Major changes
All changes brought by Zero Trace Pen 2.12.
Upgrade to a new snapshot of the Debian and Torproject
APT repositories (2017041704).
Security improvements
Enable the buddy page allocator free poisoning (Closes: #12089).
Enable slub/slab allocator free poisoning (Closes: #12090).
Create IUKs (automatic upgrades) in a reproducible manner
(Closes: #11974).
Minor improvements
Firewall: forbid the _apt user to talk to DNS ports. APT works very well
without DNS access since we only have Onion APT sources, so let's silence
the logs.
Replace Pidgin's "systray" icon with the guifications plugin
(Closes: #11741). We're trying to remove as much as we can from
the set of icons managed by TopIcons extension flavours, in the hope
it's enough to cancel the problems we've seen with them (#10576, #11737).
Disable apt-daily.timer, that can only cause problems in our context
(Closes: #12390).
Do not let pppd-dns manage /etc/resolv.conf (Closes: #12401).
Ensure rootless X.Org can access /dev/fb0 when started by GDM.
Include the amdgpu module in the initramfs (refs: #12218).
Zero Trace Pen Greeter: don't mention 'firewall' anymore (#12382).
Zero Trace Pen Greeter: avoid the popover menu for Formats being cut,
in most cases (Closes: #12249).
Zero Trace Pen Greeter: disable the screensaver (Closes: #12370).
Zero Trace Pen Greeter: fix behavior when pressing Enter in the language selection
menu (Closes: #12359).
Bugfixes
Install speech-dispatcher-espeak-ng to fix the Orca screen reader
(Closes: #12389).
Install xserver-xorg-video-intel and use it on a few graphics adapters
that are not supported correctly by the modesetting driver (refs: #12219).
More PCI IDs will be added as new affected hardware is reported.
Test suite
Run on a Q35 2.8 machine (Closes: #11605).
Deprecate xtightvncviewer in favor of tigervnc-viewer.
Test the Unsafe Browser in 3 random supported languages, not all.
This should be enough to identify most future regressions in this area,
and will be much faster than testing them all.
Pidgin tests: switch to an image that doesn't depend on the
topic of zerotracepen@conference.riseup.net.
Fix a problematic use of try_for.
Fix VM.select_virtual_desktop() and VM.do_focus().
Random Gherkin improvements.
Fix a focus issue for GNOME Terminal vs. Zero Trace Pen Installer.
Adjust to kernel memory poisoning being enabled, which breaks the way
we used to test memory erasure (refs: #12354):
· Drop "no memory erasure" and "memory erasure" tests, that can't work
anymore.
· Test erasure of memory freed by a killed userspace process.
· Test that memory poisoning applies to unmounted tmpfs.
· Test that memory poisoning applies to read and write cache
for unmounted vfat and LUKS-encrypted ext4.
· Run erase_memory a bit later, it requires less disk space nowadays.