-build and live-helper from Debian Live snapshots.
  4372. - Remove dependency on live-build functions in chroot_local-hooks.
  4373. This makes the build environment more robust and less dependent on
  4374. live-build internals.
  4375. - Remove hand-made rcS.d/S41tails-wifi: a hook now does this.
  4376. - Measure time used by the lh build command.
  4377. - Fix boot profile hook.
  4378. - Boot profiling: wait a bit more: the current list does not include
  4379. /usr/sbin/tor.
  4380. -- T(A)ILS developers <amnesia@boum.org> Sat, 02 Oct 2010 23:06:46 +0200
  4381. tails (0.6~rc2) UNRELEASED; urgency=low
  4382. ** SNAPSHOT build @c0ca0760ff577a1e797cdddf0e95c5d62a986ec8 **
  4383. * Iceweasel
  4384. - Refreshed AdBlock patterns (20100926).
  4385. - Set network.dns.disableIPv6 to true (untested yet)
  4386. - Torbutton: install patched 1.2.5-1+tails1 to fix the User-Agent bug,
  4387. disable extensions.torbutton.spoof_english again.
  4388. * Software
  4389. - WhisperBack: upgrade to 1.3~beta3 (main change: let the user provide
  4390. optional email address and OpenPGP key).
  4391. - Remove mc.
  4392. - Update haveged backport to 0.9-3~amnesia+lenny1.
  4393. - Update live-boot custom packages (2.0.6-1+tails1.6797e8): fixes bugs
  4394. in persistency and smem-on-shutdown.
  4395. - Update custom htpdate script. Taken from commit d778a6094cb3 in our
  4396. custom Git repository: fixes setting of date/time.
  4397. * Build system
  4398. - Bugfix: failed builds are now (hopefully) detected.
  4399. - Fix permissions on files in /etc/apt/ that are preserved in the image.
  4400. - Install version 2.0~a21-1 of live-build and live-helper in the image.
  4401. We are too late in the release process to upgrade to current Squeeze
  4402. version (2.0~a29-1).
  4403. * Misc
  4404. - Pidgin/OTR: disable the automatic OTR initiation and OTR requirement.
  4405. -- T(A)ILS developers <amnesia@boum.org> Wed, 29 Sep 2010 19:23:17 +0200
  4406. tails (0.6~1.gbpef2878) UNRELEASED; urgency=low
  4407. ** SNAPSHOT build @ef28782a0bf58004397b5fd303f938cc7d11ddaa **
  4408. * Hardware support
  4409. - Use a 2.6.32 kernel: linux-image-2.6.32-bpo.5-686 (2.6.32-23~bpo50+1)
  4410. from backports.org. This should support far more hardware and
  4411. especially a lot of wireless adapters.
  4412. - Add firmware for RTL8192 wireless adapters.
  4413. - Enable power management on all wireless interfaces on boot.
  4414. * Software
  4415. - Install inkscape.
  4416. - Install poedit.
  4417. - Install gfshare and ssss: two complementary implementations
  4418. of Shamir's Secret Sharing.
  4419. - Install tor-geoipdb.
  4420. - Remove dialog, mc and xterm.
  4421. * Iceweasel
  4422. - Set extensions.torbutton.spoof_english to its default true value
  4423. in order to workaround a security issue:
  4424. https://amnesia.boum.org/security/Iceweasel_exposes_a_rare_User-Agent/
  4425. * Monkeysphere
  4426. - Install the Iceweasel extension.
  4427. - Use a hkps:// keyserver.
  4428. * GnuPG
  4429. - Install gnupg from backports.org so that hkps:// is supported.
  4430. - Use a hkps:// keyserver.
  4431. - Proxy traffic via polipo.
  4432. - Prefer up-to-date digests and ciphers.
  4433. * Vidalia: rebased our custom package against 0.2.10.
  4434. * Build system
  4435. - Built images are now named like this:
  4436. tails-i386-lenny-0.5-20100925.iso
  4437. - Use live-helper support for isohybrid options instead of doing the
  4438. conversion ourselves. The default binary image type we build is now
  4439. iso-hybrid.
  4440. - Remove .deb built by m-a after they have been installed.
  4441. - Setup custom GConf settings at build time rather than at boot time.
  4442. - Move $HOME files to /etc/skel and let adduser deal with permissions.
  4443. - Convert to live-boot / live-config / live-build 2.x branches.
  4444. - Replaced our custom live-initramfs with a custom live-boot package;
  4445. included version is 2.0.5-1+tails2.6797e8 from our Git repository:
  4446. git clone git://git.immerda.ch/tails_live-boot.git
  4447. - Install live-config* from the live-snapshots Lenny repository.
  4448. Rationale: live-config binary packages differ depending on the target
  4449. distribution, so that using Squeeze's live-config does not produce
  4450. fully-working Lenny images.
  4451. - Rename custom scripts, packages lists and syslinux menu entries from
  4452. the amnesia-* namespace to the tails-* one.
  4453. * HTP
  4454. - Use (authenticated) HTP instead of NTP.
  4455. - The htpdate script that is used comes from commit 43f5f83c0 in our
  4456. custom repository: git://git.immerda.ch/tails_htp.git
  4457. - Start Tor and Vidalia only once HTP is done.
  4458. * Misc
  4459. - Fix IPv6 firewall restore file. It was previously not used at all.
  4460. - Use ftp.us.debian.org instead of the buggy GeoIP-powered
  4461. cdn.debian.net.
  4462. - Gedit: don't autocreate backup copies.
  4463. - Build images with syslinux>=4.01 that has better isohybrid support.
  4464. - amnesia-security-check: got rid of the dependency on File::Slurp.
  4465. - Take into account the migration of backports.org to backports.debian.org.
  4466. - Make GnuPG key import errors fatal on boot.
  4467. - Warn the user when T(A)ILS is running inside a virtual machine.
  4468. - DNS cache: forget automapped .onion:s on Tor restart.
  4469. * Documentation: imported Incognito's walkthrough, converted to
  4470. Markdown, started the needed adaptation work.
  4471. -- T(A)ILS developers <amnesia@boum.org> Sun, 26 Sep 2010 11:06:50 +0200
  4472. tails (0.5) unstable; urgency=low
  4473. * The project has merged efforts with Incognito.
  4474. It is now to be called "The (Amnesic) Incognito Live System".
  4475. In short: T(A)ILS.
  4476. * Community
  4477. - Created the amnesia-news mailing-list.
  4478. - Added a forum to the website.
  4479. - Created a chatroom on IRC: #tails on irc.oftc.net
  4480. * Fixed bugs
  4481. - Workaround nasty NetworkManager vs. Tor bug that often
  4482. prevented the system to connect to the Tor network: restart Tor and Vidalia
  4483. when a network interface goes up.
  4484. - onBoard now autodetects the keyboard layout... at least once some
  4485. keys have been pressed.
  4486. - New windows don't open in background anymore, thanks to
  4487. a patched Metacity.
  4488. - Memory wiping at shutdown is now lightning fast, and does not prevent
  4489. the computer to halt anymore.
  4490. - GNOME panel icons are right-aligned again.
  4491. - Fixed permissions on APT config files.
  4492. - Repaired mouse integration when running inside VirtualBox.
  4493. * Iceweasel
  4494. - Torbutton: redirect to Scroogle when presented a Google captcha.
  4495. - Revamped bookmarks
  4496. . moved T(A)ILS own website to the personal toolbar
  4497. . moved webmail links (that are expected to be more than 3 soon)
  4498. to a dedicated folder.
  4499. - Don't show AdBlock Plus icon in the toolbar.
  4500. - Adblock Plus: updated patterns, configured to only update subscriptions
  4501. once a year. Which means never, hopefully, as users do update their
  4502. Live system on a regular basis, don't they?
  4503. * Vidalia: rebased our custom package against 0.2.8.
  4504. * Claws Mail
  4505. - Install Claws Mail from backports.org to use the X.509 CA
  4506. certificates provided by Debian.
  4507. - Enable PGP modules with basic configuration:
  4508. . Automatically check signatures.
  4509. . Use gpg-agent to manage passwords.
  4510. . Display warning on start-up if GnuPG doesn't work.
  4511. - Set the IO timeout to 120s (i.e. the double of the default 60s).
  4512. * Pidgin
  4513. - Automatically connect to irc.oftc.net with a randomized nickname,
  4514. so as not to advertize the use of T(A)ILS; this nickname is made of:
  4515. . a random firstname picked from the 2000 most registered by the U.S.
  4516. social security administration in the 70s;
  4517. . two random digits.
  4518. Good old irc.indymedia.org is still configured - with same nickname -
  4519. but is not enabled by default anymore.
  4520. - Disabled MSN support, that is far too often affected by security flaws.
  4521. * Build $HOME programmatically
  4522. - Migrated all GConf settings, including the GNOME panel configuration,
  4523. to XML files that are loaded at boot time.
  4524. - Configure iceweasel profile skeleton in /etc/iceweasel.
  4525. A brand new profile is setup from this skeleton once iceweasel is
  4526. started after boot.
  4527. . build sqlite files at build time from plain SQL.
  4528. . FireGPG: hard-code current firegpg version at build time to prevent
  4529. the extension to think it was just updated.
  4530. . stop shipping binary NSS files. These were here only to
  4531. install CaCert's certificate, that is actually shipped by Debian's
  4532. patched libnss.
  4533. * Build system
  4534. - Updated Debian Live snapshots APT repository URL.
  4535. - Purge all devel packages at the end of the chroot configuration.
  4536. - Make sure the hook that fixes permissions runs last.
  4537. - Remove unwanted Iceweasel search plugins at build time.
  4538. * Misc
  4539. - Added a progress bar for boot time file readahead.
  4540. - Readahead more (~37MB) stuff in foreground at boot time.
  4541. - Make the APT pinning persist in the Live image.
  4542. - localepurge: keep locales for all supported languages,
  4543. don't bother when installing new packages.
  4544. - Removed syslinux help menu: these help pages are either buggy or
  4545. not understandable by non-geeks.
  4546. - Fixed Windows autorun.
  4547. - Disable a few live-initramfs scripts to improve boot time.
  4548. - Firewall: forbid any IPv6 communication with the outside.
  4549. - Virtualization support: install open-vm-tools.
  4550. - WhisperBack: updated to 1.2.1, add a random bug ID to the sent
  4551. mail subject.
  4552. - Prompt for CD removal on shutdown, not for USB device.
  4553. * live-initramfs: new package built from our Git (e2890a04ff) repository.
  4554. - Merged upstream changes up to 1.177.2-1.
  4555. - New noprompt=usb feature.
  4556. - Fix buggy memory wiping and shutdown.
  4557. - Really reboot when asked, rather than shutting down the system.
  4558. * onBoard
  4559. - Upgraded to a new custom, patched package (0.93.0-0ubuntu4~amnesia1).
  4560. - Added an entry in the Applications menu.
  4561. * Software
  4562. - Install vim-nox with basic configuration
  4563. - Install pwgen
  4564. - Install monkeysphere and msva-perl
  4565. - Replaced randomsound with haveged as an additional source of entropy.
  4566. * Hardware support
  4567. - Build ralink rt2570 wifi modules.
  4568. - Build rt2860 wifi modules from Squeeze. This supports the RT2860
  4569. wireless adapter, found particularly in the ASUS EeePC model 901
  4570. and above.
  4571. - Build broadcom-sta-source wifi modules.
  4572. - Bugfix: cpufreq modules were not properly added to /etc/modules.
  4573. - Use 800x600 mode on boot rather than 1024x768 for compatibility
  4574. with smaller displays.
  4575. -- amnesia <amnesia@boum.org> Fri, 30 Apr 2010 16:14:13 +0200
  4576. amnesia (0.4.2) unstable; urgency=low
  4577. New release, mainly aimed at fixing live-initramfs security issue
  4578. (Debian bug #568750), with an additional set of small enhancements as
  4579. a bonus.
  4580. * live-initramfs: new custom package built from our own live-initramfs
  4581. Git repository (commit 8b96e5a6cf8abc)
  4582. - based on new 1.173.1-1 upstream release
  4583. - fixed live-media=removable behaviour so that filesystem images found
  4584. on non-removable storage are really never used (Debian bug #568750)
  4585. * Vidalia: bring back our UI customizations (0.2.7-1~lenny+amnesia1)
  4586. * APT: consistently use the GeoIP-powered cdn.debian.net
  4587. * Software: make room so that {alpha, future} Squeeze images fit on
  4588. 700MB CD-ROM
  4589. - only install OpenOffice.org's calc, draw, impress, math and writer
  4590. components
  4591. - removed OpenOffice.org's English hyphenation and thesaurus
  4592. - removed hunspell, wonder why it was ever added
  4593. * Boot
  4594. - explicitly disable persistence, better safe than sorry
  4595. - removed compulsory 15s timeout, live-initramfs knows how to wait for
  4596. the Live media to be ready
  4597. * Build system: don't cache rootfs anymore
  4598. -- amnesia <amnesia@boum.org> Sun, 07 Feb 2010 18:28:16 +0100
  4599. amnesia (0.4.1) unstable; urgency=low
  4600. * Brown paper bag bugfix release: have amnesia-security-check use
  4601. entries publication time, rather than update time... else tagging
  4602. a security issue as fixed, after releasing a new version, make this
  4603. issue be announced to every user of this new, fixed version.
  4604. -- amnesia <amnesia@boum.org> Sat, 06 Feb 2010 03:58:41 +0100
  4605. amnesia (0.4) unstable; urgency=low
  4606. * We now only build and ship "Hybrid" ISO images, which can be either
  4607. burnt on CD-ROM or dd'd to a USB stick or hard disk.
  4608. * l10n: we now build and ship multilingual images; initially supported
  4609. (or rather wanna-be-supported) languages are: ar, zh, de, en, fr, it,
  4610. pt, es
  4611. - install Iceweasel's and OpenOffice.org's l10n packages for every
  4612. supported language
  4613. - stop installing localized help for OpenOffice.org, we can't afford it
  4614. for enough languages
  4615. - when possible, Iceweasel's homepage and default search engine are localized
  4616. - added Iceweasel's "any language" Scroogle SSL search engine
  4617. - when the documentation icon is clicked, display the local wiki in
  4618. currently used language, if available
  4619. - the Nautilus wipe script is now translatable
  4620. - added gnome-keyboard-applet to the Gnome panel
  4621. * software
  4622. - replaced Icedove with claws mail, in a bit rough way; see
  4623. https://amnesia.boum.org/todo/replace_icedove_with_claws/ for best
  4624. practices and configuration advices
  4625. - virtual keyboard: install onBoard instead of kvkbd
  4626. - Tor controller: install Vidalia instead of TorK
  4627. - install only chosen parts of Gnome, rather than gnome-desktop-environment
  4628. - do not install xdialog, which is unused and not in Squeeze
  4629. - stop installing grub as it breaks Squeeze builds (see Debian bug #467620)
  4630. - install live-helper from snapshots repository into the Live image
  4631. * Iceweasel
  4632. - do not install the NoScript extension anymore: it is not strictly
  4633. necessary but bloodily annoying
  4634. * Provide WhisperBack 1.2 for anonymous, GnuPG-encrypted bug reporting.
  4635. - added dependency on python-gnutls
  4636. - install the SMTP hidden relay's certificate
  4637. * amnesia-security-check: new program that tells users that the amnesia
  4638. version they are running is affected by security flaws, and which ones
  4639. they are; this program is run at Gnome session startup, after sleeping
  4640. 2 minutes to let Tor a chance to initialize.
  4641. Technical details:
  4642. - Perl
  4643. - uses the Desktop Notifications framework
  4644. - fetches the security atom feed from the wiki
  4645. - verifies the server certificate against its known CA
  4646. - tries fetching the localized feed; if it fails, fetch the default
  4647. (English) feed
  4648. * live-initramfs: new custom package built from our own live-initramfs
  4649. Git repository (commit 40e957c4b89099e06421)
  4650. - at shutdown time, ask the user to unplug the CD / USB stick, then run
  4651. smem, wait for it to finish, then attempt to immediately halt
  4652. * build system
  4653. - bumped dependency on live-helper to >= 2.0a6 and adapted our config
  4654. - generate hybrid ISO images by default, when installed syslinux is
  4655. recent enough
  4656. - stop trying to support building several images in a row, it is still
  4657. broken and less needed now that we ship hybrid ISO images
  4658. - scripts/config: specify distribution when initializing defaults
  4659. - updated Debian Live APT repository's signing key
  4660. * PowerPC
  4661. - disable virtualbox packages installing and module building on !i386
  4662. && !amd64, as PowerPC is not a supported guest architecture
  4663. - built and imported tor_0.2.1.20-1~~lenny+1_powerpc.deb
  4664. * Squeeze
  4665. - rough beginnings of a scratch Squeeze branch, currently unsupported
  4666. - install gobby-infinote
  4667. * misc
  4668. - updated GnuPG key with up-to-date signatures
  4669. - more improvements on boot time from CD
  4670. - enhanced the wipe in Nautilus UI (now asks for confirmation and
  4671. reports success or failure)
  4672. - removed the "restart Tor" launcher from the Gnome panel
  4673. -- amnesia <amnesia@boum.org> Fri, 05 Feb 2010 22:28:04 +0100
  4674. amnesia (0.3) unstable; urgency=low
  4675. * software: removed openvpn, added
  4676. - Audacity
  4677. - cups
  4678. - Git
  4679. - Gobby
  4680. - GParted
  4681. - lvm2 (with disabled initscript as it slows-down too much the boot in certain
  4682. circumstances)
  4683. - NetworkManager 0.7 (from backports.org) to support non-DHCP networking
  4684. - ntfsprogs
  4685. - randomsound to enhance the kernel's random pool
  4686. * Tor
  4687. - install the latest stable release from deb.torproject.org
  4688. - ifupdown script now uses SIGHUP signal rather than a whole tor
  4689. restart, so that in the middle of it vidalia won't start it's own
  4690. tor
  4691. - configure Gnome proxy to use Tor
  4692. * iceweasel
  4693. - adblockplus: upgraded to 1.0.2
  4694. - adblockplus: subscribe to US and DE EasyList extensions, updated patterns
  4695. - firegpg is now installed from Debian Squeeze rather than manually; current
  4696. version is then 0.7.10
  4697. - firegpg: use better keyserver ... namely pool.sks-keyservers.net
  4698. - added bookmark to Amnesia's own website
  4699. - use a custom "amnesiabranding" extension to localize the default search
  4700. engine and homepage depending on the current locale
  4701. - updated noscript whitelist
  4702. - disable overriden homepage redirect on iceweasel upgrade
  4703. * pidgin
  4704. - nicer default configuration with verified irc.indymedia.org's SSL cert
  4705. - do not parse incoming messages for formatting
  4706. - hide formatting toolbar
  4707. * hardware compatibility
  4708. - b43-fwcutter
  4709. - beginning of support for the ppc architecture
  4710. - load acpi-cpufreq, cpufreq_ondemand and cpufreq_powersave kernel
  4711. modules
  4712. * live-initramfs: custom, updated package based on upstream's 1.157.4-1, built
  4713. from commit b0a4265f9f30bad945da of amnesia's custom live-initramfs Git
  4714. repository
  4715. - securely erases RAM on shutdown using smem
  4716. - fixes the noprompt bug when running from USB
  4717. - disables local swap partitions usage, wrongly enabled by upstream
  4718. * fully support for running as a guest system in VirtualBox
  4719. - install guest utils and X11 drivers
  4720. - build virtualbox-ose kernel modules at image build time
  4721. * documentation
  4722. - new (translatable) wiki, using ikiwiki, with integrated bugs and todo
  4723. tracking system a static version of the wiki is included in generated
  4724. images and linked from the Desktop
  4725. * build system
  4726. - adapt for live-helper 2.0, and depend on it
  4727. - get amnesia version from debian/changelog
  4728. - include the full version in ISO volume name
  4729. - save .list, .packages and .buildlog
  4730. - scripts/clean: cleanup any created dir in binary_local-includes
  4731. - updated Debian Live snapshot packages repository URL and signing key
  4732. - remove duplicated apt/preferences file, the live-helper bug has been
  4733. fixed
  4734. * l10n: beginning of support for --language=en
  4735. * misc
  4736. - improved boot time on CD by ordering files in the squashfs in the order they
  4737. are used during boot
  4738. - added a amnesia-version script to built images, that outputs the current
  4739. image's version
  4740. - added a amnesia-debug script that prepares a tarball with information that
  4741. could be useful for developpers
  4742. - updated Amnesia GnuPG key to a new 4096R one
  4743. - set time with NTP when a network interface is brought up
  4744. - import amnesia's GnuPG pubkey into the live session user's keyring
  4745. - do not ask DHCP for a specific hostname
  4746. - install localepurge, only keep en, fr, de and es locales, which reduces the
  4747. generated images' size by 100MB
  4748. - added a hook to replace /sbin/swapon with a script that only runs
  4749. /bin/true
  4750. - moved networking hooks responsibility from ifupdown to NetworkManager
  4751. -- amnesia <amnesia@boum.org> Thu, 26 Nov 2009 11:17:08 +0100
  4752. amnesia (0.2) unstable; urgency=low
  4753. * imported /home/amnesia, then:
  4754. - more user-friendly shell, umask 077
  4755. - updated panel, added launcher to restart Tor
  4756. - mv $HOME/bin/* /usr/local/bin/
  4757. - removed metacity sessions
  4758. - removed gstreamer's registry, better keep this dynamically updated
  4759. - rm .qt/qt_plugins_3.3rc, better keep this dynamically updated
  4760. - removed .gnome/gnome-vfs/.trash_entry_cache
  4761. - removed kconf_update log
  4762. - removed and excluded Epiphany configuration (not installed)
  4763. - cleanup .kde
  4764. * iceweasel
  4765. - enable caching in RAM
  4766. - explicitly disable ssl v2, and enable ssl v3 + tls
  4767. - removed prefs for the non-installed webdeveloper
  4768. - removed the SSL Blacklist extension (not so useful, licensing issues)
  4769. - deep profile directory cleanup
  4770. - extensions cleanup: prefer Debian-packaged ones, cleanly reinstalled
  4771. AddBlock Plus and CS Lite to allow upgrading them
  4772. - updated pluginreg.dat and localstore.rdf
  4773. - moved some settings to user.js
  4774. - made cookie/JavaScript whitelists more consistent
  4775. - force httpS on whitelisted sites
  4776. - NoScript: marked google and gmail as untrusted
  4777. - some user interface tweaks, mainly for NoScript
  4778. - FireGPG: disable the buggy auto-detection feature, the link to firegpg's
  4779. homepage in generated pgp messages and the GMail interface (which won't
  4780. work without JavaScript anyway)
  4781. - updated blocklist.xml
  4782. - removed and excluded a bunch of files in the profile directory
  4783. * icedove: clean the profile directory up just like we did for iceweasel
  4784. * software: install msmtp and mutt
  4785. * home-refresh
  4786. - use rsync rather than tar
  4787. * documentation
  4788. - various fixes
  4789. - reviewed pidgin-otr security (see TODO)
  4790. * build system
  4791. - stop calling home-refresh in lh_build
  4792. - include home-refresh in generated images
  4793. - gitignore update
  4794. - fix permissions on local includes at build time
  4795. - updated scripts/{build,clean} wrt. new $HOME handling
  4796. - scripts/{build,config}: stop guessing BASEDIR, we must be run from
  4797. the root of the source directory anyway
  4798. - stop storing /etc/amnesia/version in Git, delete it at clean time
  4799. * release
  4800. - converted Changelog to the Debian format and location, updated
  4801. build scripts accordingly
  4802. - added a README symlink at the root of the source directory
  4803. - basic debian/ directory (not working for building packages yet,
  4804. but at least we can now use git-dch)
  4805. - added debian/gbp.conf with our custom options for git-dch
  4806. - config/amnesia: introduce new $AMNESIA_DEV_* variables to be used
  4807. by developpers' scripts
  4808. - added ./release script: a wrapper around git-dch, git-commit and git-tag
  4809. -- amnesia <amnesia@boum.org> Tue, 23 Jun 2009 14:42:03 +0200
  4810. amnesia (0.1) UNRELEASED; urgency=low
  4811. * Forked Privatix 9.03.15, by Markus Mandalka:
  4812. http://mandalka.name/privatix/index.html.en
  4813. Everything has since been rewritten or so heavily changed that nothing
  4814. remains from the original code... apart of a bunch of Gnome settings.
  4815. * hardware support:
  4816. - install a bunch of non-free wifi firmwares
  4817. - install xsane and add the live user to the scanner group
  4818. - install aircrack-ng
  4819. - install xserver-xorg-video-geode on i386 (eCafe support)
  4820. - install xserver-xorg-video-all
  4821. - install firmware-linux from backports.org
  4822. - install system-config-printer
  4823. - added instructions in README.eCAFE to support the Hercules eCAFE EC-800
  4824. netbook
  4825. * APT:
  4826. - configure pinning to support installing chosen packages from
  4827. squeeze; the APT source for testing is hardcoded in chroot_sources/,
  4828. since there is no way to use $LH_CHROOT_MIRROR in chroot_local-hooks
  4829. - give backports.org priority 200, so that we track upgrades of packages
  4830. installed from there
  4831. * release: include the Changelog and TODO in the generated images,
  4832. in the /usr/share/doc/amnesia/ directory
  4833. * software: install gnomebaker when building Gnome-based live OS, to
  4834. easily clone myself when running from CD
  4835. * build system
  4836. - build i386 images when the build host is amd64
  4837. - added a version file: /etc/amnesia/version
  4838. - use snapshot live-* packages inside the images
  4839. - setup timezone depending on the chosen build locale
  4840. - rely on standard live-initramfs adduser to do our user setup
  4841. (including sudo vs. Gnome/KDE, etc.)
  4842. - stop "supporting" KDE
  4843. - allow building several images at once
  4844. - migrated most of lh_config invocations to scripts/config
  4845. - append "noprompt" so that halting/rebooting work with splashy
  4846. - moved our own variables to config/amnesia, using the namespace
  4847. $AMNESIA_*
  4848. * iceweasel
  4849. - default search engine is now Scroogle SSL, configured to search pages
  4850. in French language; the English one is also installed
  4851. - never ask to save passwords or forms content
  4852. - configured the torbutton extension to use polipo
  4853. - installed the CACert root certificate
  4854. - installed the SSL Blacklist extension and the blacklist data
  4855. - installed the FireGPG extension
  4856. - installed the CS Lite extension
  4857. - installed the NoScript extension
  4858. - NoScript, CS Lite: replaced the default whitelists with a list of
  4859. trusted, non-commercial Internet Service Providers
  4860. - configure extensions (add to prefs.js):
  4861. user_pref("extensions.torbutton.startup", true);
  4862. user_pref("extensions.torbutton.startup_state", 1);
  4863. user_pref("extensions.torbutton.tor_enabled", true);
  4864. user_pref("noscript.notify.hide", true);
  4865. user_pref("capability.policy.maonoscript.sites", "about:
  4866. about:blank about:certerror about:config about:credits
  4867. about:neterror about:plugins about:privatebrowsing
  4868. about:sessionrestore chrome: resource:");
  4869. user_pref("extensions.firegpg.no_updates", true);
  4870. - install the NoScript plugin from Debian squeeze
  4871. - delete urlclassifier3.sqlite on $HOME refresh: as we disabled
  4872. "safebrowsing", this huge file is of no use
  4873. - torbutton: install newer version from Squeeze
  4874. * linux: removed non-686 kernel flavours when building i386 images
  4875. * compatibility: append "live-media=removable live-media-timeout=15", to
  4876. prevent blindly booting another debian-live installed on the hard disk
  4877. * software: added
  4878. - gnome-app-install
  4879. - iwconfig
  4880. - cryptkeeper: Gnome system tray applet to encrypt files with EncFS
  4881. - kvkbd: virtual keyboard (installed from backports.org)
  4882. - sshfs (and added live user to the fuse group)
  4883. - less, secure-delete, wipe, seahorse, sshfs, ntfs-3g
  4884. - scribus
  4885. * Tor
  4886. - enable the transparent proxy, the DNS resolver, and the control port
  4887. - save authentication cookie to /tmp/control_auth_cookie, so that the
  4888. live user can use Tork and co.
  4889. - autostart Tork with Gnome
  4890. - Tork: installed, disabled most notifications and startup tips
  4891. - added a restart tor hook to if-up.d (used by Network Manager as well),
  4892. so that Tor does work immediately even if the network cable was
  4893. plugged late in/after the boot process
  4894. * $HOME
  4895. - added a nautilus-script to wipe files and directories
  4896. - bash with working completion for the live user
  4897. * polipo: install and configure this HTTP proxy to forward requests
  4898. through Tor
  4899. * DNS: install and configure pdnsd to forward any DNS request through
  4900. the Tor resolver
  4901. * firewall: force every outgoing TCP connection through the Tor
  4902. transparent proxy, discard any outgoing UDP connection
  4903. * misc
  4904. - set syslinux timeout to 4 seconds
  4905. - use splashy for more user-friendly boot/halt sequences
  4906. -- amnesia <amnesia@boum.org> Sat, 20 Jun 2009 21:09:15 +0200