Major new features and changes

• Install Tor 0.2.8.7. (Closes: #11351)

• Enable kASLR in the Linux kernel. (Closes: #11281)

• Upgrade Icedove to 1:45.2.0-1~deb8u1+zerotracepen1: (Closes: #11714)
  · Drop auto-fetched configurations using Oauth2. They do not
  work together with Torbirdy since it disables needed
  functionality (like JavaScript and cookies) in the embedded
  browser. This should make auto-configuration work for GMail
  again, for instance. (Closes: ##11536)
  · Pin Icedove to be installed from our APT repo. Debian's
  Icedove packages still do not have our secure Icedove
  autoconfig wizard patches applied, so installing them would be
  a serious security regression. (Closes: #11613)
  · Add missing icedove-l10n-* packages to our custom APT
  repository (Closes: #11550)

• Upgrade to Linux 4.6: (Closes: #10298)
  · Install the 686 kernel flavour instead of the obsolete 586
  one.
  · APT, dpkg: add amd64 architecture. The amd64 kernel flavour is
  not built anymore for the i386 architecture, so we need to use
  multiarch now.
  · Build and install the out-of-tree aufs4 module. (Closes: #10298)
  · Disable kernel modesetting for QXL: it's not compatible with
  Jessie's QXL X.Org driver.

• Security fixes

• Hopefully fixed an issue which would sometimes make the Greeter
  ignore the "disable networking" or "bridge mode"
  options. (Closes: #11593)

• Minor improvements

• Install firmware-intel-sound and firmware-ti-connectivity. This
  adds support for some sound cards and Wi-Fi adapters. (Closes:

  11502)

• Install OpenPGP Applet from Debian. (Closes: #10190)

• Port the "About Zero Trace Pen" dialog to python3.

• Run our initramfs memory erasure hook earlier (Closes:

  10733). The goal here is to:

  · save a few seconds on shutdown (it might matter especially for
  the emergency one);
  · work in a less heavily multitasking / event-driven
  environment, for more robust operation.

• Install rngd, and make rng-tools initscript return success when
  it can't find any hardware RNG device. Most Zero Trace Pen systems around
  probably have no such device, and we don't want systemd to
  believe they failed to boot properly. (Closes: #5650)

• Don't force using the vboxvideo X.Org driver. According to our
  tests, this forced setting is:
  · harmful: it breaks X startup when the vboxvideo kernel
  driver is loaded;
  · useless: X.Org now autodetects the vboxvideo X.Org driver and
  uses it when running in VirtualBox and the vboxvideo kernel
  is not present.

• Port boot-profile to python3 (Closes: #10083). Thanks to
  heartsucker heartsucker@autistici.org for the patch!

• Include /proc/cmdline and the content of persistent APT sources
  in WhisperBack bug reports. (Closes: #11675, #11635)

• Disable non-free APT sources at boot time. (Closes: #10130)

• Have a dedicated page for the homepage of Tor Browser in
  Zero Trace Pen. (Closes: # 11725)

• Only build the VirtualBox kernel modules for the 32-bit kernel.
  It's both hard and useless to build it for 64-bit in the current
  state of things, as long as we're shipping a 32-bit userspace.
  Also, install virtualbox-* from jessie-backports, since the
  version in Jessie is not compatible with Linux 4.x.

• Build system

• Don't install+remove dpatch during the build. It's not been
  needed in this hook for ages.

• Bump BUILD_SPACE_REQUIREMENT: at least one of us needed that to
  build feature/10298-linux-4.x-aufs with the gzipcomp option.

• Test suite

• Send Zero Trace Pen Installer's debug log to the Cucumber debug log on
  failure. This is meant to debug #10720 since I can't
  reproduce it locally.

• Give the system under testing 2 vCPUs. (Closes: #6729)

• Split scenarios from checks.feature. (Closes: #5707)

• Add retry-logic to the Synaptic tests. (Closes: #10412, #10441,

  10991)

• Run usb_upgrade.feature earlier, when there is enough free disk
  space left. (Closes: #11582)

• Use more recent virtual hardware in the system under test,
  i.e. USB 3.0 (nec-xhci) on a pc-i440fx-2.5 machine. Switching
  USB controllers has helped with problems we see on Jenkins when
  booting from USB (#11588). Also, there are chances that more
  recent virtual hardware sees more testing these days, so it
  sounds potentially useful to "upgrade".

• Add support for Cucumber 2.4. (Closes: #11690)

• Always write {pretty,debug} logs and JSON output to the artifact
  directory.

• Disable info level logging on Chutney nodes to save disk
  space. For our network all these add up to > 1 GiB and we didn't
  take this into account when budgeting RAM to the isotesters on
  Jenkins.