zerotracepen (3.12)

Major changes

• Make the USB image the main supported way to install Zero Trace Pen (refs: #15292).
  On first boot, grow the system partition to a size that's a factor
  of the size of the boot medium and randomize GUIDs (Closes: #15319).
• Upgrade Linux to 4.19, version 4.19.13-1 (Closes: #16073, #16224).
  Fixes CVE-2018-19985, CVE-2018-19406, CVE-2018-16862, CVE-2018-18397,
  CVE-2018-18397, CVE-2018-18397, CVE-2018-18397, CVE-2018-19824,
  CVE-2018-14625.
• Remove Liferea (Closes: #11082, #15776).
• Upgrade to the Debian Stretch 9.6 point-release.

• Security fixes

  • Upgrade Tor Browser to 8.0.5 (MFSA-2019-02; Closes: #16388).
  • Upgrade Thunderbird to 60.4.0 (DSA-4362-1; Closes: #16261).
  • Upgrade OpenSSL to 1.0.2q-1~deb9u1 (DSA-4355-1).
  • Upgrade libarchive to 3.2.2-2+deb9u1 (DSA-4360-1).
  • Upgrade GnuTLS to 3.5.8-5+deb9u4 (CVE-2018-10844, CVE-2018-10845).
  • Upgrade libgd3 to 2.2.4-2+deb9u3 (CVE-2018-1000222, CVE-2018-5711).
  • Upgrade libmspack to 0.5-1+deb9u3 (CVE-2018-18584, CVE-2018-18585).
  • Upgrade libopenmpt to 0.2.7386~beta20.3-3+deb9u3 (CVE-2018-10017).
  • Upgrade libx11 to 2:1.6.4-3+deb9u1 (CVE-2018-14598, CVE-2018-14599,
    CVE-2018-14600).
  • Upgrade libxcursor to 1:1.1.14-1+deb9u2 (CVE-2015-9262).
  • Upgrade NetworkManager to 1.6.2-3+deb9u2+0.zerotracepen1 (CVE-2018-15688).
  • Upgrade wpa to 2:2.4-1+deb9u2 (CVE-2018-14526).
  • Upgrade zeromq3 to 4.2.1-4+deb9u1 (CVE-2019-6250).
  • Upgrade APT to 1.4.9 (DSA-4371-1).
  • Upgrade GhostScript to 9.26a~dfsg-0+deb9u1 (DSA-4372-1).

• Bugfixes

  • Fix Totem's access to the Internet when it's started from the Applications
    menu.
  • Rename HTP pools to avoid confusion (Closes: #15428).
  • Fix memory erasure on shutdown with systemd v239+, by mounting
    a dedicated tmpfs on /run/initramfs instead of trying to remount /run
    with the "exec" option (Closes: #16097).
  • Make the KeePassX wrapper dialog translatable.
  • Fix detection of first Thunderbird run.

• Minor improvements and updates

  • Upgrade tor to 0.3.4.9-1~d90.stretch+1.
  • Upgrade Mesa to 18.2.6-1~bpo9+1, libdrm to 2.4.95-1~bpo9+1,
    and libglvnd to 1.1.0-1~bpo9+1.
  • Upgrade firmware-linux and firmware-nonfree to 20190114-1.
  • Upgrade amd64-microcode to 3.20181128.1.
  • Upgrade intel-microcode to 3.20180807a.2~bpo9+1.
  • Remove the boot readahead feature (Closes: #15915).
    In most supported use cases, it did not improve boot time anymore,
    or even increases it.
  • Require TLS 1.2 in our Upgrader and zerotracepen-security-check (Closes: 11815).
  • Enable O_CREAT restriction in /tmp directories for FIFOs and regular
    files (Closes: #16072).
  • Upgrade systemd to 240-4~bpo9+0zerotracepen1 (Closes: #16352).
    Fixes CVE-2018-16864, CVE-2018-16865, and CVE-2018-16866.
  • Upgrade Enigmail to 2.0.8-5~deb9u1 (Closes: #15657).
  • Upgrade Torbirdy to 0.2.6-1~bpo9+1 (Closes: #15661).
  • Modify Torbirdy configuration in a way that's easier to maintain.
  • Tell the user they need to use sudo when they attempt to use su
    (Closes: #15583).

• Build system

  • Make the build of the USB image reproducible (Closes: #15985).
  • Allow specifying which set of APT snapshots shall be used during
    the build, with the APT_SNAPSHOTS_SERIALS build option (Closes: #15107).
  • Fix more GIDs and display more information when changing UIDs or GIDs
    fails (Closes: #16036).
  • Remove obsolete patches, refresh remaining ones to apply on top
    of currently installed packages version.
  • Disable irrelevant recurring jobs in Vagrant build box (refs: #16177)
    that increase the chance of FTBFS due to mksquashfs being reaped
    by the OOM killer.
  • Adjust for recent GnuPG error'ing out when it has no controlling terminal.

• Test suite

  • Adjust test suite for USB image:
    • Add tests that exercise behavior on first boot from a device
      installed using the USB image (Closes: #16003).
    • Drop tests for use cases we don't support anymore with the introduction
      of the USB image (refs: #16004).
    • Adjust remaining tests to focus on main supported use cases,
      i.e. Zero Trace Pen installed from a USB image (refs: #16004.
  • In scenarios where we simulate MAC spoofing failure, test safety-critical
    properties even if the desktop notification is buggy (refs: #10774).
  • Update expected title for our Redmine (Closes: #16237).
  • Update expected image for OpenPGP key search.