Feature #14714

Consider upgrading to Stretch 9.2 in Tails 3.3

Added by intrigeri 2017-09-24 09:34:41 . Updated 2017-11-15 11:34:05 .

Status:

Resolved

Priority:

High

Assignee:

Category:

Target version:

Tails_3.3

Start date:

2017-09-24

Due date:

% Done:

100%

Feature Branch:

feature/14789-linux-4.13

Type of work:

Code

Blueprint:

Starter:

Affected tool:

Deliverable for:

Description

It will be released on Oct 7. As usual, we need to balance the risk of regressions (that the limited QA/testing we do on our bugfix releases may fail to catch) with the benefit of fixing a bunch of bugs.

As usual, since we have APT snapshots it’s not just a matter of enabling stretch-proposed-updates: instead, it’s a matter of bumping the APT snapshots we use for Debian entirely. The good news is that we already have a branch that tracks that, and it’s called devel :)

Subtasks

Related issues

Blocks Tails - ~~Feature #13244~~: Core work 2017Q4: Foundations Team	Resolved	2017-06-29
Blocks Tails - ~~Feature #14789~~: Upgrade to Linux 4.13	Resolved	2017-10-05

History

#1 Updated by intrigeri 2017-09-24 09:34:53

blocks ~~Feature #13244~~: Core work 2017Q4: Foundations Team added

#2 Updated by intrigeri 2017-09-24 09:37:33

Meta: I wouldn’t mind if anonym took this over from me :)

#3 Updated by intrigeri 2017-09-29 13:35:25

Description updated

#4 Updated by intrigeri 2017-10-09 15:18:47

related to ~~Feature #14789~~: Upgrade to Linux 4.13 added

#5 Updated by intrigeri 2017-11-08 15:37:47

related to deleted (~~~~Feature #14789~~: Upgrade to Linux 4.13~~)

#6 Updated by intrigeri 2017-11-08 15:37:54

blocks ~~Feature #14789~~: Upgrade to Linux 4.13 added

#7 Updated by intrigeri 2017-11-08 15:45:35

Status changed from Confirmed to In Progress
% Done changed from 0 to 10
Feature Branch set to feature/14714-bump-APT-snapshots

I’ll run a full test suite on the topic branch == stable + thaw APT snapshots + update Tor Browser profile patch.

#8 Updated by intrigeri 2017-11-08 15:48:26

Priority changed from Normal to Elevated

#9 Updated by intrigeri 2017-11-08 17:39:35

Well, it’s not that easy: Linux 4.12 is not in sid anymore, so if we’re going to bump APT snapshots without upgrading to Linux 4.13, then we’ll have to upload it to our custom APT repo. So I’ll do my evaluation of both matters on ~~Feature #14789~~ for now.

#10 Updated by intrigeri 2017-11-08 20:31:13

Assignee changed from intrigeri to anonym
% Done changed from 10 to 50
QA Check set to Ready for QA
Feature Branch changed from feature/14714-bump-APT-snapshots to feature/14789-linux-4.13

Test suite is happy: ~~Feature #14789#note-19~~.

build-manifest diff since 3.2 is big, but seems reasonable (basically a truckload of bugfixes and minor security fixes, see below).

So I say go for it.

@@ -1,11 +1,11 @@
 ---
 origin_references:
   debian:
-    reference: '2017091504'
+    reference: '2017110802'
   debian-security:
-    reference: '2017092504'
+    reference: '2017110802'
   torproject:
-    reference: '2017091503'
+    reference: '2017110802'
 packages:
   binary:
   - arch: amd64
@@ -64,13 +64,13 @@
     version: '0.3'
   - arch: amd64
     package: apt-utils
-    version: 1.4.7
+    version: 1.4.8
   - arch: amd64
     package: apt
-    version: 1.4.7
+    version: 1.4.8
   - arch: amd64
     package: at-spi2-core
-    version: 2.22.0-6
+    version: 2.22.0-6+deb9u1
   - arch: all
     package: audacity-data
     version: 2.1.2-2
@@ -79,7 +79,7 @@
     version: 2.1.2-2
   - arch: amd64
     package: aufs-dkms
-    version: 4.12+20170904-1
+    version: 4.13+20171002-1
   - arch: all
     package: autoconf
     version: 2.69-10
@@ -118,7 +118,7 @@
     version: 0.5.2.1
   - arch: amd64
     package: bind9-host
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: binutils
     version: 2.28-5
@@ -265,7 +265,7 @@
     version: 2.2.1-8
   - arch: amd64
     package: curl
-    version: 7.52.1-5
+    version: 7.52.1-5+deb9u2
   - arch: amd64
     package: dash
     version: 0.5.8-2.4
@@ -277,13 +277,13 @@
     version: 5.0.0~beta~repack-2
   - arch: all
     package: dbus-user-session
-    version: 1.10.18-1
+    version: 1.10.22-0+deb9u1
   - arch: amd64
     package: dbus-x11
-    version: 1.10.18-1
+    version: 1.10.22-0+deb9u1
   - arch: amd64
     package: dbus
-    version: 1.10.18-1
+    version: 1.10.22-0+deb9u1
   - arch: amd64
     package: dconf-cli
     version: 0.26.0-2+b1
@@ -319,7 +319,7 @@
     version: 1.0.89
   - arch: all
     package: desktop-base
-    version: 9.0.2
+    version: 9.0.2+deb9u1
   - arch: amd64
     package: desktop-file-utils
     version: 0.23-1.0tails1
@@ -340,7 +340,7 @@
     version: 1:3.5-3
   - arch: amd64
     package: dirmngr
-    version: 2.1.18-6
+    version: 2.1.18-8~deb9u1
   - arch: all
     package: distro-info-data
     version: '0.36'
@@ -359,9 +359,6 @@
   - arch: all
     package: dmz-cursor-theme
     version: 0.4.4
-  - arch: amd64
-    package: dnsutils
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
   - arch: all
     package: doc-debian
     version: '6.4'
@@ -808,7 +805,7 @@
     version: 0.19.8.1-2
   - arch: amd64
     package: ghostscript
-    version: 9.20~dfsg-3.2
+    version: 9.20~dfsg-3.2+deb9u1
   - arch: all
     package: gimp-data
     version: 2.8.18-1
@@ -823,7 +820,7 @@
     version: 2.22.0-1
   - arch: amd64
     package: gir1.2-atspi-2.0
-    version: 2.22.0-6
+    version: 2.22.0-6+deb9u1
   - arch: amd64
     package: gir1.2-caribou-1.0
     version: 0.4.21-1+b1
@@ -850,7 +847,7 @@
     version: 3.22.0-1
   - arch: amd64
     package: gir1.2-gdkpixbuf-2.0
-    version: 2.36.5-2.0tails2
+    version: 2.36.5-2+deb9u1.0tails1
   - arch: amd64
     package: gir1.2-gdm-1.0
     version: 3.22.3-3
@@ -892,7 +889,7 @@
     version: 2.4.11-3
   - arch: amd64
     package: gir1.2-javascriptcoregtk-4.0
-    version: 2.16.3-2
+    version: 2.16.6-0+deb9u1
   - arch: amd64
     package: gir1.2-json-1.0
     version: 1.2.6-1
@@ -901,7 +898,7 @@
     version: 3.22.4-1+tail1
   - arch: amd64
     package: gir1.2-nautilus-3.0
-    version: 3.22.3-1
+    version: 3.22.3-1+deb9u1
   - arch: amd64
     package: gir1.2-networkmanager-1.0
     version: 1.6.2-3+0.tails1
@@ -949,16 +946,16 @@
     version: 2.4.11-3
   - arch: amd64
     package: gir1.2-webkit2-4.0
-    version: 2.16.3-2
+    version: 2.16.6-0+deb9u1
   - arch: amd64
     package: gir1.2-wnck-3.0
     version: 3.20.1-3
   - arch: all
     package: git-man
-    version: 1:2.11.0-3+deb9u1
+    version: 1:2.11.0-3+deb9u2
   - arch: amd64
     package: git
-    version: 1:2.11.0-3+deb9u1
+    version: 1:2.11.0-3+deb9u2
   - arch: amd64
     package: gjs
     version: 1.46.0-1+b2
@@ -1066,16 +1063,16 @@
     version: 3.22.0-1
   - arch: amd64
     package: gnupg-agent
-    version: 2.1.18-6
+    version: 2.1.18-8~deb9u1
   - arch: amd64
     package: gnupg1
     version: 1.4.21-4
   - arch: all
     package: gnupg2
-    version: 2.1.18-6
+    version: 2.1.18-8~deb9u1
   - arch: amd64
     package: gnupg
-    version: 2.1.18-6
+    version: 2.1.18-8~deb9u1
   - arch: all
     package: gnustep-base-common
     version: 1.24.9-3.1
@@ -1090,7 +1087,7 @@
     version: 0.6-1+b2
   - arch: amd64
     package: gpgv
-    version: 2.1.18-6
+    version: 2.1.18-8~deb9u1
   - arch: amd64
     package: grep
     version: 2.27-2
@@ -1177,7 +1174,7 @@
     version: 0.3.0+b1
   - arch: amd64
     package: haveged
-    version: 1.9.1-5
+    version: 1.9.1-5+deb9u1
   - arch: amd64
     package: hdparm
     version: 9.51+ds-1
@@ -1187,9 +1184,6 @@
   - arch: amd64
     package: hopenpgp-tools
     version: 0.19.4-3
-  - arch: all
-    package: host
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
   - arch: amd64
     package: hostname
     version: 3.18+b1
@@ -1261,13 +1255,13 @@
     version: 0.8.19
   - arch: all
     package: imagemagick-6-common
-    version: 8:6.9.7.4+dfsg-11+deb9u1
+    version: 8:6.9.7.4+dfsg-11+deb9u2
   - arch: amd64
     package: imagemagick-6.q16
-    version: 8:6.9.7.4+dfsg-11+deb9u1
+    version: 8:6.9.7.4+dfsg-11+deb9u2
   - arch: amd64
     package: imagemagick
-    version: 8:6.9.7.4+dfsg-11+deb9u1
+    version: 8:6.9.7.4+dfsg-11+deb9u2
   - arch: all
     package: init-system-helpers
     version: '1.48'
@@ -1339,7 +1333,7 @@
     version: 23-2
   - arch: all
     package: krb5-locales
-    version: 1.15-1
+    version: 1.15-1+deb9u1
   - arch: all
     package: laptop-mode-tools
     version: 1.71-2
@@ -1390,10 +1384,10 @@
     version: 2.11.0-3
   - arch: amd64
     package: libapt-inst2.0
-    version: 1.4.7
+    version: 1.4.8
   - arch: amd64
     package: libapt-pkg5.0
-    version: 1.4.7
+    version: 1.4.8
   - arch: all
     package: libarchive-tar-wrapper-perl
     version: 0.23-1
@@ -1453,7 +1447,7 @@
     version: 6.3.0-18
   - arch: amd64
     package: libatspi2.0-0
-    version: 2.22.0-6
+    version: 2.22.0-6+deb9u1
   - arch: amd64
     package: libattr1
     version: 1:2.4.47-2+b2
@@ -1486,19 +1480,19 @@
     version: 0.5.4-4+b1
   - arch: amd64
     package: libavcodec57
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: amd64
     package: libavfilter6
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: amd64
     package: libavformat57
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: amd64
     package: libavresample3
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: amd64
     package: libavutil55
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: all
     package: libb-hooks-endofscope-perl
     version: 0.21-1
@@ -1510,7 +1504,7 @@
     version: 0.1.18-1
   - arch: amd64
     package: libbind9-140
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: libblas-common
     version: 3.7.0-2
@@ -1825,10 +1819,10 @@
     version: 2.2.1-8
   - arch: amd64
     package: libcurl3-gnutls
-    version: 7.52.1-5
+    version: 7.52.1-5+deb9u2
   - arch: amd64
     package: libcurl3
-    version: 7.52.1-5
+    version: 7.52.1-5+deb9u2
   - arch: all
     package: libdata-optlist-perl
     version: 0.110-1
@@ -1852,13 +1846,13 @@
     version: 0.2.10-4+b1
   - arch: amd64
     package: libdb5.3++
-    version: 5.3.28-12+b1
+    version: 5.3.28-12+deb9u1
   - arch: amd64
     package: libdb5.3
-    version: 5.3.28-12+b1
+    version: 5.3.28-12+deb9u1
   - arch: amd64
     package: libdbus-1-3
-    version: 1.10.18-1
+    version: 1.10.22-0+deb9u1
   - arch: amd64
     package: libdbus-glib-1-2
     version: 0.108-2
@@ -1918,13 +1912,10 @@
     version: 2.9.37-1
   - arch: amd64
     package: libdns-export162
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u1
-  - arch: amd64
-    package: libdns-export162
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: libdns162
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: libdotconf0
     version: 1.3-0.2
@@ -2197,9 +2188,6 @@
     version: 3.20.0-5.1
   - arch: amd64
     package: libgcrypt20
-    version: 1.7.6-2+deb9u1
-  - arch: amd64
-    package: libgcrypt20
     version: 1.7.6-2+deb9u2
   - arch: amd64
     package: libgd3
@@ -2215,10 +2203,10 @@
     version: 1.8.3-14
   - arch: amd64
     package: libgdk-pixbuf2.0-0
-    version: 2.36.5-2.0tails2
+    version: 2.36.5-2+deb9u1.0tails1
   - arch: all
     package: libgdk-pixbuf2.0-common
-    version: 2.36.5-2.0tails2
+    version: 2.36.5-2+deb9u1.0tails1
   - arch: amd64
     package: libgdm1
     version: 3.22.3-3
@@ -2344,7 +2332,7 @@
     version: 1.24.9-3.1
   - arch: amd64
     package: libgnutls30
-    version: 3.5.8-5+deb9u2
+    version: 3.5.8-5+deb9u3
   - arch: amd64
     package: libgoa-1.0-0b
     version: 3.22.5-1
@@ -2389,10 +2377,10 @@
     version: 0.3.2-2
   - arch: all
     package: libgs9-common
-    version: 9.20~dfsg-3.2
+    version: 9.20~dfsg-3.2+deb9u1
   - arch: amd64
     package: libgs9
-    version: 9.20~dfsg-3.2
+    version: 9.20~dfsg-3.2+deb9u1
   - arch: amd64
     package: libgsasl7
     version: 1.8.0-8+b2
@@ -2413,7 +2401,7 @@
     version: 1.2.2-1
   - arch: amd64
     package: libgssapi-krb5-2
-    version: 1.15-1
+    version: 1.15-1+deb9u1
   - arch: amd64
     package: libgssdp-1.0-3
     version: 1.0.1-1
@@ -2503,7 +2491,7 @@
     version: 1.4.2-1
   - arch: amd64
     package: libhavege1
-    version: 1.9.1-5
+    version: 1.9.1-5+deb9u1
   - arch: amd64
     package: libhidapi-hidraw0
     version: 0.8.0~rc1+git20140818.d17db57+dfsg-1
@@ -2512,7 +2500,7 @@
     version: 0.8.0~rc1+git20140818.d17db57+dfsg-1
   - arch: amd64
     package: libhogweed4
-    version: 3.3-1+b1
+    version: 3.3-1+b2
   - arch: amd64
     package: libhpmud0
     version: 3.16.11+repack0-3
@@ -2572,7 +2560,7 @@
     version: 1.33-1
   - arch: amd64
     package: libidn2-0
-    version: 0.16-1
+    version: 0.16-1+deb9u1
   - arch: amd64
     package: libiec61883-0
     version: 1.2.0-2
@@ -2659,19 +2647,16 @@
     version: 1.0.4-6+b1
   - arch: amd64
     package: libisc-export160
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u1
-  - arch: amd64
-    package: libisc-export160
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: libisc160
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: libisccc140
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: libisccfg140
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: libisl15
     version: 0.18-1
@@ -2698,7 +2683,7 @@
     version: 2.4.11-3
   - arch: amd64
     package: libjavascriptcoregtk-4.0-18
-    version: 2.16.3-2
+    version: 2.16.6-0+deb9u1
   - arch: amd64
     package: libjbig0
     version: 2.1-3.1+b2
@@ -2734,7 +2719,7 @@
     version: 1.20-2+b1
   - arch: amd64
     package: libk5crypto3
-    version: 1.15-1
+    version: 1.15-1+deb9u1
   - arch: amd64
     package: libkate1
     version: 0.4.1-7+b1
@@ -2752,10 +2737,10 @@
     version: 2016.20160513.41080.dfsg-2
   - arch: amd64
     package: libkrb5-3
-    version: 1.15-1
+    version: 1.15-1+deb9u1
   - arch: amd64
     package: libkrb5support0
-    version: 1.15-1
+    version: 1.15-1+deb9u1
   - arch: amd64
     package: libksba8
     version: 1.3.5-2
@@ -2773,10 +2758,10 @@
     version: 2.8-4
   - arch: amd64
     package: libldap-2.4-2
-    version: 2.4.44+dfsg-5
+    version: 2.4.44+dfsg-5+deb9u1
   - arch: all
     package: libldap-common
-    version: 2.4.44+dfsg-5
+    version: 2.4.44+dfsg-5+deb9u1
   - arch: amd64
     package: libldb1
     version: 2:1.1.27-1+b1
@@ -2857,7 +2842,7 @@
     version: 1.7-1
   - arch: amd64
     package: liblwres141
-    version: 1:9.10.3.dfsg.P4-12.3+deb9u2
+    version: 1:9.10.3.dfsg.P4-12.3+deb9u3
   - arch: amd64
     package: liblz4-1
     version: 0.0~r131-2+b1
@@ -2878,13 +2863,13 @@
     version: 1:5.30-1+deb9u1
   - arch: amd64
     package: libmagick++-6.q16-7
-    version: 8:6.9.7.4+dfsg-11+deb9u1
+    version: 8:6.9.7.4+dfsg-11+deb9u2
   - arch: amd64
     package: libmagickcore-6.q16-3
-    version: 8:6.9.7.4+dfsg-11+deb9u1
+    version: 8:6.9.7.4+dfsg-11+deb9u2
   - arch: amd64
     package: libmagickwand-6.q16-3
-    version: 8:6.9.7.4+dfsg-11+deb9u1
+    version: 8:6.9.7.4+dfsg-11+deb9u2
   - arch: amd64
     package: libmbim-glib4
     version: 1.14.0-1+b1
@@ -3058,13 +3043,13 @@
     version: 0.27-1
   - arch: amd64
     package: libnautilus-extension1a
-    version: 3.22.3-1
+    version: 3.22.3-1+deb9u1
   - arch: amd64
     package: libncurses5
-    version: 6.0+20161126-1
+    version: 6.0+20161126-1+deb9u1
   - arch: amd64
     package: libncursesw5
-    version: 6.0+20161126-1
+    version: 6.0+20161126-1+deb9u1
   - arch: amd64
     package: libndp0
     version: 1.6-1+b1
@@ -3094,7 +3079,7 @@
     version: 1.0.6-2
   - arch: amd64
     package: libnettle6
-    version: 3.3-1+b1
+    version: 3.3-1+b2
   - arch: amd64
     package: libnewt0.52
     version: 0.52.19-1+b1
@@ -3145,7 +3130,7 @@
     version: 2:4.12-6
   - arch: amd64
     package: libnss3
-    version: 2:3.26.2-1.1
+    version: 2:3.26.2-1.1+deb9u1
   - arch: amd64
     package: libntfs-3g871
     version: 1:2016.2.22AR.1+dfsg-1
@@ -3214,7 +3199,7 @@
     version: 2.2.0-11+b1
   - arch: amd64
     package: libopenjp2-7
-    version: 2.1.2-1.1
+    version: 2.1.2-1.1+deb9u2
   - arch: amd64
     package: libopenmpt0
     version: 0.2.7386~beta20.3-3+deb9u2
@@ -3394,7 +3379,7 @@
     version: 0.1~svn20101010-5
   - arch: amd64
     package: libpostproc54
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: amd64
     package: libpotrace0
     version: 1.13-3
@@ -3718,7 +3703,7 @@
     version: 0.18.5-3.1
   - arch: amd64
     package: libselinux1
-    version: 2.6-3+b1
+    version: 2.6-3+b3
   - arch: all
     package: libsemanage-common
     version: 2.6-2
@@ -3760,7 +3745,7 @@
     version: 2.29.2-1
   - arch: amd64
     package: libsmbclient
-    version: 2:4.5.8+dfsg-2+deb9u2
+    version: 2:4.5.12+dfsg-2
   - arch: amd64
     package: libsnappy1v5
     version: 1.1.3-3
@@ -3811,7 +3796,7 @@
     version: 0.2.8-1
   - arch: amd64
     package: libspeechd2
-    version: 0.8.6-4
+    version: 0.8.6-4+deb9u1
   - arch: amd64
     package: libspeex1
     version: 1.2~rc1.2-1+b2
@@ -3838,9 +3823,15 @@
     version: 1.7.0-1
   - arch: amd64
     package: libssl1.0.2
+    version: 1.0.2l-2+deb9u1
+  - arch: amd64
+    package: libssl1.0.2
     version: 1.0.2l-2
   - arch: amd64
     package: libssl1.1
+    version: 1.1.0f-3+deb9u1
+  - arch: amd64
+    package: libssl1.1
     version: 1.1.0f-3
   - arch: amd64
     package: libstartup-notification0
@@ -3892,10 +3883,10 @@
     version: 2.17-2
   - arch: amd64
     package: libswresample2
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: amd64
     package: libswscale4
-    version: 7:3.2.7-1~deb9u1
+    version: 7:3.2.8-1~deb9u1
   - arch: all
     package: libsyntax-keyword-junction-perl
     version: 0.003008-1
@@ -3973,7 +3964,7 @@
     version: 2.3000-2
   - arch: amd64
     package: libtinfo5
-    version: 6.0+20161126-1
+    version: 6.0+20161126-1+deb9u1
   - arch: amd64
     package: libtk8.6
     version: 8.6.6-1+b1
@@ -4129,10 +4120,10 @@
     version: 1.12.0-1
   - arch: amd64
     package: libwbclient0
-    version: 2:4.5.8+dfsg-2+deb9u2
+    version: 2:4.5.12+dfsg-2
   - arch: amd64
     package: libwebkit2gtk-4.0-37
-    version: 2.16.3-2
+    version: 2.16.6-0+deb9u1
   - arch: amd64
     package: libwebkitgtk-3.0-0
     version: 2.4.11-3
@@ -4165,7 +4156,7 @@
     version: 3.20.1-3
   - arch: amd64
     package: libwpd-0.10-10
-    version: 0.10.1-5
+    version: 0.10.1-5+deb9u1
   - arch: amd64
     package: libwpg-0.3-3
     version: 0.3.1-3
@@ -4303,7 +4294,7 @@
     version: 1:1.5.2-4
   - arch: amd64
     package: libxfont2
-    version: 1:2.0.1-3
+    version: 1:2.0.1-3+deb9u1
   - arch: amd64
     package: libxft2
     version: 2.3.2-1+b2
@@ -4442,6 +4433,9 @@
   - arch: amd64
     package: libzmq5
     version: 4.2.1-4
+  - arch: amd64
+    package: libzstd1
+    version: 1.1.2-1
   - arch: all
     package: libzvbi-common
     version: 0.2.35-13
@@ -4459,22 +4453,22 @@
     version: '4.5'
   - arch: amd64
     package: linux-compiler-gcc-6-x86
-    version: 4.12.12-2
+    version: 4.13.10-1
   - arch: amd64
-    package: linux-headers-4.12.0-2-amd64
-    version: 4.12.12-2
+    package: linux-headers-4.13.0-1-amd64
+    version: 4.13.10-1
   - arch: all
-    package: linux-headers-4.12.0-2-common
-    version: 4.12.12-2
+    package: linux-headers-4.13.0-1-common
+    version: 4.13.10-1
   - arch: amd64
-    package: linux-image-4.12.0-2-amd64
-    version: 4.12.12-2
+    package: linux-image-4.13.0-1-amd64
+    version: 4.13.10-1
   - arch: amd64
-    package: linux-kbuild-4.12
-    version: 4.12.12-2
+    package: linux-kbuild-4.13
+    version: 4.13.10-1
   - arch: amd64
     package: linux-libc-dev
-    version: 4.9.30-2+deb9u5
+    version: 4.9.51-1
   - arch: all
     package: live-boot-initramfs-tools
     version: 1:20170112
@@ -4609,7 +4603,7 @@
     version: 2.7.4-1
   - arch: all
     package: nautilus-data
-    version: 3.22.3-1
+    version: 3.22.3-1+deb9u1
   - arch: amd64
     package: nautilus-gtkhash
     version: 0.7.0-4
@@ -4618,16 +4612,16 @@
     version: 0.3-1
   - arch: amd64
     package: nautilus
-    version: 3.22.3-1
+    version: 3.22.3-1+deb9u1
   - arch: all
     package: ncurses-base
-    version: 6.0+20161126-1
+    version: 6.0+20161126-1+deb9u1
   - arch: amd64
     package: ncurses-bin
-    version: 6.0+20161126-1
+    version: 6.0+20161126-1+deb9u1
   - arch: all
     package: ncurses-term
-    version: 6.0+20161126-1
+    version: 6.0+20161126-1+deb9u1
   - arch: all
     package: netbase
     version: '5.4'
@@ -4663,7 +4657,7 @@
     version: 0.9.2-1
   - arch: amd64
     package: open-vm-tools
-    version: 2:10.1.5-5055683-4
+    version: 2:10.1.5-5055683-4+deb9u1
   - arch: all
     package: openpgp-applet
     version: 1.0-1
@@ -4672,7 +4666,7 @@
     version: 1:7.4p1-10+deb9u1
   - arch: amd64
     package: openssl
-    version: 1.1.0f-3
+    version: 1.1.0f-3+deb9u1
   - arch: amd64
     package: p11-kit-modules
     version: 0.23.3-2
@@ -4705,9 +4699,6 @@
     version: 1.8.20-1
   - arch: amd64
     package: perl-base
-    version: 5.24.1-3+deb9u1
-  - arch: amd64
-    package: perl-base
     version: 5.24.1-3+deb9u2
   - arch: all
     package: perl-modules-5.24
@@ -5113,7 +5104,7 @@
     version: 1.6.5-1
   - arch: all
     package: python3-speechd
-    version: 0.8.6-4
+    version: 0.8.6-4+deb9u1
   - arch: all
     package: python3-stem
     version: 1.5.3-1
@@ -5182,13 +5173,13 @@
     version: 8.24.0-1
   - arch: amd64
     package: samba-libs
-    version: 2:4.5.8+dfsg-2+deb9u2
+    version: 2:4.5.12+dfsg-2
   - arch: amd64
     package: sane-utils
     version: 1.0.25-4.1
   - arch: amd64
     package: scdaemon
-    version: 2.1.18-6
+    version: 2.1.18-8~deb9u1
   - arch: all
     package: scribus-data
     version: 1.4.6+dfsg-4
@@ -5230,13 +5221,13 @@
     version: 0.8-1
   - arch: amd64
     package: speech-dispatcher-audio-plugins
-    version: 0.8.6-4
+    version: 0.8.6-4+deb9u1
   - arch: amd64
     package: speech-dispatcher-espeak-ng
-    version: 0.8.6-4
+    version: 0.8.6-4+deb9u1
   - arch: amd64
     package: speech-dispatcher
-    version: 0.8.6-4
+    version: 0.8.6-4+deb9u1
   - arch: amd64
     package: spice-vdagent
     version: 0.17.0-1
@@ -5293,7 +5284,7 @@
     version: 1.0.3
   - arch: amd64
     package: tails-installer
-    version: 5.0.1+dfsg-0tails1
+    version: 5.0.1+dfsg-0tails1+bugfix.14809~1.gbp64627f
   - arch: all
     package: tails-iuk
     version: 2.12-1
@@ -5503,10 +5494,10 @@
     version: 2.5.3+dfsg-3
   - arch: all
     package: tor-geoipdb
-    version: 0.3.0.10-1~d90.stretch+1
+    version: 0.3.1.8-2~d90.stretch+1
   - arch: amd64
     package: tor
-    version: 0.3.0.10-1~d90.stretch+1
+    version: 0.3.1.8-2~d90.stretch+1
   - arch: amd64
     package: torsocks
     version: 2.2.0-1.0tails1
@@ -5587,24 +5578,27 @@
     version: 2.29.2-1
   - arch: all
     package: vim-common
-    version: 2:8.0.0197-4
+    version: 2:8.0.0197-4+deb9u1
   - arch: amd64
     package: vim-tiny
-    version: 2:8.0.0197-4
+    version: 2:8.0.0197-4+deb9u1
   - arch: all
     package: virtualbox-guest-dkms
-    version: 5.1.28-dfsg-1
+    version: 5.2.0-dfsg-4
   - arch: amd64
     package: virtualbox-guest-utils
-    version: 5.1.28-dfsg-1
+    version: 5.2.0-dfsg-4
   - arch: amd64
     package: virtualbox-guest-x11
-    version: 5.1.28-dfsg-1
+    version: 5.2.0-dfsg-4
   - arch: all
     package: wamerican
     version: 7.1-1
   - arch: amd64
     package: wget
+    version: 1.18-5+deb9u1
+  - arch: amd64
+    package: wget
     version: 1.18-5
   - arch: amd64
     package: whiptail
@@ -5614,7 +5608,7 @@
     version: 1.7.13
   - arch: amd64
     package: whois
-    version: 5.2.15
+    version: 5.2.17~deb9u1
   - arch: all
     package: wireless-regdb
     version: 2016.06.10-1
@@ -5623,7 +5617,7 @@
     version: 30~pre9-12+b1
   - arch: amd64
     package: wpasupplicant
-    version: 2:2.4-1
+    version: 2:2.4-1+deb9u1
   - arch: amd64
     package: x11-apps
     version: 7.7+6+b1
@@ -5695,7 +5689,7 @@
     version: 1.3.4-3+b1
   - arch: all
     package: xkb-data
-    version: 2.19-1
+    version: 2.19-1+deb9u1
   - arch: all
     package: xml-core
     version: '0.17'
@@ -5776,7 +5770,7 @@
     version: 2:1.19.3-1
   - arch: amd64
     package: xxd
-    version: 2:8.0.0197-4
+    version: 2:8.0.0197-4+deb9u1
   - arch: amd64
     package: xz-utils
     version: 5.2.2-1.2+b1
@@ -5799,4 +5793,4 @@
   - package: syslinux
     version: 3:6.03+dfsg-14.1
   - package: torbrowser-launcher
-    version: 0.2.8-1
+    version: 0.2.8-4

#11 Updated by intrigeri 2017-11-08 21:04:34

Note that I did not extend the expiration date of the APT snapshots (I’ll let you do this if you decide to merge this), and did not bumped APT snapshots for the Vagrant build box (I don’t think it would be very useful so I picked the most conservative option).

#12 Updated by anonym 2017-11-11 14:41:36

Status changed from In Progress to Fix committed
Assignee deleted (~~anonym~~)
% Done changed from 50 to 100
QA Check changed from Ready for QA to Pass

#13 Updated by intrigeri 2017-11-11 16:28:59

Status changed from Fix committed to In Progress
Assignee set to anonym
Priority changed from Elevated to High
% Done changed from 100 to 90
QA Check deleted (~~Pass~~)
Type of work changed from Research to Code

intrigeri wrote:
> Note that I did not extend the expiration date of the APT snapshots (I’ll let you do this if you decide to merge this),

Apparently you missed this comment. We’ll need these snapshots until 3.5.

> and did not bumped APT snapshots for the Vagrant build box (I don’t think it would be very useful so I picked the most conservative option).

So please make sure the snapshots we still use for the Vagrant build box will survive until 3.5.

#14 Updated by anonym 2017-11-12 17:06:55

Assignee changed from anonym to intrigeri
QA Check set to Info Needed

intrigeri wrote:
> intrigeri wrote:
> > Note that I did not extend the expiration date of the APT snapshots (I’ll let you do this if you decide to merge this),
>
> Apparently you missed this comment.

I didn’t miss it, but I forgot it, and I feel like it’s not a first time exactly. Might I propose that we try to make these comments stand out more? For instance:

⚠ Extra merge steps

Also bump the APT snapshots

(Exact code: “h1. ⚠ Extra merge steps”)

What do you think?

> We’ll need these snapshots until 3.5.

Origin 'debian' uses snapshot '2017110802' which expires on: Thu, 22 Mar 2018 16:41:06 +0000
Origin 'debian-security' uses snapshot 'latest' which expires on: never
Origin 'torproject' uses snapshot '2017110802' which expires on: Thu, 22 Mar 2018 16:41:10 +0000

> So please make sure the snapshots we still use for the Vagrant build box will survive until 3.5.

Origin 'debian' uses snapshot '2017091504' which expires on: Thu, 22 Mar 2018 16:41:14 +0000
Origin 'debian-security' uses snapshot '2017091504' which expires on: 
Origin 'tails' uses snapshot '2017091504' which expires on: Thu, 22 Mar 2018 16:41:23 +0000

Note the missing date for debian-security — I looked at this URL (thanks to the snippet in the end of release_process.mdwn):

http://time-based.snapshots.deb.tails.boum.org/debian-security/dists/stable/snapshots/2017091504/Release

which doesn’t exist. In fact, .../debian-security/dists/stable doesn’t exist, but .../debian-security/dists/stretch does, although it doesn’t have dists but just updates. What’s going on here? We need a snapshots of debian-security when building the base box (during provisioning (before each Tails build) it will update using the latest debian-security though). Since building the base box is currently possible we apparently do save them, but not at that location? Please clarify, sensei!

#15 Updated by intrigeri 2017-11-13 08:18:28

Assignee changed from intrigeri to anonym
QA Check changed from Info Needed to Dev Needed

> I didn’t miss it, but I forgot it, and I feel like it’s not a first time exactly. Might I propose that we try to make these comments stand out more? For instance:

OK, I’ll try to keep this in mind.

>> So please make sure the snapshots we still use for the Vagrant build box will survive until 3.5.

> Origin 'debian' uses snapshot '2017091504' which expires on: Thu, 22 Mar 2018 16:41:14 +0000
> Origin 'debian-security' uses snapshot '2017091504' which expires on: 
> Origin 'tails' uses snapshot '2017091504' which expires on: Thu, 22 Mar 2018 16:41:23 +0000
>

> Note the missing date for debian-security — I looked at this URL (thanks to the snippet in the end of release_process.mdwn):
>

> http://time-based.snapshots.deb.tails.boum.org/debian-security/dists/stable/snapshots/2017091504/Release
>

> which doesn’t exist. In fact, .../debian-security/dists/stable doesn’t exist, but
> .../debian-security/dists/stretch does, although it doesn’t have dists but just
> updates. What’s going on here? We need a snapshots of debian-security when
> building the base box (during provisioning (before each Tails build) it will update
> using the latest debian-security though). Since building the base box is currently
> possible we apparently do save them, but not at that location?
> Please clarify, sensei!

The directory structure for debian-security (http://security.debian.org/dists/stretch/updates/) is different from the other archives. I think what you’re looking for is e.g. https://time-based.snapshots.deb.tails.boum.org/debian-security/dists/stretch/updates/snapshots/2017091504/Release

I suspect the snippet to check these in the release process doc was working fine in the general case (snapshots used in the ISO) but then it was applied as-is to the Vagrant snapshots, without taking this special case into account (we freeze debian-security snapshots for Vagrant too, as you know).

#16 Updated by anonym 2017-11-13 11:30:10

Status changed from In Progress to Fix committed
Assignee deleted (~~anonym~~)
% Done changed from 90 to 100
QA Check changed from Dev Needed to Pass

intrigeri wrote:
> > I didn’t miss it, but I forgot it, and I feel like it’s not a first time exactly. Might I propose that we try to make these comments stand out more? For instance:
>
> OK, I’ll try to keep this in mind.

Thanks! Hopefully I’ll fuck up less (and with that I also mean that my perspective isn’t that it now is your responsibility to remember presenting merge steps like that to me).

> The directory structure for debian-security (http://security.debian.org/dists/stretch/updates/) is different from the other archives. I think what you’re looking for is e.g. https://time-based.snapshots.deb.tails.boum.org/debian-security/dists/stretch/updates/snapshots/2017091504/Release
>
> I suspect the snippet to check these in the release process doc was working fine in the general case (snapshots used in the ISO) but then it was applied as-is to the Vagrant snapshots, without taking this special case into account (we freeze debian-security snapshots for Vagrant too, as you know).

Thanks! Now it checks Vagrant’s snapshots too: commit:5e7a38b21b9a052069295c260266c44e387885cb

config/APT_snapshots.d:
* Archive 'debian' uses snapshot '2017110802' which expires on: Thu, 22 Mar 2018 16:41:06 +0000
* Archive 'debian-security' uses snapshot 'latest' which expires on: never
* Archive 'torproject' uses snapshot '2017110802' which expires on: Thu, 22 Mar 2018 16:41:10 +0000
---
vagrant/definitions/tails-builder/config/APT_snapshots.d:
* Archive 'debian' uses snapshot '2017091504' which expires on: Thu, 22 Mar 2018 16:41:14 +0000
* Archive 'debian-security' uses snapshot '2017091504' which expires on: Thu, 22 Mar 2018 16:41:20 +0000
* Archive 'tails' uses snapshot '2017091504' which expires on: Thu, 22 Mar 2018 16:41:23 +0000
---

#17 Updated by anonym 2017-11-15 11:34:05

Status changed from Fix committed to Resolved