Major new features and changes

• Upgrade Tor Browser to 6.0.1 based on Firefox 45.2. (Closes:

  11403, #11513).

• Enable Icedove's automatic configuration wizard. We patch the
  wizard to only use secure protocols when probing, and only
  accept secure protocols, while keeping the improvements done by
  TorBirdy in its own non-automatic configuration wizard. (Closes:

  6158, #11204)

• Security fixes

• Upgrade bsdtar and libarchive13 to 3.1.2-11+deb8u1.

• Upgrade icedove to 38.8.0-1~deb8u1+zerotracepen3.

• Upgrade imagemagick to 8:6.8.9.9-5+deb8u3.

• Upgrade libexpat1 to 2.1.0-6+deb8u2.

• Upgrade libgd3 to 2.1.0-5+deb8u3.

• Upgrade gdk-pixbuf-based packages to 2.31.1-2+deb8u5.

• Upgrade libidn11 to 1.29-1+deb8u1.

• Upgrade libndp0 to 1.4-2+deb8u1.

• Upgrade poppler-based packages to 0.26.5-2+deb8u1.

• Upgrade librsvg2-2 to 2.40.5-1+deb8u2.

• Upgrade libsmbclient to 2:4.2.10+dfsg-0+deb8u3.

• Upgrade OpenSSL to 1.0.1k-3+deb8u5.

• Upgrade libtasn1-6 to 4.2-3+deb8u2.

• Upgrade libxml2 to 2.9.1+dfsg1-5+deb8u2.

• Upgrade openjdk-7-jre to 7u101-2.6.6-1~deb8u1.

• Bugfixes

• Enable Packetization Layer Path MTU Discovery for IPv4. If any
  system on the path to the remote host has a MTU smaller than the
  standard Ethernet one, then Zero Trace Pen will receive an ICMP packet
  asking it to send smaller packets. Our firewall will drop such
  ICMP packets to the floor, and then the TCP connection won't
  work properly. This can happen to any TCP connection, but so far
  it's been reported as breaking obfs4 for actual users. Thanks to
  Yawning for the help! (Closes: #9268)

• Make Zero Trace Pen Upgrader ship other locales than English. (Closes:

  10221)

• Make it possible to add local USB printers again. Bugfix on
  Zero Trace Pen 2.0. (Closes #10965).

• Minor improvements

• Remove custom SSH ciphers and MACs settings. (Closes: #7315)

• Bring back "minimize" and "maximize" buttons in titlebars by
  default. (Closes: #11270)

• Icedove improvements:

  • Stop patching in our default into Torbirdy. We've upstreamed
    some parts, and the rest we set with pref branch overrides in
    /etc/xul-ext/torbirdy.js. (Closes: #10905)
  • Use hkps keyserver in Enigmail. (Closes: #10906)
  • Default to POP if persistence is enabled, IMAP is
    not. (Closes: #10574)
  • Disable remote email account creation in Icedove. (Closes:

    10464)

• Firewall hardening (Closes: #11391):

  • Don't accept RELATED packets. This enables quite a lot of code
    in the kernel that we don't need. Let's reduce the attack
    surface a bit.
  • Restrict debian-tor user to NEW TCP syn packets. It doesn't
    need to do more, so let's do a little bit of security in
    depth.
  • Disable netfilter's nf_conntrack_helper.
  • Fix disabling of automatic conntrack helper assignment.

• Kernel hardening:

  • Set various kernel boot options: slab_nomerge slub_debug=FZ
    mce=0 vsyscall=none. (Closes: #11143)
  • Remove the kernel .map files. These are only useful for kernel
    debugging and slightly make things easier for malware, perhaps
    and otherwise just occupy disk space. Also stop exposing
    kernel memory addresses through /proc etc. (Closes: #10951)

• Drop zenity hacks to "focus" the negative answer. Jessie's
  zenity introduced the --default-cancel option, finally!
  (Closes: #11229)

• Drop useless APT pinning for Linux.

• Remove gnome-tweak-tool. (Closes: #11237)

• Install python-dogtail, to enable accessibility technologies in
  our automated test suite (see below). (Part of: #10721)

• Install libdrm and mesa from jessie-backports. (Closes: #11303)

• Remove hledger. (Closes: #11346)

• Don't pre-configure the #zerotracepen chan on the default OFTC account.
  (Part of: #11306)

• Install onioncircuits from jessie-backports. (Closes: #11443)

• Remove nmh. (Closes: #10477)

• Drop Debian experimental APT source: we don't use it.

• Use APT codenames (e.g. "stretch") instead of suites, to be
  compatible with our tagged APT snapshots.

• Drop module-assistant hook and its cleanup. We've not been using
  it since 2010.

• Remove 'Reboot' and 'Power Off' entries from Applications →
  System Tools. (Closes: #11075)

• Pin our custom APT repo to the same level as Debian ones, and
  explicitly pin higher the packages we want to pull from our custom
  APT repo, when needed.

• config/chroot_local-hooks/59-libdvd-pkg: verify libdvdcss
  package installation. (Closes: #11420)

• Make Zero Trace Pen Upgrader use our new mirror pool design. (Closes:

  11123)

• Drop custom OpenSSH client ciphers and MACs settings. We did a
  pretty bad job at maintaining them compared to the Debian
  upstream. (Closes: #7315)

• Install jessie-backports version of all binary packages built
  from src:hplip. This adds support for quite a few new
  printers.

• Install printer-driver-postscript-hp, which adds support for
  some more printers.

• Build system

• Use a freezable APT repo when building Zero Trace Pen. This is a first
  step towards reproducible builds, and improves our QA and
  development processes by making our builds more predictable. For
  dezerotracepen, see: https://zerotracepen.boum.org/contribute/APT_repository/

• There has been a massive amount of improvements to the
  Vagrant-based build system, and now it could be considered the
  de-facto build system for Zero Trace Pen! Improvements and fixes include:

  • Migrate Vagrant to use libvirt/KVM instead of
    Virtualbox. (Closes: #6354)
  • Make apt-get stuff non-interactive while provisioning.
    Because there is no interaction, so that will results in
    errors.
  • Bump disk space (=> RAM for RAM builds) needed to build with
    Vagrant. Since the Jessie migration it seems impossible to
    keep this low enough to fit in 8 GiB or RAM. For this reason
    we also drop the space optimization where we build inside a
    crazy aufs stack; now we just build in a tmpfs.
  • Clean up apt-cacher-ng cache on vm:provision to save disk
    space on the builder.
  • Add convenient Rake task for SSH:ing into the builder VM:
    rake vm:ssh.
  • Add rake task for generating a new Vagrant base box.
  • Automatically provision the VM on build to keep things up-to-date.
  • Don't enable extproxy unless explicitly given as an
    option. Previously it would automatically be enabled when
    http_proxy is set in the environment, unlike what is
    documented. This will hopefully lead to fewer surprises for users
    who e.g. point http_proxy to a torified polipo, or similar.
  • Re-fetch tags when running build-zerotracepen with Vagrant. That
    should fix an annoyance related to #7182 that I frequently
    encounter: when I, as the RM, rebuild the release image the
    second time from the force-updated tag, the build system would
    not have the force-updated tag. (Closes: #7182)
  • Make sure we use the intended locale in the Zero Trace Pen builder VM.
    Since we communicate via SSH, and e.g. Debian forward the
    locale env vars by default, we have to take some steps
    ensuring we do not do that.

• Pull monkeysphere from stretch to avoid failing to install under
  eatmydata. Patch submitted by Cyril Brulebois cyril@debamax.com.

• Test suite

• Add wrapper around dogtail (inside Zero Trace Pen) for "remote" usage in
  the automated test suite. This provides a simple interface for
  generating dogtail python code, sending it to the guest, and
  executing it, and should allow us to write more robust tests
  leveraging assistive technologies. (Closes: #10721)

• A few previously sikuli-based tests has been migrated to use
  dogtail instead, e.g. GNOME Applications menu interaction.

• Add a test for re-configuring an existing persistent volume.
  This is a regression test for #10809. (Closes: #10834)

• Use a simulated Tor network provided by Chutney in the automated
  test suite. The main motivation here is improved robustness --
  since the "Tor network" we now use will exit from the host
  running the automated test suite, we won't have to deal with Tor
  network blocking, or unreliable circuits. Performance should
  also be improved. (Closes: #9521)

• Drop the usage of Tor Check in our tests. It doesn't make sense
  now when we use Chutney since that always means it will report
  that Tor is not being used.

• Stop testing obsolete pluggable transports.

• Completely rewrite the firewall leak detector to something more
  flexible and expressive.

• Run tcpdump with --immediate-mode for the network sniffer. With
  this option, "packets are delivered to tcpdump as soon as they
  arrive, rather than being buffered for efficiency" which is
  required to make the sniffing work reliable the way we use it.

• Remove most scenarios testing "tordate". It just isn't working
  well in Zero Trace Pen, so we shouldn't expect the tests to actually work
  all of the time. (Closes: #10440)

• Close Pidgin before we inspect or persist its accounts.xml.
  I've seen a case when that file is not saved (and thus, not
  persisted) if we shut down the system while Pidgin is still
  running. (Closes: #11413)

• Close the GNOME Notification bar by pressing ESC, instead of
  opening the Applications menu. The Applications menu often
  covers other elements that we're looking for on the
  screen. (Closes #11401)

• Hide Florence keyboard window when it doesn't vanish by itself
  (Closes: #11398) and wait a bit less for Florence to disappear
  (Closes: #11464).